Collaborative risk aware authentication

1. A method comprising:

broadcasting, by an initiator device, a witness request to a plurality of authentication devices, wherein the plurality of authentication devices determine one or more assurance levels with respect to the initiator device, respectively, from a range of assurance levels and determine a token share corresponding to the one or more assurance levels, respectively;

receiving, by the initiator device from the plurality of authentication devices, a plurality of witness responses comprising a set of token shares corresponding to an assurance level among the one or more assurance levels, wherein each of the token shares is a portion of an authentication token or determined using a key share that is a fraction of a cryptographic key;

generating, by the initiator device, the authentication token, by using the token shares of the set; and

transmitting, by the initiator device, the authentication token to an authentication server, wherein the authentication server verifies the authentication token.

2. The method of claim 1 , wherein each of the plurality of witness responses further comprises at least one assurance level among the one or more assurance levels.

3. The method of claim 1 , wherein the witness request specifies one or more requested assurance levels, and wherein the one or more requested assurance levels include the assurance level corresponding to the set of token shares.

4. The method of claim 1 , wherein the set of token shares is associated with a first assurance level of the range of assurance levels, and wherein the method further comprises:

determining a first amount of the yet of token shares of the set of token shares; and

determining, by the initiator device, the first assurance level associated with the set of token shares that include at least a threshold amount of token shares by comparing the first amount to the threshold amount.

5. The method of claim 4 , wherein the first amount of the set of token shares is determined by summing weights of the set of token shares, wherein a higher value for a weight indicates the token share is more secure.

6. The method of claim 4 , further comprising:

obtaining, by the initiator device, an initiator token share corresponding to the first assurance level and any other token share(s) when lower assurance levels exist.

7. The method of claim 4 , wherein the token shares are included in a plurality of token shares corresponding to the one or more assurance levels, the first assurance level includes one or more first assurance levels respectively associated with one or more sets of token shares, and wherein the authentication token is one or more authentication tokens.

8. The method of claim 4 further comprising:

transmitting, by the initiator device, the first assurance level to the authentication server.

9. The method of claim 1 , further comprising:

prior to broadcasting the witness request, receiving, by the initiator device, a challenge request from the authentication server.

10. The method of claim 9 , wherein the authentication server generates the challenge request after receiving authentic credentials from a user device.

11. The method of claim 9 , wherein the challenge request is received from the authentication server via a user device.

12. The method of claim 1 , wherein generating the authentication token further comprises:

removing, by the initiator device, duplicate token shares from the set of token shares; and

XORing, by the initiator device, remaining token shares from the set of token shares to determine the authentication token.

13. The method of claim 1 , further comprising:

prior to broadcasting the witness request, determining, by the initiator device, the witness request based on at least one of user input, an internal timer, and a detection of an anomaly.

14. A method comprising:

receiving, by an authentication device from an initiator device, a witness request;

determining, by the authentication device, a first assurance level with respect to the initiator device based on a trust score, the first assurance level determined from a range of assurance levels;

obtaining, by the authentication device, a token share corresponding to the first assurance level, wherein the token share is one of a plurality of token shares associated with a plurality of authentication devices, respectively, wherein each of the plurality of token shares is a portion of an authentication token or determined using a key share that is a fraction of a cryptographic key, and wherein the plurality of token shares results are used in generation of the authentication token; and

transmitting, by the authentication device to the initiator device, the token share for the first assurance level.

15. The method of claim 14 , wherein obtaining the token share further comprises:

obtaining, by the authentication device, other token share(s) corresponding to lower assurance levels when assurance levels lower than the first assurance level exist.

16. The method of claim 15 , wherein transmitting the token share further comprises:

transmitting, by the authentication device, the other token share(s) for each of the lower assurance level.

17. The method of claim 16 , wherein obtaining the token share corresponding to the first assurance level and the other token share(s) corresponding to the lower assurance levels further comprises:

retrieving, by the authentication device, a first key share corresponding to the first assurance level and mother key share(s) corresponding to the other token share(s);

deriving, by the authentication device, the token share corresponding to the first assurance level from the first key share; and

deriving, by the authentication device, the other token share(s) corresponding to the lower assurance levels from the other key share(s).

18. The method of claim 14 , wherein the initiator device determines a highest assurance level associated with a threshold amount of token shares received from the plurality of authentication devices that include the authentication device and are proximate the initiator device.

19. The method of claim 14 further comprising:

determining, by the authentication device, the trust score associated with the initiator device based on at least network data,

wherein the network data includes at least one from among transmission rates, data reception rates, average size of data packets, source addresses, domain name system information, IP addresses, hostnames, signal strength data, and Wi-Fi connection data, and

wherein the trust score is determined based on at least one at least one from among a difference between historically typical transmission rates and the transmission rates, a difference between historically typical data reception rates and the data reception rates, and a difference between historically typical average size of data packets and the average size of data packets.

20. The method of claim 19 , wherein the trust score is a local trust score, and wherein determining the trust score further comprises:

receiving, by the authentication device, one or more remote trust scores from one or more additional authentication devices; and

determining, by the authentication device, the trust score using a weighted average of the local trust score and the one or more remote trust scores.