Methods and systems for device authentication
A method for disabling a device associated with a virtual identity may include receiving, from the device, a request to use the virtual identity, where the request that may include a passcode guess and a device identifier. The method may also include determining that the passcode guess does not authorize use of the virtual identity and incrementing a number of incorrect passcode guesses received within a time interval. The method may additionally include determining that the number of incorrect passcode guesses received within the time interval is greater than or equal to a threshold. The method may further include storing an indication that subsequent requests associated with the device identifier should not authorize use of the virtual identity.
1. A method for disabling a device associated with a virtual identity, the method comprising:
receiving, from the device, a request to use the virtual identity, the request comprising:
a passcode guess comprising a hash of a salted password; and
a device identifier;
cryptographically transforming the passcode guess to obscure its value;
comparing the passcode guess to a value previously stored in a repository;
determining whether the passcode guess does not authorize use of the virtual identity based on comparing the passcode guess to the value previously stored in the repository;
incrementing a number of incorrect passcode guesses received within a time interval, wherein the incrementing is based on predetermined values for a type of transaction,
wherein the type of transaction includes using a Level of Assurance (LOA) mode, the LOA mode comprising: a disabled mode, an enabled with no security mode, a password with a timeout mode, or an out-of-band (OOB) authorization required with an optional pin and timeout mode;
determining that the number of incorrect passcode guesses received within the time interval is greater than or equal to a threshold;
storing an indication that subsequent requests associated with the device identifier and transaction type should not authorize the use of the virtual identity; and
resetting the number of incorrect passcode guesses when a valid passcode guess is received.
2. The method of claim 1 , wherein one or more user devices associated with the virtual identity are allowed to provide correct passcode guesses and authorize the use of the virtual identity.
3. The method of claim 1 , wherein the passcode guess is based on a PIN.
4. The method of claim 1 , further comprising sending, to one or more user devices associated with the virtual identity, an indication that the device cannot authorize the use of the virtual identity.
5. The method of claim 4 , wherein the indication that the device cannot authorize the use of the virtual identity comprises a push notification to a smart phone.
6. The method of claim 1 , further comprising:
receiving, from an authorized user device:
a second passcode guess; and
an indication that the device should be reauthorized;
determining that the second passcode guess authorizes the use of the virtual identity; and
determining that the subsequent requests associated with the device identifier can authorize the use of the virtual identity.
7. A method for disabling a device associated with a virtual identity, the method comprising:
receiving, from the device, a request to register an unregistered device, the request comprising:
a passcode guess comprising a hash of a salted password; and
a device identifier;
cryptographically transforming the passcode guess to obscure its value;
comparing the passcode guess to a value previously stored in a repository;
determining whether the passcode guess does not authorize registration of the unregistered device based on comparing the passcode guess to the value previously stored in the repository;
incrementing a number of incorrect passcode guesses received within a time interval, wherein the incrementing is based on predetermined values for a type of transaction,
wherein the type of transaction includes using a Level of Assurance (LOA) mode, the LOA mode comprising: a disabled mode, an enabled with no security mode, a password with a timeout mode, or an out-of-band (OOB) authorization required with an optional pin and timeout mode;
determining that the number of incorrect passcode guesses received within the time interval is greater than or equal to a threshold;
storing an indication that subsequent requests associated with the device identifier and transaction type should not register unregistered devices; and
resetting the number of incorrect passcode guesses when a valid passcode guess is received.
8. The method of claim 7 , further comprising sending the indication that subsequent requests associated with the device identifier should not register unregistered devices to a pairing repository.
9. The method of claim 7 , further comprising:
receiving the request to register a second unregistered device, the request comprising:
a second passcode guess; and
the device identifier;
denying the request to register the second unregistered device based on the stored indication.
10. The method of claim 7 , wherein the passcode guess comprises a digital signature derived from a user-provided passcode.
11. The method of claim 7 , wherein the unregistered device comprises a smart phone.
12. The method of claim 7 , wherein the request to register the unregistered device further comprises an encrypted salt value.
13. The method of claim 7 , wherein the request to register the unregistered device further comprises a pairing code.
14. An identity repository comprising:
one or more interfaces that receive requests from user devices;
one or more processors; and
one or more memories communicatively coupled to the one or more processors, having instructions stored thereon, which, when executed by the one or more processors, cause the one or more processors to:
receive a request from the user devices through the one or more interfaces, the request comprising:
a passcode guess comprising a hash of a salted password; and
a device identifier;
cryptographically transform the passcode guess to obscure its value;
compare the passcode guess to a value previously stored in a repository;
determine whether the passcode guess does not authorize use of a virtual identify based on comparing the passcode guess to the value previously stored in the repository;
increment a number of incorrect passcode guesses received within a time interval, wherein the incrementing is based on predetermined values for a type of transaction,
wherein the type of transaction includes using a Level of Assurance (LOA) mode, the LOA mode comprising: a disabled mode, an enabled with no security mode, a password with a timeout mode, or an out-of-band (OOB) authorization required with an optional pin and timeout mode;
determine that the number of incorrect passcode guesses received within the time interval is greater than or equal to a threshold;
generate an indication in the one or more memories that subsequent requests associated with the device identifier and transaction type should not be granted; and
reset the number of incorrect passcode guesses when a valid passcode guess is received.
15. The identity repository of claim 14 , wherein the one or more memories further store encrypted personal information associated with the virtual identity, wherein the device identifier is associated with the virtual identity.
16. The identity repository of claim 14 , wherein the request from the user devices comprises a request to use the virtual identity.
17. The identity repository of claim 14 , wherein the request from the user devices comprises a request to pair an unregistered device with the virtual identity.
18. The identity repository of claim 14 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:
send the indication to a pairing repository that is physically separate from the identity repository.