Online authentication and security management using device-based identification
Techniques are disclosed to provide enhanced online security. When user authenticating information is provided to access secure content, a network server identifies the user via a website identifier. Some of the disclosed techniques leverage third party “cookie stitchers” to associate user data, which may include a website identifier, to the user's computing devices. If the cookie stitcher cannot identify a current computing device, or if a current website identifier does not match one stored in the user data, then 2-factor authentication (2FA) may be triggered. Other disclosed techniques leverage stored device management data (DMD), which uniquely identifies each computing device that is associated with a website identifier. These techniques allow the network server to block access to explicitly-identified computing devices, and to trigger 2FA unless specific computing device metrics, which are associated with a computing device, are matched to computing device metrics contained in the DMD.
1 . A system for providing access to secure content, comprising:
a network server having a memory storing a set of instructions and one or more processors interfaced with the memory and configured to receive user authenticating information that is provided via a computing device attempting to access secure content that is hosted by the network server; and
a cookie-stitching server configured to:
access a storage device containing sets of user data that are correlated to respective sets of computing devices, wherein each set of user data is stored with an associated agency identification that uniquely identifies a user,
receive from the network server user and device identifying data,
in response to identifying, based at least in part on the user and device identifying data, an agency identification, send a set of user data associated with the agency identification to the network server, and
in response to not identifying an agency identification, send a notification to the network server,
wherein the network server is further configured to:
in response to receiving the set of user data from the cookie-stitching server, grant the computing device access to secure content that is provided by the network server upon verification that (i) user authenticating information received via the computing device is correct, and (ii) a website identifier generated by the network server from the user authenticating information, wherein the website identifier enables one or more back-end computing devices to provide access to the secure content during a browsing session, matches a website identifier associated with the set of user data received from the cookie-stitching server, and
in response to receiving the notification from the cookie-stitching server, trigger execution of a two-factor authentication (2FA), and grant the computing device access to the secure content upon satisfaction of one or more conditions associated with the 2FA.
2 . The system of claim 1 , wherein the cookie-stitching server is further configured to identify the user data using one or more of (i) cookie data, (ii) unique device identifiers, and (iii) browser information.
3 . The system of claim 1 , wherein the cookie-stitching server is further configured to access the set of user data, and to send the user data or the notification to the network server in real time.
4 . The system of claim 1 , wherein the secure content includes one or more of payment information, prescription information, and health-related information.
5 . The system of claim 1 , wherein the one or more conditions associated with the 2FA include sending an alphanumeric code to a computing device associated with the user data, requesting the alphanumeric code be entered via the computing device from which the user authenticating information was received, and verifying that an alphanumeric code received in response to the request matches the alphanumeric code sent in a text message.
6 . The system of claim 1 , wherein the one or more conditions associated with the 2FA include requesting that biometric information be entered via the computing device from which the user authenticating information was received, and verifying the biometric information received in response to the request.
7 . A method for providing access to secure content, comprising:
receiving, by a network server, user authenticating information that is provided via a computing device attempting to access secure content that is hosted by the network server,
accessing, by a cookie-stitching server, a storage device containing sets of user data that are correlated to respective sets of computing devices, wherein each set of user data is stored with an associated agency identification that uniquely identifies a user,
receiving from the network server user and device identifying data,
in response to identifying, based at least in part on the user and device identifying data, an agency identification, sending, by the cookie-stitching server, a set of user data associated with the agency identification to the network server, and
in response to not identifying an agency identification, sending, by the cookie-stitching server, a notification to the network server,
in response to receiving the set of user data from the cookie-stitching server, granting, by the network server, the computing device access to secure content that is provided by the network server upon verification that (i) user authenticating information received via the computing device is correct, and (ii) a website identifier generated by the network server from the user authenticating information, wherein the website identifier enables one or more back-end computing devices to provide access to the secure content during a browsing session, matches a website identifier associated with the set of user data received from the cookie-stitching server, and
in response to receiving the notification from the cookie-stitching server, triggering, by the network server, execution of a two-factor authentication (2FA), and granting, by the network server, the computing device access to the secure content upon satisfaction of one or more conditions associated with the 2FA.
8 . The method of claim 7 , further comprising:
identifying, by the cookie-stitching server, the user data using one or more of (i) cookie data, (ii) unique device identifiers, and (iii) browser information.
9 . The method of claim 7 , further comprising:
accessing, by the cookie-stitching server, the set of user data, and
sending, by the cookie-stitching server, the user data or the notification to the network server in real time.
10 . The method of claim 7 , wherein the secure content includes one or more of payment information, prescription information, and health-related information.
11 . The method of claim 7 , wherein the one or more conditions associated with the 2FA include sending an alphanumeric code to a computing device associated with the user data, requesting the alphanumeric code be entered via the computing device from which the user authenticating information was received, and verifying that an alphanumeric code received in response to the request matches the alphanumeric code sent in a text message.
12 . The method of claim 7 , wherein the one or more conditions associated with the 2FA include requesting that biometric information be entered via the computing device from which the user authenticating information was received, and verifying the biometric information received in response to the request.