Personal device network for user identification and authentication
Established user habits in carrying multiple wirelessly detectable devices are used to provide or substantiate authentication. In some embodiments, simply detecting that expected devices are co-located within a limited spatial region is sufficient to establish that the devices are being carried by a single individual. In other embodiments, particularly where the potential for spoofing by multiple individuals is a concern, single-user possession of the devices may be confirmed by various corroborative techniques. This approach affords convenience to users, who may be working at a device that lacks the necessary modality (e.g., a fingerprint or vein reader) for strong authentication.
1. A method for authenticating a user seeking access to a secure resource at a client device in accordance with a security policy, the method comprising:
electronically detecting one or more wireless devices co-located with the client device;
determining whether the one or more wireless devices are listed and related to the user in an identity database that includes entries relating users with wireless devices belonging to the users;
when the one or more wireless devices are listed and related to the user in the identity database, determining whether detection of the one or more wireless devices co-located with the client device is alone sufficient to satisfy the downloaded security policy; and
when detection of the one or more wireless devices co-located with the client device alone is sufficient to satisfy the security policy, allowing the user to access the secure resource on the client device.
2. The method of claim 1 , wherein the security policy does not require a predetermined location for the client device upon which access to the secure resource is to be allowed.
3. The method of claim 1 , wherein the client device does not receive user-specific authentication information from any of the one or more wireless devices.
4. The method of claim 1 , wherein the client device forms a network with the one or more wireless devices.
5. The method of claim 1 , wherein the one or more wireless devices comprises two or more wireless devices.
6. The method of claim 1 , further comprising, when the detection of the one or more wireless devices co-located with the client device is not sufficient to satisfy the security policy alone, identifying at least one additional authentication step whose fulfillment would satisfy the security policy, causing fulfillment of the at least one additional authentication step, and allowing the user to access the secure resource on the client device after fulfillment of the at least one additional authentication step.
7. The method of claim 6 , further comprising searching initially for additional authentication steps whose fulfillment would satisfy the security policy and that do not require user action.
8. The method of claim 7 , wherein, when there are no additional authentication steps that do not require user action but would satisfy the security policy, causing fulfillment of the at least one additional authentication step comprises engaging the user to fulfill the at least one additional authentication step.
9. The method of claim 1 , further comprising, after the user has been allowed to access the secure resource, (i) verifying the co-location, with the user and the client device, of all wireless devices associated with the user in the identity database, and (ii) for any wireless device associated with the user but not co-located with the user and the client device, at least one of (a) decrementing a counter associated with the wireless device or (b) disassociating the wireless device from the user in the identity database.
10. The method of claim 1 , wherein the client device lacks any modality for biometric authentication.
11. A method for authenticating a user seeking access to a secure resource on a first wireless device in accordance with a security policy, the method comprising:
at the first wireless device, electronically determining whether one or more additional wireless devices associated with the user are co-located with the first wireless device; and
when (i) the one or more additional wireless devices are co-located with the first wireless device, and (ii) when co-location of the one or more additional wireless devices with the first wireless device alone is sufficient to satisfy the security policy, allowing the user to access the secure resource on the first wireless device in response to a request for access from the user.
12. The method of claim 11 , further comprising forming a network among the first wireless device and one or more additional wireless devices.
13. The method of claim 12 , wherein the network comprises an ad hoc network.
14. The method of claim 11 , wherein the first wireless device lacks any modality for biometric authentication.
15. The method of claim 11 , wherein the security policy does not require a predetermined location for the first wireless device upon which access to the secure resource is to be allowed.
16. The method of claim 11 , wherein the first wireless device does not receive user-specific authentication information from any of the one or more additional wireless devices.
17. The method of claim 11 , wherein the one or more additional wireless devices comprises two or more additional wireless devices.
18. The method of claim 11 , further comprising, when the co-location of the one or more additional wireless devices with the first wireless device is not sufficient to satisfy the security policy alone, identifying at least one additional authentication step whose fulfillment would satisfy the security policy, causing fulfillment of the at least one additional authentication step, and allowing the user to access the secure resource on the first wireless device after fulfillment of the at least one additional authentication step.
19. The method of claim 18 , further comprising searching initially for additional authentication steps whose fulfillment would satisfy the security policy and that do not require user action.
20. The method of claim 19 , wherein, when there are no additional authentication steps that do not require user action but would satisfy the security policy, causing fulfillment of the at least one additional authentication step comprises engaging the user to fulfill the at least one additional authentication step.