Multifactor derived identification
The present technology pertains to a system that authenticates the identity of a user trying to access a service. The system comprises an authentication provider configured to communicate authentication requirements to a continuous multifactor authentication device and the continuous multifactor authentication device configured to receive authentication requirements, to fuse multiple identification factors into an identification credential for a user according to the authentication requirements, and to send the authentication credential to the authentication provider. After receiving the identification credential meeting the authentication requirements, the authentication provider is configured to instruct a service provider to initiate a session.
1. A method of deriving an identification credential comprising:
detecting a plurality of types of biometric data of a user;
receiving a randomly generated number;
translating the randomly generated number into selections of fractional portions of the plurality of types of biometric data;
generating the identification credential from the fractional portions of the plurality of types of biometric data; and
during a first log-in with a service provider, storing information identifying the service provider and the randomly generated number used to create the identification credential in a storage of a trusted execution environment on a continuous multifactor authentication device, wherein during the first log-in the randomly generated number is generated by a hardware root of trust located in the trusted execution environment;
wherein the randomly generated number is received from the storage in the trusted execution environment during a log-in to the service provider that is subsequent to the first log-in.
2. The method of claim 1 , wherein the randomly generated number is generated by a hardware root of trust located in a trusted execution environment on a continuous multifactor authentication device.
3. The method of claim 1 , comprising:
receiving context data from an operating system or application executing on the continuous multifactor authentication device,
determining that the context of a continuous multifactor authentication device meets access conditions necessary to generate the identification credential.
4. The method of claim 3 , wherein the access conditions that specify the context, and the types of biometric data in the plurality of types of biometric data are specified by an access provider.
5. The method of claim 1 , comprising:
determining from the plurality of types of biometric data or from data derived by an operating system or applications on a continuous multifactor authentication device, that the user is under stress;
disallowing the generating of the identification credential.
6. A continuous multifactor authentication system comprising:
a trusted execution environment having a processor and memory storing instructions, the instructions programmed to cooperate with the processor to cause the trusted execution environment to:
detect a plurality of types of biometric data of a user;
receive a randomly generated number;
translate the randomly generated number into selections of fractional portions of the plurality of types of biometric data;
generate an identification credential from the fractional portions of the plurality of types of biometric data; and
during a first log-in with a service provider, storing in a storage information of the trusted execution environment information identifying the service provider and the randomly generated number used to create the identification credential, wherein during the first log-in the randomly generated number is generated by a hardware root of trust located in the trusted execution environment;
receive the randomly generated number from the storage in the trusted execution environment during a log-in to the service provider that is subsequent to the first log-in.
7. The continuous multifactor authentication system of claim 6 comprising:
a rich execution environment configured to collect contextual information from applications and an operating system executing on the continuous multifactor authentication system.
8. The continuous multifactor authentication system of claim 6 , wherein the randomly generated number is generated by a hardware root of trust located in a trusted execution environment on a continuous multifactor authentication device.
9. The continuous multifactor authentication system of claim 6 , the trusted execution environment further configured to:
receive context data from an operating system or application executing on the continuous multifactor authentication system,
determine that the context of a continuous multifactor authentication device meets access conditions necessary to generate the identification credential.
10. The continuous multifactor authentication system of claim 9 , wherein the access conditions that specify the context, and the types of biometric data in the plurality of types of biometric data are specified by an access provider.
11. A non-transitory computer readable medium comprising instructions stored thereon, the instructions are effective to cause at least one processor of a continuous multifactor authentication system to perform operations comprising:
detect a plurality of types of biometric data of a user;
receive a randomly generated number;
translate the randomly generated number into selections of fractional portions of the plurality of types of biometric data; and
generate an identification credential from the fractional portions of the plurality of types of biometric data; and
during a first log-in with a service provider, store information in a storage of a trusted executed environment identifying the service provider and the randomly generated number used to create the identification credential, wherein during the first log-in the randomly generated number is generated by a hardware root of trust located in the trusted execution environment;
wherein the trusted execution environment is configured to receive the randomly generated number from the storage in the trusted execution environment during a log-in to the service provider that is subsequent to the first log-in.
12. The non-transitory computer readable medium of claim 11 , wherein the instructions are effective to cause at least one processor to generate the randomly generated number by a hardware root of trust located in a trusted execution environment on a continuous multifactor authentication device.
13. The non-transitory computer readable medium of claim 11 , wherein the instructions are effective to cause at least one processor to:
receive context data from an operating system or application executing on the continuous multifactor authentication system,
determine that the context of a continuous multifactor authentication device meets access conditions necessary to generate the identification credential.
14. The non-transitory computer readable medium of claim 11 , wherein the instructions are effective to cause at least one processor to:
determine from the plurality of types of biometric data or from data derived by an operating system or applications on a continuous multifactor authentication device, that the user is under stress;
disallow the generating of the identification credential.