57 results about "Strong authentication" patented technology

Enhanced user authentication in cellular networks This invention describes a method, apparatus, and system for authenticating, authorizing, and managing a connection in a cellular system to allow a user to retrieve / send some data, e.g., from / to an application function (AF) or to communicate with another remote user over multiple networks in an optimized / secure manner. The user may have one or multiple devices (UEs) using (e.g., connected to) multiple / different networks, e.g., a device with multiple subscriber identity modules (SIMs) and / or different radio access technologies.

A system for zero-trust cybersecurity access control using continuous identity verification (100), comprising: a Policy Decision and Enforcement Orchestrator (1) configured to receive an access request from a user device and enforce a session with minimal privileges; an engine for continuous identity verification (2) configured to generate a time-dependent identity trust score by continuously verifying the user identity during an active session; a device state and telemetry collector (3) configured to acquire device state parameters, runtime signals and network telemetry and to generate a state value; a module for detecting behavioral risks and anomalies (4) that is configured to create behavioral profiles and detect anomalies based on user activity patterns, contextual signals and the history of resource access; a cryptographic authentication and secure token module (5) configured to issue and update a short-lived, bound access token associated with at least the identity trust value and the state value; and an adaptive response and microsegmentation module (6) configured to dynamically adjust access permissions, network segmentation and session privileges in real time, based on an aggregated risk assessment derived from modules (2) to (4), where the system (100) continuously reassesses trustworthiness during the session and selectively allows, restricts, requires enhanced authentication or terminates the session based on the aggregated risk assessment.

An apparatus is provided, including a transaction card, having: a first microprocessor configured to exchange transaction data; a sensor configured to detect movement; and a second microprocessor in communication with the sensor. The second microprocessor may be configured to store arrays of hash values, representing a movement of a user and a card; obtain hash values based on observed movement patterns, and compare them to the stored values. Upon receiving a transaction request, the microprocessor may determine in real time whether the user is in locomotion and whether the card is being intentionally tapped by the user, based on the observed movement patterns. On this basis, the second microprocessor may determine whether to require an augmented authentication for the requested transaction.

Methods, apparatus, and systems for two-factor authentication leveraging graphical passwords and behavioral data are provided. Methods may include creating a two-factor authentication model for logging into a user account. The two-factor authentication model may include a first graphical password and first behavioral data corresponding to biometric characteristics of the creating of the graphical password. Methods may include receiving a login request from the user. Methods may include receiving, from the user, a second graphical password and second behavioral data. Methods may include identifying first comparison points between the second graphical password and the first graphical password. In parallel, methods may include identifying second comparison points between the second behavioral data and the first behavioral data. Methods may include logging the user into the account in response to a determination that a sum of the first and second comparison points is greater than a threshold value.

Authentication codes (e.g., a One Time Passwords) are used in various ways to provide enhanced authentication. For example, multiple authentication codes may be sent to different users in order to provide access to a first user. In addition to sending authentication codes, multiple users may have to provide authentication credentials (e.g., a username / password) in order for a first user to access a resource, such as a bank account. The use of authentication codes may be applied to communication sessions, such as voice and video communication sessions. In addition, the authentication codes may be used to approve an incoming communication, such as and incoming email.

Established user habits in carrying multiple wirelessly detectable devices are used to provide or substantiate authentication. In some embodiments, simply detecting that expected devices are co-located within a limited spatial region is sufficient to establish that the devices are being carried by a single individual. In other embodiments, particularly where the potential for spoofing by multiple individuals is a concern, single-user possession of the devices may be confirmed by various corroborative techniques. This approach affords convenience to users, who may be working at a device that lacks the necessary modality (e.g., a fingerprint or vein reader) for strong authentication.

Systems and methods are provided for use in consent-based synchronization of keys for enhanced authentication availability. One example computer-implemented method includes receiving, by a first fast identity online (FIDO) server, from a second FIDO server, a signed consent token, which is signed by a first private key specific to a mobile device of a user; retrieving a user profile for a user; verifying the signed consent token based on a first public key included in the user profile; based on the successful verification of the consent token, generating a response token, which includes the first public key; signing the response token with a second private key unique to the first FIDO server; and transmitting the signed response token to the second FIDO server.

User accounts for blockchain technology are prone to security risks, such as account take-overs by malicious actors and lost or inaccessible wallets. A data access server system is herein provided to enable strong authentication credentials, such as FIDO2 public and private key pairs that adhere to Fast Identity Online (FIDO) protocols, to be used generate user account. The FIDO2 public key, also herein called a device authenticator public key, is embedded in a code script, and the code script is executed by the data access server system to verify the user using FIDO authentication. The data access server system also provides user tools to create credentials and associate one or more credentials with a blockchain user account. The user tools also enable rekeying of a blockchain user account with different credentials from another blockchain user account, with both accounts belonging to the same user.

The invention discloses a computer remote login recognition system based on artificial intelligence, relates to the technical field of remote login recognition, and breaks through the three limitations of a traditional scheme through underlying signal capture and multi-modal feature fusion: directly obtaining physical signals of input equipment, avoiding information loss caused by protocol packaging, and improving the recognition efficiency. Microcosmic anomalies of the high-simulation AI attack script are accurately recognized; a low-frequency hidden attack chain is captured in combination with a time sequence graph and a causal model, and the view limitation of single session detection is solved; the robustness of the model is enhanced through adversarial training, and the generalization ability of an unknown attack resisting technique is remarkably improved; meanwhile, the system design gives consideration to the user experience and compliance, the dynamic update of the device fingerprint avoids frequent strong authentication interference, and the federal learning architecture realizes the balance of security and privacy.

The invention discloses a quantum random source, equipment fingerprint and biological characteristic-based three-quantum hybrid security chip and an identity authentication method. The three-quantum hybrid security chip comprises a quantum random number generation unit; the system comprises an equipment safety processing unit, a biological characteristic processing unit, a triple mixing processing unit and a key derivation and identity management unit. The chip is integrated with a biological characteristic processing unit with living body detection and quantum fuzzy commitment functions, quantum randomness, equipment physical fingerprints and living body biological characteristics are subjected to deep cryptographic fusion through a triple hybrid processing unit, a unique hybrid result binding'equipment-user 'is generated, and a joint authentication key is derived according to the hybrid result; according to the invention, the method achieves the jump from equipment authentication to human-machine integrated strong authentication, thoroughly solves the risk of equipment embezzlement while inheriting the anti-quantum and anti-cloning advantages, and is suitable for scenes with the highest security level.

A device may receive, from a computing device, a request for a two-factor authentication of a user. A device may transmit, from a server to the computing device and based on the request, multi-factor authentication data to the computing device. A device may establish a short-distance wireless communication link between the computing device and a registered mobile device. A device may transmit, from the computing device and via the short-distance wireless communication link, encrypted data which is encrypted based on the multi-factor authentication data, to the registered mobile device. A device may receive, at the server and from the registered mobile device, a confirmation that corrected data was decrypted from the encrypted data. A device may provide, based on the confirmation, the user with access to a service via the computing device.

A method may include receiving a login request from a computing device including authentication data for a user identifier; granting access to user identifier for a host application having a current level of authentication; receiving a request from the computing device to perform an action; determining the current level of authentication is less than an action level of authentication of the action; presenting a gaming application on the computing device embedded as part of the host application; monitoring telemetry data of the computing device during gameplay of the gaming application including: user interaction data associated with gaming application, and computing device movement data; calculating a current user behavior fingerprint using the telemetry data; calculating a fingerprint similarity score between the current user behavior fingerprint and a past user behavior fingerprint; determining the fingerprint similarity score is above a threshold similarity score; and based on the second determining, authorizing the action.

The present invention discloses a method for secure access to a storage device, an electronic device, and a storage medium, and relates to the technical field of secure access to storage devices. The method comprises the following steps: verifying user identity through a strong authentication mechanism to ensure that only legitimate users can access the storage device; determining whether the user's operating authority is the highest operating authority or applying for access authority based on the attributes of the stored data; generating an encryption key based on an encryption password set by the user, and encrypting, storing, and transmitting the stored data through the encryption key; the present invention is used to solve the problem that the existing storage device secure access technology still has insufficient security protection for stored data and unreasonable setting of encryption keys, which makes stored data prone to leakage.

The invention relates to a dynamic authorization method based on a software defined boundary and a user behavior baseline, and belongs to the field of network security. According to the method, initial strong authentication of a software defined boundary SDP is combined with continuous monitoring based on a user behavior baseline, and a dynamic authorization system throughout the full life cycle of a session is constructed; the abnormal risk is identified by comparing the current operation of a user with a dynamically updated behavior baseline in real time, and an authorization engine is triggered to automatically execute a complete method flow of authority adjustment according to the risk alarm, so that the fundamental conversion from'one-time authorization 'to'continuous self-adaptive authorization' is realized. According to the method, on the basis of a controlled channel established by the SDP, continuous learning and risk assessment of behaviors in a user session are introduced, and the access authority is automatically adjusted in real time according to an assessment result, so that a self-adaptive security closed loop integrating perception, analysis, decision making and execution is formed.

The invention relates to a method for authenticating a user of a service on a communication terminal, comprising what follows, performed by the communication terminal: - transmitting (S23) to a server a request to access said server, said request comprising an identifier associated with the communication terminal and an identifier associated with a required service in said server, - receiving (S25), from an authentication device, an authentication request asking the user to pronounce at least one word, - communicating (S26) said at least one word pronounced by the user to the device, - said at least one pronounced word corresponding to a voiceprint of the user stored beforehand in association with the identifier of said communication terminal, accessing (S30a) the service or receiving (S29b) from the device a complementary user authentication request.

The invention relates to the technical field of biological recognition, in particular to a safety mobile payment processing system based on iris recognition, which comprises an iris feature capture module, a feature correction and alignment module, a focus distance adjustment module, a user identity verification module, an identity matching algorithm module and a safety certification output module. According to the invention, by configuring the multi-angle optical image sensor and adjusting the acquisition distance, the adaptive capacity to users with different heights and the response speed of the system to environment change are enhanced, the image contrast is optimized and optical distortion is corrected by using the edge detection technology, and pixel-level image alignment is executed, so that the image problem caused by depth-of-field change is effectively solved; after the image capture quality is improved and the focus distance is adjusted, the accuracy and reliability of iris recognition are improved, and in secure mobile payment, the iris image is analyzed carefully and compared with database identity information, so that the security of identity verification is enhanced, unauthorized access and fraud are reduced, and the transaction legality and the user financial security are ensured.

A multi-factor authentication system for property management may provide user a convenient and safe property management service via enrolling with service for multi-factor authentication via an application. The user may log in the multi-factor authentication service platform during the enrollment phase via the application to acquire an account and obtain authority for use, thereby to access the service provided by the multi-factor authentication service platform via a property management station system. In addition, during the property management service, the user may acquire the property management service in fewer steps and a more secure manner during an authentication phase with the multi-factor authentication service platform, thereby to enforce security for identity authentication.

A service installed on a user's device identifies a user that has logged into an account associated with an organization that has provided the service for installment. When the service determines that the user has successfully authenticated with an identity provider used by the organization, the service determines information about the session with the identity provider that was created to strongly authenticate the user. The service sends an authentication request to the identity provider as part of the same session with the identity provider that was created when the user was strongly authenticated. The authentication request generated by the service includes a parameter value for configuring authentication without user involvement, such as a parameter value for configuring passive or no prompt authentication. The user thus can be strongly authenticated to the service.

The invention discloses a global digital authentication terminal device supporting an eSIM, and the device comprises a password security chip which is used for executing global digital identity authentication, credit evidence storage and secure communication control, and a security module, an SM9 identification password algorithm module, an electronic seal engine, a multi-platform digital certificate management unit and a trusted execution environment are built in the password security chip; the eSIM module conforms to the standard of the global system for mobile communication (SGP). 22 and supports the switching of configuration files of a multi-operator subscriber identity module; wherein the eSIM module and the password security chip cooperatively operate, when a user initiates a security service, the password security chip generates a dynamic digital identity identifier based on an SM9 identifier cryptographic algorithm, and binds the dynamic digital identity identifier with an international mobile subscriber identity code in an eSIM configuration file; therefore, two-factor authentication of the communication identity and the digital identity is realized. The terminal device has the advantages of strong authentication and high compliance.

Aspects of the disclosure relate to using machine-learning models to determine graduated levels of access to secured data for remote devices. In some embodiments, a computing platform may establish a connection with a mobile device. Subsequently, based on establishing the connection, the platform may identify initial device information, device features, and user information. The platform may input the identified information into an authentication model to compute a baseline authentication score and then may identify an initial level of access to secured resources for the mobile device. Thereafter, the platform may receive from the mobile device, AR / VR device information captured by the mobile device. The platform may input the AR / VR device information into the authentication model to compute an augmented authentication score. Based on the augmented score, the platform may identify an augmented level of access to secured resources for the mobile device.

A lightweight physical layer authentication method based on a two-stage response of a real-time channel belongs to the field of wireless communication technology. The present invention addresses the problem that existing physical layer authentication methods are not suitable for situations where computing resources and storage resources are limited, and lack robust methods for dealing with noisy observations. It includes two-stage authentication. The first stage uses a low-complexity channel tracking model to accurately model and track real-time channel changes, and uses historical data for online prediction without incurring significant computing or storage overhead; the second stage enhances the robustness of the authentication process by introducing power delay features. These features are inherently resistant to time fluctuations, thereby eliminating the need for additional feature extraction in noisy environments. The present invention can improve the security, robustness and online processing capabilities of physical layer authentication in dynamic time-varying channels.

Anti-counterfeiting is benefited by integrating both optical and digital encoding-decoding approaches for spoof protection, e.g., in print anti-spoofing. An optical-digital encoding-decoding system uses an encoded medium, such as a security label, to display images encoded with digital data, and a decoding device to decode or decrypt the digital data for achieving stronger authentication in anti-counterfeiting or other security-related purposes. The images are encoded into resonant waveguide gratings (RWGs) in the encoded medium, enabling angle multiplexing of the displayed images and addressing different secrecy requirements in optically handling different groups of security-related data. Furthermore, aperiodic diffraction gratings instead of periodic ones are used in RWGs for selected images intended to be viewed by users, broadening beamwidths of outgoing light beams generated by these RWGs to allow the selected images to be more conveniently viewed by the users over a wider range of angle.

The application discloses an intelligent substation security communication method and system based on edge computing, proposes an intelligent substation security communication strategy based on edge computing, provides shared proxy computing services for resource-limited terminal devices, greatly reduces the time for the terminal devices to process security messages, and can well meet the high-specification delay requirements of communication messages. In view of the access risk control problems of the edge server and the terminal device, a lightweight two-way identity authentication protocol is proposed, which is low in security risk, high in real-time authentication efficiency and light in weight, and is more suitable for real-time interaction of the substation transceiving time-sensitive business subject and the edge server. Moreover, considering that the server is low in risk level and high in performance, and the terminal device is high in risk level and low in performance, an asymmetric two-way authentication mode of weak authentication for the server and strong authentication for the terminal device is proposed, so that the calculation burden of the terminal device is reduced, and the authentication efficiency is improved.

Techniques described herein relate to a method managing accounts in a cluster. The method includes identifying, by an alert manager, an account login alert associated with an account and a node of a cluster, wherein the cluster comprises a plurality of nodes, wherein the node is one of the plurality of nodes; in response to the identification: making a first determination that the account login alert exceeds an alert threshold; in response to the first determination: disabling a weak authentication method for the account; enabling a strong authentication method for the account; disabling weak authentication methods for other accounts on the plurality of nodes; enabling strong authentication methods for other accounts on the plurality of nodes; making a second determination the account is associated with multiple sessions; and in response to the second determination: closing the multiple sessions associated with the account.

The invention discloses a multi-terminal device biological recognition method and device, and the method comprises the steps: enabling a first terminal device to respond to a first verification information input operation of a user, and carrying out the unlocking verification of the device and the login verification of a target APP; in response to the transaction amount input and confirmation operation, sending a first enhanced identity verification request to the second terminal device; the second terminal device displays an information collection page used for receiving first biological information input by a user; transmitting the encrypted biological information template to a first terminal device through a near-field secure communication channel; matching with standard biological information; if the matching is successful, generating a first authentication token; the first terminal device displays a payment verification interface; and after the payment verification succeeds, performing payment operation. According to the scheme, the biological information of the user is stored on the first terminal equipment, so that the risk that the biological data is leaked and abused at the cloud is eliminated; multiple verification factors are introduced outside a single biological feature, and multi-factor enhanced safety is achieved.

In various embodiments, authentication stations are distributed within a facility, particularly in spaces where mobile devices are predominantly used—e.g., a hospital's emergency department. Each such station includes a series of authentication devices. Mobile device may run applications for locating the nearest such station and, in some embodiments, pair wirelessly with the station so that authentication thereon will accord a user access to the desired resource via a mobile device.

The invention provides an asset query method and device, which can be used in the financial field or other fields. The method comprises the following steps: acquiring a first query request sent by a query terminal, and processing the first query request sent by the query terminal by using a preset asset query strong authentication dual-algorithm model to obtain a customer identifier; obtaining first effective verification information and second effective verification information corresponding to the customer identifier in a preset aging region; and obtaining customer asset information sent by the generative artificial intelligence server through an asset query encryption packaging interface by using the first effective verification information and the second effective verification information, and feeding back the customer asset information to a customer through a query terminal. According to the method, convenient and brand-new asset and liability management services are provided for clients, the clients do not need to open all electronic banks to inquire assets and then carry out single superposition, all assets under the name can be inquired clearly at a glance, and the convenience of asset inquiry is improved while data safety is guaranteed.

The invention provides a BDSBAS hybrid authentication method fusing a domestic cryptographic algorithm and a TESLA protocol. According to the method, strong authentication of terrestrial broadcast node identities and generation of message digests are realized by introducing an SM3 hash algorithm, and efficient broadcast authentication of enhanced messages is realized by combining a time window delay release mechanism based on a symmetric key chain construction mode of a TESLA protocol. In the aspect of key management, the system generates a root key through a key management center, constructs a TESLA authentication chain through a Hash function, supports regular rotation, and ensures the security and traceability of the key. In the aspect of protocol design, compatible expansion and low-overhead receiving verification of a telegraph text structure are realized. The mechanism has the advantages of low calculation complexity, good broadcast adaptability and high security, is suitable for a large-range broadcast scene of the BDSBAS in civil aviation navigation enhancement, and effectively defends attacks such as data forgery and the like.