Risk Scoring via Third-Party Status Settings for Mobile Device Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile OS manufacturers restrict persistent identification of mobile devices for privacy reasons, limiting app developers' ability to authenticate devices securely, especially for financial transactions, where traditional methods are insufficient to determine the trustworthiness of devices.
Innovation Solution
A system that uses limited permanent device markings, combined with data from login attempts, to assign a risk score to network requests, leveraging the capabilities provided by mobile OS manufacturers to classify devices and assess the authenticity of login attempts, incorporating traditional risk scoring techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If mobile OS manufacturers implement privacy restrictions on persistent device identification, then user privacy is improved, but device authentication capability deteriorates
Solution Approach 1:
The patent introduces a third-party server as an intermediary that stores device status settings and provides them to application servers. This mediator enables authentication capability without requiring direct persistent identification between apps and devices, thus resolving the privacy-reliability contradiction by maintaining privacy restrictions while enabling secure authentication through the intermediary server.
Solution Approach 2:
The patent extracts the persistent identification function from direct app-device communication and relocates it to the third-party server. By taking out the identification storage function from the device itself and placing it in a centralized server, the system maintains privacy on the device while enabling authentication through the extracted identification data.
2Object-affected harmful factors
If traditional risk scoring methods are used without permanent device markings, then privacy is maintained, but risk assessment accuracy deteriorates
Solution Approach 1:
The patent changes the parameter of device identification from traditional persistent identifiers to limited permanent device markings (status settings with specific bit patterns). This parameter change enables risk assessment accuracy by providing stable device identification while maintaining privacy by using minimal, restricted identification data that cannot be used for traditional tracking.
3Object-affected harmful factors
If limited permanent device markings are used instead of full persistent identification, then privacy is protected, but device recognition capability deteriorates
Solution Approach 1:
The patent segments the device identification function into two parts: limited permanent device markings stored on the device (for privacy-protected identification) and corresponding status settings stored on the third-party server (for authentication). This segmentation enables device recognition capability while protecting privacy by distributing identification data across multiple locations with different access levels.
Data Source
AI summary
System comprises an application server for hosting a mobile application service; a mobile device having a mobile application for the mobile application service installed thereon; and a third party server. Application server is configured to: receive a log-in request for the mobile application service from the mobile device, where the log-in request includes device identifying information for the mobile device; transmit, to the third party server, a request for a status setting for the mobile application, wherein the request comprises the device identifying information for the mobile device, where the status setting comprises a plurality of bits, and where the third party server retrieves the status setting from a database based on the device identifying information for the mobile device; receive from the third party server, the status setting for the mobile application; and determine a risk rating for the log-in request based in part on the status setting for the mobile application.