Authentication Using Device and User Identity

Abstract

Methods and systems for secure authentication of users based on unique device identifiers are described herein. A computing device may receive, from a user device, a device registration. The device registration may comprise authentication credentials, device information, and/or a public key. Based on the authentication credentials and/or the device information, a unique device identifier may be generated. A token may be generated based on the unique device identifier and sent to the user device. A request for content may be received from the user device. A nonce may be sent to the user device. The token and a signed version of the nonce may be received from the user device. The nonce may have been signed using a private key corresponding to the public key. Access to the content may be provided based on the token, the unique device identifier, and/or the signed version of the nonce.

What is claimed is: 
     
         1 . A method comprising:
 sending, to a user device, a token based on:
 authentication credentials, and 
 a first plurality of applications executing on the user device at a first time; 
   receiving, from the user device:
 a modified version of the token that indicates a second plurality of applications executing on the user device at a second time, wherein the second plurality of applications is different from the first plurality of applications; and 
 data signed using a private key corresponding to the public key; and 
   determining, based on comparing the token and the modified version of the token, based on determining whether a difference between the first plurality of applications and the second plurality of applications indicates an attempt at unauthorized access to content, and based on processing the data using a public key corresponding to the private key, to provide the user device access to content.   
     
     
         2 . The method of  claim 1 , wherein the token comprises an indication of a fingerprint of the public key. 
     
     
         3 . The method of  claim 1 , wherein comparing the token and the modified version of the token comprises:
 determining the difference between the first plurality of applications and the second plurality of applications.   
     
     
         4 . The method of  claim 1 , wherein determining to provide the user device access to the content comprises a determination that the user device is of a device type permitted to access the content. 
     
     
         5 . The method of  claim 1 , wherein determining to provide the user device access to the content comprises:
 determining that the data was not signed using the private key; and   preventing the user device from accessing the content.   
     
     
         6 . The method of  claim 1 , further comprising:
 generating, based on the authentication credentials and the first plurality of applications, a unique identifier.   
     
     
         7 . The method of  claim 6 , wherein determining to provide the user device access to the content comprises:
 preventing the user device from accessing the content based on a determination that the unique identifier is not stored by a database.   
     
     
         8 . The method of  claim 1 , wherein determining to provide the user device access to the content is based on a request for content, received from the user device, that is associated with access, by the user device, of a Uniform Resource Locator (URL). 
     
     
         9 . The method of  claim 1 , further comprising:
 storing the public key for a period of time; and   deleting the public key after the period of time.   
     
     
         10 . A method comprising:
 generating, by a server, a token based on:
 authentication credentials associated with a user device; 
 data indicating a first plurality of applications executing on the user device at a first time; and 
 a public key; 
   sending, to the user device and based on a determination that the user device is of a permitted device type, the token;   receiving, from the user device, a request for content;   sending, to the user device, second data;   receiving, from the user device, a response comprising:
 a modified version of the token that indicates a second plurality of applications executing on the user device at a second time, wherein the second plurality of applications is different from the first plurality of applications; and 
 a signed version of the second data, wherein the signed version of the second data was signed using a private key corresponding to the public key; and 
   determining, based on the response, and based on determining whether a difference between the first plurality of applications and the second plurality of applications indicates an attempt at unauthorized access to the content, to provide the user device access to the content.   
     
     
         11 . The method of  claim 10 , wherein determining to provide the user device access to the content comprises:
 determining whether the second data was signed using the private key.   
     
     
         12 . The method of  claim 10 , wherein determining to provide the user device access to the content comprises:
 preventing the user device from accessing the content based on a determination that a unique device identifier is not stored by a database.   
     
     
         13 . The method of  claim 10 , further comprising:
 storing, by the server, the public key for a period of time; and   deleting the public key after the period of time.   
     
     
         14 . The method of  claim 10 , wherein determining to provide the user device access to the content comprises:
 determining the difference between the first plurality of applications and the second plurality of applications.   
     
     
         15 . A system comprising:
 a server; and   a user device,   wherein the server comprises:
 one or more first processors; and 
 first memory storing first instructions that, when executed by the one or more first processors, cause the server to:
 send, to the user device, a token based on:
 authentication credentials, and 
 a first plurality of applications executing on the user device at a first time; 
 
 receive, from the user device:
 a modified version of the token that indicates a second plurality of applications executing on the user device at a second time, wherein the second plurality of applications is different from the first plurality of applications; and 
 data signed using a private key corresponding to the public key; and 
 
 determine, based on comparing the token and the modified version of the token, based on determining whether a difference between the first plurality of applications and the second plurality of applications indicates an attempt at unauthorized access to content, and based on processing the data using a public key corresponding to the private key, to provide the user device access to content; and 
 
   wherein the user device comprises:
 one or more second processors; and 
 second memory storing second instructions that, when executed by the one or more second processors, cause the user device to:
 receive the token. 
 
   
     
     
         16 . The system of  claim 15 , wherein the token comprises an indication of a fingerprint of the public key. 
     
     
         17 . The system of  claim 15 , wherein the first instructions, when executed by the one or more first processors, cause the server to compare the token and the modified version of the token by causing the server to:
 determine the difference between the first plurality of applications and the second plurality of applications.   
     
     
         18 . The system of  claim 15 , wherein the first instructions, when executed by the one or more first processors, cause the server to determine to provide the user device access to the content based on a determination that the user device is of a device type permitted to access the content. 
     
     
         19 . The system of  claim 15 , wherein the first instructions, when executed by the one or more first processors, cause the server to determine to provide the user device access to the content by causing the server to:
 determine that the data was not signed using the private key; and   prevent the user device from accessing the content.   
     
     
         20 . The system of  claim 15 , wherein the first instructions, when executed by the one or more first processors, cause the server to:
 generate, based on the authentication credentials and the first plurality of applications, a unique identifier.   
     
     
         21 . The system of  claim 20 , wherein the first instructions, when executed by the one or more first processors, cause the server to determine to provide the user device access to the content by causing the server to:
 prevent the user device from accessing the content based on a determination that the unique identifier is not stored by a database.   
     
     
         22 . The system of  claim 15 , wherein the first instructions, when executed by the one or more first processors, cause the server to determine to provide the user device access to the content based on a request for content, received from the user device, that is associated with access, by the user device, of a Uniform Resource Locator (URL). 
     
     
         23 . The system of  claim 15 , wherein the first instructions, when executed by the one or more first processors, cause the server to:
 store the public key for a period of time; and   delete the public key after the period of time.   
     
     
         24 . A system comprising:
 a server; and   a user device,   wherein the server comprises:
 one or more first processors; and 
 first memory storing first instructions that, when executed by the one or more first processors, cause the server to: 
 generate a token based on:
 authentication credentials associated with a user device; 
 data indicating a first plurality of applications executing on the user device at a first time; and 
 a public key; 
 
 send, to the user device and based on a determination that the user device is of a permitted device type, the token; 
 receive, from the user device, a request for content; 
 send, to the user device, second data; 
 receive, from the user device, a response comprising:
 a modified version of the token that indicates a second plurality of applications executing on the user device at a second time, wherein the second plurality of applications is different from the first plurality of applications; and 
 a signed version of the second data, wherein the signed version of the second data was signed using a private key corresponding to the public key; and 
 
 determine, based on the response, and based on determining whether a difference between the first plurality of applications and the second plurality of applications indicates an attempt at unauthorized access to the content, to provide the user device access to the content; and 
   wherein the user device comprises:
 one or more second processors; and 
 second memory storing second instructions that, when executed by the one or more second processors, cause the user device to:
 receive the token. 
 
   
     
     
         25 . The system of  claim 24 , wherein the first instructions, when executed by the one or more first processors, cause the server to determine to provide the user device access to the content by causing the server to:
 determine whether the second data was signed using the private key.   
     
     
         26 . The system of  claim 24 , wherein the first instructions, when executed by the one or more first processors, cause the server to determine to provide the user device access to the content by causing the server to:
 prevent the user device from accessing the content based on a determination that a unique device identifier is not stored by a database.   
     
     
         27 . The system of  claim 24 , wherein the first instructions, when executed by the one or more first processors, cause the server to:
 store the public key for a period of time; and   delete the public key after the period of time.   
     
     
         28 . The system of  claim 24 , wherein the first instructions, when executed by the one or more first processors, cause the server to determine to provide the user device access to the content by causing the server to:
 determine the difference between the first plurality of applications and the second plurality of applications.