Lookout, Inc.

Other

Okta, Inc.

Stephen Lind

Brian James Buck

Brian Sullivan

Naveen Kumar Keerthy

Karthik Bhat

Bidan Sinha

Jintai He

Kavitha Chandramohan

An authentication system determines a risk level for a client device impersonating a client device enrolled in authentication services by comparing device metadata for the impersonating client device to device metadata for the enrolled client device. As part of enrolling the enrolled client device, the authentication system associates one or more authentication credentials with the enrolled client device. In order to authenticate access requests associated with a client device identified as the enrolled client device, the authentication system obtains an authentication token from the client device generated using the authentication credentials and also obtains device metadata corresponding to the client device. Based on the device metadata comparison during authentication, the authentication system detects device metadata anomalies and uses detected device metadata anomalies to determine a risk level for the client device. Based on the risk level, the authentication system authorizes or denies the client device from accessing requested services.

Device risk level based on device metadata comparison

Methods and systems provide for improved security for domain name resolution (DNS) and browsing. User privacy may be improved for client devices by first transmitting authentication information and the domain name to a server. After determining that the requesting security component on the client device is authorized to access a domain resolution service, the domain name is resolved to obtain an internet protocol (IP) address. Classification data is then retrieved from a third-party service for the domain name and/or the IP address. This classification data may then be evaluated against a first policy associated with the client device. When the evaluation indicates the client device is not allowed to access the IP address, the client device is sent information indicating that access is not permitted. When access is permitted, the client device may be sent the IP address and the classification data used for the evaluation.

Client device security for domain name resolution and browsing

An authentication system supports multi-factor authentication (MFA) when authenticating the identity of a user. A challenge-response portion of the authentication process is delegated to an MFA device—a secondary device within control of the user, but separate from the primary login device that the user is using when initiating the authentication. Communications between the MFA device and the login device are conducted using a short-range wireless communication protocol (e.g., Bluetooth™ or NFC), so that the two devices must be in close physical proximity to each other.

Transparent short-range wireless device factor in a multi-factor authentication system

A service monitors password and username use while maintaining username and password privacy by receiving a hash of a username, a hash of a password, and a host name and comparing the received hashes against a database of associated host names and hashes of usernames and passwords. When the comparison determines that the hash of the new password meets certain conditions, e.g., no hash in the database matches the hash of the new password, then the new password may be allowed and the service informs the security component accordingly.

Service protecting privacy while monitoring password and username usage

Methods and systems provide for receiving an assessment of a full uniform resource locator (URL) in a browser session in advance of the browser accessing the URL, maintaining client privacy in the process using a proxy between the client device and an assessment component on a server. The proxy receives the client identity and a URL. After substituting an arbitrary query identifier for the client identity in the assessment request, the proxy forwards the anonymized assessment request to the assessment component. In return the proxy receives classification data regarding the URL associated with the arbitrary query identifier, which the proxy associates with the client identity and subsequently forwards the classification data to the client.

Protecting client privacy during browsing

Methods and systems provide for resolving domain names by employing a proxy server between the client device and the resolving server. The methods and systems may maintain user privacy by the proxy receiving the client identity and an encrypted domain name. After substituting an arbitrary query identifier for the client identity in the resolution request, the proxy forwards the anonymized resolution request to the resolving server. In return the proxy receives an encrypted internet protocol (IP) address with the arbitrary query identifier, which the proxy associates with the client identity and forwards the encrypted IP address to the client for decrypting. Methods and systems provide for receiving an assessment of a full uniform resource locator (URL) in a browser session in advance of the browser accessing the URL. Methods and systems further prevent the re-use of passwords.

Growing community of inventors

El Cerrito, CA, United States of America

Stephen Lind