# US 10,313,364 B2 · Adaptive client-aware session security

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,313,364 B2
- Document ID: US10313364B2
- Status: Granted
- Kind: B2
- Application number: 15/048,823
- Filed: 2016-02-19
- Published: 2016-06-16
- Granted: 2019-06-04
- Earliest claimed: 2014-01-13
- Assignees: Amazon Technologies, Inc.
- Applicants: Amazon Technologies, Inc.
- Inventors: Gregory Branchek Roth; Nicholas Alexander Allen
- Web page: https://patentgrep.com/patent/US10313364B2

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 21/45: Structures or tools for the administration of authentication
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- H04L 61/5007: Internet protocol [IP] addresses
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- G06F 2221/2101: Auditing as a secondary aspect
- G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS
- H04L 63/105: {Multiple levels of security}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Source information for requests submitted to a system are classified to enable differential handling of requests over a session whose source information changes over the session. For source information (e.g., an IP address) classified as fixed, stronger authentication may be required to fulfill requests when the source information changes during the session. Similarly, for source information classified as dynamic, source information may be allowed to change without requiring the stronger authentication.

## Claims

### Claim 1

A computer-implemented method, comprising:
under the control of one or more computer systems configured with executable instructions,
receiving a first request associated with an identifier and a first source;
determining, based at least in part on a classification of the first source, that a change from a second source to the first source is indicative of potential malicious activity; and
causing an operation to be performed as a result of determining that the change from the second source to the first source is indicative of potential malicious activity, wherein the operation is initiation of an authentication process.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein the first source corresponds to a first Internet Protocol address, the second source corresponds to a second Internet Protocol address, and the identifier identifies a session.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, wherein:
the operation initiates an authentication process; and
the method further comprises updating a database dependent on whether the authentication process results in successful authentication.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein determining that the change from the second source to the first source is indicative of potential malicious activity comprises making a call to another computer system that indicates the first source and the second source and receiving a response from the other computer system, the response indicating whether the change from the second source to the first source is indicative of potential malicious activity.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, wherein:
the operation is initiation of a strong authentication process; and
the method further comprises:
receiving a third request associated with a second identifier and a third source;
determining, based at least in part on a classification of the third source, that a change from a fourth source to the third source is not determined to be indicative potential malicious activity; and
a weak authentication process to be performed as a result of determining that the change from the second source to the first source is not determined to be indicative of potential malicious activity.

### Claim 6

A system, comprising:
one or more processors; and
memory including instructions that, when executed by the one or more processors, cause the system to:
receive a second request associated with an identifier and a second source, the second source different from a first source of a first request associated with the identifier;
determine, based at least in part on a classification of the first source that indicates whether a change from the first source to another source is unexpected, an operation to perform; and
cause the operation to be performed, wherein the instructions that cause the system to determine the operation to perform to protect the system, as a result of execution by the one or more processors, cause the system to select an authentication type from a plurality of authentication types that includes strong authentication and weak authentication.

### Claim 7 (depends on 6)

The system of claim 6, wherein the instructions further comprise instructions that, as a result of execution by the one or more processors, cause the system to update a database dependent on an authentication process associated with the operation.

### Claim 8 (depends on 6)

The system of claim 6, wherein the instructions, as a result of execution by the one or more processors, further cause the system to calculate a classification score for the classification and determine whether to change the classification of the first source based at least in part on the classification score.

### Claim 9 (depends on 8)

The system of claim 8, wherein a first threshold classification score for changing from a first classification to a second classification is different than a second threshold classification score for changing from the second classification to the first classification.

### Claim 10 (depends on 6)

The system of claim 6, wherein the instructions to determine the operation to perform to protect the system comprise instructions that, as a result of execution by the one or more processors, cause the system to submit a request specifying the first source and second source to another system and determine the operation to perform based at least in part on a response from the other system.

### Claim 11 (depends on 6)

The system of claim 6, wherein the instructions further comprise instructions that, as a result of execution by the one or more processors, cause the system to:
receive, from an entity, information regarding the first source; and
update a classification of the first source in a database based at least in part on the information and a reputation score associated with the entity.

### Claim 12

A non-transitory computer-readable storage medium having stored thereon instructions that, as a result of execution by one or more processors, cause a computer system to:
obtain information that specifies a first request source and a second request source;
classify, based at least in part on a classification of the first request source, a change from the first request source to the second request source during a session associated with an identity to determine a classification of the change;
provide the classification of the change; and
receive the classification of the change and determine, based at least in part on the classification of the change, whether to initiate an authentication process.

### Claim 13 (depends on 12)

The non-transitory computer-readable storage medium of claim 12, wherein:
the instructions that cause the computer system to obtain the information cause the computer system to receive the information in an application programming interface request; and
the instructions that cause the computer system to provide the classification of the change to protect the computer system cause the computer system to provide the classification of the change to protect the computer system in a response to the application programming interface request.

### Claim 14 (depends on 12)

The non-transitory computer-readable storage medium of claim 12, wherein:
the instructions that cause the computer system to obtain the information cause the computer system to obtain the information from a first request specifying the first request source and a second request specifying the second request source.

### Claim 15 (depends on 12)

The non-transitory computer-readable storage medium of claim 12, wherein the first request source is a set of network addresses and the second request source is a second set of network addresses.

### Claim 16 (depends on 12)

The non-transitory computer-readable storage medium of claim 12, wherein the instructions that cause the computer system to classify the change are further based at least in part on a classification of the second request source.

### Claim 17 (depends on 12)

The non-transitory computer-readable storage medium of claim 12, wherein the instructions further comprise instructions that, as a result of execution by the one or more processors, cause the computer system to:
obtain information indicating whether authentication after the change was successful; and
update a database that at least stores a classification of the first source based at least in part on the information indicating whether the authentication after the change was successful.