# US 10,375,119 B2 · Dynamic multi-factor authentication challenge generation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,119 B2 - Document ID: US10375119B2 - Status: Granted - Kind: B2 - Application number: 15/221,620 - Filed: 2016-07-28 - Published: 2018-02-01 - Granted: 2019-08-06 - Earliest claimed: 2016-07-28 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Hagai Aronowitz; Lawrence Koved; Ian M. Molloy; Bo Zhang - Web page: https://patentgrep.com/patent/US10375119B2 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Dynamic multi-factor authentication challenge selection is provided. A risk associated with an operation that requires authentication of a user of a client device is determined. A plurality of authentication methods is identified. Each respective authentication method associated with a level of security offsetting the risk and a computing cost associated with a respective authentication method. One or more authentication methods are selected from the plurality of authentication methods according to the risk and to minimize the computing cost associated with authenticating the operation. ## Claims ### Claim 1 A computer-implemented method for dynamic multi-factor authentication challenge selection to control access to protected network resources, the computer-implemented method comprising: determining, by a computer, a risk associated with an operation to access a resource connected to a network that requires authentication of a user of a client device; identifying, by the computer, a plurality of authentication methods, each respective authentication method associated with a level of security offsetting the risk and a computing cost associated with a respective authentication method; sending, by the computer responsive to the computer determining that a set of client-side selection factors maintained at the client device are needed to achieve a required confidence level in an identity of the user, a request for the set of client-side selection factors to the client device; responsive to the computer requesting the set of client-side selection factors from the client device, receiving, by the computer, the set of client-side selection factors of time and memory needed to capture a biometric sample by the client device; selecting, by the computer, a set of authentication methods from the plurality of authentication methods to send to the client device to achieve the required confidence level in the identity of the user based on a set of server-side selection factors maintained at the computer and the set of client-side selection factors received by the computer to minimize the risk and the computing cost associated with authenticating the operation to access the resource connected to the network; sending, by the computer, the selected set of authentication methods to the client device; responsive to the computer determining that a confidence level in the identity of the user is less than a defined confidence level threshold based on a score corresponding to one or more responses received from the client device to the selected set of authentication methods, determining, by the computer, whether more authentication methods having an equivalent associated computing cost exist in an equivalence class associated with the selected set of authentication methods, wherein the equivalence class is a group of interchangeable challenges having an equivalence relation between them to satisfy the set of client-side selection factors; responsive to the computer determining that no more authentication methods having the equivalent associated computing cost exist in the equivalence class associated with the selected set of authentication methods, determining, by the computer, that the authentication of the user was unsuccessful; and denying, by the computer, access by the client device to the resource connected to the network based on the unsuccessful authentication of the user. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein each respective authentication method has an associated user convenience factor, and wherein the computer selects the selected set of authentication methods to maximize an aggregate user convenience that satisfies the risk associated with the operation to access the resource connected to the network. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the computer randomizes which respective authentication method is selected to minimize spoofing. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the computer selects the selected set of authentication methods based on a history of authentication method selection by the computer for a given operation to access a particular resource connected to the network requiring user authentication. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein the computer selects a different authentication method than a most recently selected authentication method according to the history of authentication method selection to minimize replay attacks on the computer. ### Claim 6 (depends on 1) The computer-implemented method of claim 1 further comprising: analyze, by the computer, a set of responses to the selected set of authentication methods, wherein each response in the set of responses corresponds to a respective authentication method in the selected set of authentication methods; scoring, by the computer, each response in the set of responses; fusing, by the computer, scores corresponding to the set of responses to generate a fusion score; and generating, by the computer, the confidence level in the identity of the user of the client device based on the fusion score. ### Claim 7 (depends on 1) The computer-implemented method of claim 1 further comprising: responsive to the computer determining that the confidence level in the identity of the user is greater than or equal to the defined confidence level threshold, determining, by the computer, that the authentication of the user was successful; and authorizing, by the computer, access by the client device to the resource connected to the network based on the successful authentication of the user. ### Claim 8 (depends on 1) The computer-implemented method of claim 1 further comprising: responsive to the computer determining that more authentication methods having the equivalent associated computing cost exist in the equivalence class associated with the selected set of authentication methods, repeating, by the computer, steps to generate a new confidence level in the identity of the user. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the plurality of authentication methods include authentication challenges and contextual challenges. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein authentication method selection factors are selected from a group consisting of user experience factors, environmental factors, authentication strength factors, computational cost factors, network cost factors, authentication service factors, contextual factors, user history factors, user trust level factors, and value of resource at risk factors. ### Claim 11 A computer system for dynamic multi-factor authentication challenge selection to control access to protected network resources, the computer system comprising: a bus system; a storage device connected to the bus system, wherein the storage device stores program instructions; and a processor connected to the bus system, wherein the processor executes the program instructions to: determine a risk associated with an operation to access a resource connected to a network that requires authentication of a user of a client device; identify a plurality of authentication methods, each respective authentication method associated with a level of security offsetting the risk and a computing cost associated with a respective authentication method; send, responsive to determining that a set of client-side selection factors maintained at the client device are needed to achieve a required confidence level in an identity of the user, a request for the set of client-side selection factors to the client device; receive the set of client-side selection factors of time and memory needed to capture a biometric sample by the client device in response to requesting the set of client-side selection factors from the client device; select a set of authentication methods from the plurality of authentication methods to send to the client device to achieve the required confidence level in the identity of the user based on a set of server-side selection factors maintained at the computer system and the set of client-side selection factors received by the computer system to minimize the risk and the computing cost associated with authenticating the operation to access the resource connected to the network; send the selected set of authentication methods to the client device; determine whether more authentication methods having an equivalent associated computing cost exist in an equivalence class associated with the selected set of authentication methods in response to determining that a confidence level in an identity of the user is less than a defined confidence level threshold based on a score corresponding to one or more responses received from the client device to the selected set of authentication methods, wherein the equivalence class is a group of interchangeable challenges having an equivalence relation between them to satisfy the set of client-side selection factors; determine that the authentication of the user was unsuccessful in response to determining that no more authentication methods having the equivalent associated computing cost exist in the equivalence class associated with the selected set of authentication methods; and deny access by the client device to the resource connected to the network based on the unsuccessful authentication of the user. ### Claim 12 A computer program product for dynamic multi-factor authentication challenge selection to control access to protected network resources, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising: determining, by the computer, a risk associated with an operation to access a resource connected to a network that requires authentication of a user of a client device; identifying, by the computer, a plurality of authentication methods, each respective authentication method associated with a level of security offsetting the risk and a computing cost associated with a respective authentication method; sending, by the computer responsive to the computer determining that a set of client-side selection factors maintained at the client device are needed to achieve a required confidence level in an identity of the user, a request for the set of client-side selection factors to the client device; responsive to the computer requesting the set of client-side selection factors from the client device, receiving, by the computer, the set of client-side selection factors of time and memory needed to capture a biometric sample by the client device; selecting, by the computer, a set of authentication methods from the plurality of authentication methods to send to the client device to achieve the required confidence level in the identity of the user based on a set of server-side selection factors maintained at the computer and the set of client-side selection factors received by the computer to minimize the risk and the computing cost associated with authenticating the operation to access the resource connected to the network; sending, by the computer, the selected set of authentication methods to the client device; responsive to the computer determining that a confidence level in an identity of the user is less than a defined confidence level threshold based on a score corresponding to one or more responses received from the client device to the selected set of authentication methods, determining, by the computer, whether more authentication methods having an equivalent associated computing cost exist in an equivalence class associated with the selected set of authentication methods, wherein the equivalence class is a group of interchangeable challenges having an equivalence relation between them to satisfy the set of client-side selection factors; responsive to the computer determining that no more authentication methods having the equivalent associated computing cost exist in the equivalence class associated with the selected set of authentication methods, determining, by the computer, that the authentication of the user was unsuccessful; and denying, by the computer, access by the client device to the resource connected to the network based on the unsuccessful authentication of the user. ### Claim 13 (depends on 12) The computer program product of claim 12, wherein each respective authentication method has an associated user convenience factor, and wherein the computer selects the selected set of authentication methods to maximize an aggregate user convenience that satisfies the risk associated with the operation to access the resource connected to the network. ### Claim 14 (depends on 12) The computer program product of claim 12, wherein the computer randomizes which respective authentication method is selected to minimize spoofing. ### Claim 15 (depends on 12) The computer program product of claim 12, wherein the computer selects the selected set of authentication methods based on a history of authentication method selection by the computer for a given operation to access a particular resource connected to the network requiring user authentication. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the computer selects a different authentication method than a most recently selected authentication method according to the history of authentication method selection to minimize replay attacks on the computer.