# US 11,030,286 B2 · Authentication apparatus, method, system and program, and server apparatus

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,030,286 B2
- Document ID: US11030286B2
- Status: Granted
- Kind: B2
- Application number: 16/750,267
- Filed: 2020-01-23
- Published: 2020-05-21
- Granted: 2021-06-08
- Earliest claimed: 2015-01-19
- Assignees: NEC Corporation; The University of Tokyo
- Applicants: NEC Corporation; The University of Tokyo
- Inventors: Shizuo Sakamoto; Rie Yamaguchi; Hiroya Susuki
- Web page: https://patentgrep.com/patent/US11030286B2

## CPC

- G06F 21/31: User authentication
- G06F 21/12: Protecting executable software
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)}
- H04W 12/068: {using credential vaults, e.g. password manager applications or one time password [OTP] applications}
- H04L 2209/80: Wireless
- H04L 2463/082: applying multi-factor authentication
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A scenario including a combination of procedures of multi-factor authentication required for a terminal to receive provision of a service is stored and managed in association with the service, and a probability that the procedure will succeed is stored and managed in association with each of the procedures, a success probability of the service through the scenario, is calculated based on the probability regarding the procedure to evaluate at least one of security and usability based on the success probability, and the service to the terminal, is controlled according to the evaluation result.

## Claims

### Claim 1

A multi-factor authentication apparatus comprising:
at least one memory configured to store instructions; and
at least one processor configured to execute the instructions to perform:
selecting a security parameter according to a service to be provided to a terminal;
evaluating a first success probability of an attacker through a first scenario including a first combination of procedures of multi-factor authentication;
comparing the first success probability with the security parameter; and
based on the first success probability exceeding the security parameter, stopping provision of the service through the first scenario to the terminal,
wherein the at least one processor is further configured to execute the instructions to perform:
changing the first scenario to a second scenario including a second combination of procedures of multi-factor authentication so that the first success probability of the attacker through the second scenario becomes lower than the security parameter; and
providing the service to the terminal through the second scenario.

### Claim 2 (depends on 1)

The multi-factor authentication apparatus according to claim 1, wherein the at least one processor is further configured to execute the instructions to perform:
evaluating a second success probability of a user through the first scenario; and
based on the first success probability falling below the security parameter and the second success probability exceeding a predetermined usability parameter, providing the service to the terminal through the first scenario.

### Claim 3

A multi-factor authentication method comprising:
selecting a security parameter according to a service to be provided to a terminal;
evaluating a first success probability of an attacker through a first scenario including a combination of procedures of multi-factor authentication;
comparing the first success probability with the security parameter; and
based on the first success probability exceeding the security parameter, stopping provision of the service through the first scenario to the terminal,
wherein the method further comprises:
changing the first scenario to a second scenario including a second combination of procedures of multi-factor authentication so that the first success probability of the attacker through the second scenario becomes lower than the security parameter; and
providing the service to the terminal through the second scenario.

### Claim 4

A non-transitory computer-readable recording medium storing a program, the program causing a computer to perform:
selecting a security parameter according to a service to be provided to a terminal;
evaluating a first success probability of an attacker through a first scenario including a combination of procedures of multi-factor authentication;
comparing the first success probability with the security parameter; and
based on the first success probability exceeding the security parameter, stopping provision of the service through the first scenario to the terminal,
wherein the program further causes the computer perform:
changing the first scenario to a second scenario including a second combination of procedures of multi-factor authentication so that the first success probability of the attacker through the second scenario becomes lower than the security parameter; and
providing the service to the terminal through the second scenario.