# US 11,030,287 B2 · User-behavior-based adaptive authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,030,287 B2 - Document ID: US11030287B2 - Status: Granted - Kind: B2 - Application number: 16/003,039 - Filed: 2018-06-07 - Published: 2019-12-12 - Granted: 2021-06-08 - Earliest claimed: 2018-06-07 - Assignees: T-Mobile USA, Inc. - Applicants: T-Mobile USA, Inc. - Inventors: Ahmad Arash Obaidi - Web page: https://patentgrep.com/patent/US11030287B2 ## CPC - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints - G06F 21/36: by graphic or iconic representation - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract The use of user-behavior-based adaptive authentication may provide more secure user authentication without sacrificing user convenience. A baseline behavior pattern of a user may be identified using a machine learning algorithm based on user behavior data collected by one or more applications on at least one user device of the particular user for a predetermined time period. One or more events that deviate from the baseline behavior pattern of the user during a specific time period are then detected using the machine learning algorithm based on new user behavior data of the user obtained during the specific time period. In response to receiving a request from an application to authenticate a particular user for access or continued access to a resource, an authentication question and a correct answer for the authentication question are generated based on a detail of an event that deviates from the baseline behavior pattern. ## Claims ### Claim 1 One or more non-transitory computer-readable media collectively storing computer-executable instructions that upon execution cause one or more computing nodes to collectively perform acts comprising: obtaining, from multiple instances of a collection application installed on multiple user devices associated with a user, user behavior data of the user that comprises at least verbal expressions of the user as captured by a user device of the multiple user devices; identifying, using a machine learning algorithm, a baseline behavior pattern of a user based on the user behavior data collected within a predetermined time period from the multiple user devices; detecting, using the machine learning algorithm, an event that deviates from the baseline behavior pattern of the user during a specific time period based on new user behavior data of the user obtained during the specific time period; and in response to receiving a request from an application to authenticate a particular user for access or continued access to a resource, generating an authentication question and a correct answer for the authentication question based on a detail of the event that deviates from the baseline behavior pattern, the authentication question comprising a natural language question relating to the event that deviates from the baseline behavior pattern and the correct answer comprising the detail of the event that deviates from the baseline behavior pattern. ### Claim 2 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the acts further comprise: sending a validation prompt that includes at least the authentication question to the application for presentation to the particular user; receiving an inputted answer to the authentication question from the application in response to the validation prompt; providing a first indication to the application that the particular user is authenticated in response to the inputted answer matching the correct answer; and providing a second indication to the application that the particular user is not authenticated in response to the inputted answer failing to match correct answer. ### Claim 3 (depends on 2) The one or more non-transitory computer-readable media of claim 2, wherein the application provides the particular user with access to the resource in response to the first indication, and denies the particular user access to the resource in response to the second indication. ### Claim 4 (depends on 2) The one or more non-transitory computer-readable media of claim 2, wherein the validation prompt is a multiple-choice validation prompt that further includes a plurality of answers that comprise the correct answer and one or more incorrect answers such that the inputted answer is one of the plurality of answers, or a fill-in validation prompt that prompts for a manual input of the inputted answer to the authentication question. ### Claim 5 (depends on 4) The one or more non-transitory computer-readable media of claim 4, wherein the sending the validation prompt includes sending the fill-in validation prompt to the application when the particular user is an elevated user or when a transaction of the particular user with respect to the resource is an elevated transaction. ### Claim 6 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the receiving the request includes receiving the request to authenticate the particular user in response to an authentication credential inputted by the particular user to the application failing to match a stored authentication credential of the user. ### Claim 7 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the receiving the request includes receiving the request to authenticate the particular user in response to an authentication credential inputted by the particular user to the application matching a stored authentication credential of an authorized user, and biometric data of the particular user as captured by the application failing to match stored biometric data of the user. ### Claim 8 (depends on 7) The one or more non-transitory computer-readable media of claim 7, wherein the biometric data includes one or more of a full or partial facial image of the particular user, a voiceprint of the particular user, a fingerprint of the particular user, or a retinal scan of the particular user. ### Claim 9 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the receiving the request includes receiving the request to authenticate the particular user in response to an authentication credential inputted by the particular user to the application matching a stored authentication credential of an authorized user, and biometric data of the particular user as captured by the application matching stored biometric data of the user. ### Claim 10 (depends on 9) The one or more non-transitory computer-readable media of claim 9, wherein the sensor data includes at least one of Global Positioning System (GPS) geolocation data, camera image data, video data, compass reading data, or accelerometer data. ### Claim 11 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the user behavior data is collected by each of the multiple instances of a collection application following each instance of the collection application receiving a user input indicating that the user consents to collection of the user behavior data. ### Claim 12 (depends on 1) The one or more computer-readable media of claim 1, wherein the baseline behavior pattern comprises a persistent verbal expression in the speech of the user and the one or more events that deviate from the baseline behavior of the user comprises a deviation from the persistent verbal expression. ### Claim 13 A computer-implemented method, comprising: obtaining, from multiple instances of a collection application installed on multiple user devices associated with a user, user behavior data of the user that comprises at least verbal expressions of the user as captured by a user device of the multiple user devices, identifying, using a machine learning algorithm, a baseline behavior pattern of a user based on the user behavior data collected within a predetermined time period from the multiple user devices; detecting, using the machine learning algorithm of the wireless carrier network, an event that deviates from the baseline behavior pattern of the user during a specific time period based on new user behavior data of the user obtained during the specific time period; and in response to receiving a request from an application to authenticate a particular user for access or continued access to a resource, generating an authentication question and a correct answer for the authentication question based on a detail of the event that deviates from the baseline behavior pattern, the authentication question comprising a natural language question relating to the event that deviates from the baseline behavior pattern and the correct answer comprising the detail of the event that deviates from the baseline behavior pattern. ### Claim 14 (depends on 13) The computer-implemented method of claim 13, further comprising: sending a validation prompt that includes at least the authentication question to the application for presentation to the particular user; receiving an inputted answer to the authentication question from the application in response to the validation prompt; providing a first indication to the application that the particular user is authenticated in response to the inputted answer matching the correct answer; and providing a second indication to the application that the particular user is not authenticated in response to the inputted answer failing to match correct answer, wherein the application provides the particular user with access to the resource in response to the first indication, and denies the particular user access to the resource in response to the second indication. ### Claim 15 (depends on 13) The computer-implemented method of claim 13, wherein the receiving the request includes receiving the request to authenticate the particular user in response to an authentication credential inputted by the particular user to the application failing to match a stored authentication credential of the user. ### Claim 16 A system, comprising: one or more processors; and memory including a plurality of computer-executable components that are executable by the one or more processors to perform a plurality of actions, the plurality of actions comprising: obtaining, from multiple instances of a collection application installed on multiple user devices associated with a user, user behavior data of the user that comprises at least verbal expressions of the user as captured by a user device of the multiple user devices; identifying, using a machine learning algorithm, a baseline behavior pattern of a user based on the user behavior data collected within a predetermined time period from the multiple user devices; detecting using the machine learning algorithm an event that deviates from the baseline behavior pattern of the user during a specific time period based on new user behavior data of the user obtained during the specific time period; and in response to receiving a request from an application to authenticate a particular user for access or continued access to a resource that includes data or a service that is provided specifically for use by the user, generating an authentication question and a correct answer for the authentication question based on a detail of the event that deviates from the baseline behavior pattern, the authentication question comprising a natural language question relating to the event that deviates from the baseline behavior pattern and the correct answer comprising the detail of the event that deviates from the baseline behavior pattern.