# US 11,122,026 B2 · Queue management and load shedding for complex authentication schemes > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,026 B2 - Document ID: US11122026B2 - Status: Granted - Kind: B2 - Application number: 16/528,720 - Filed: 2019-08-01 - Published: 2020-06-04 - Granted: 2021-09-14 - Earliest claimed: 2014-06-30 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Lawrence Koved; Bo Zhang - Web page: https://patentgrep.com/patent/US11122026B2 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/105: {Multiple levels of security} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/06: Authentication - H04W 12/065: Continuous authentication - H04W 12/068: {using credential vaults, e.g. password manager applications or one time password [OTP] applications} - H04L 9/32: including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Adjustments to be made to a system for authenticating users may be made by performing the following operations: obtaining a stochastic model of the system, wherein the stochastic model includes two or more classes of requests; obtaining a set of preferences for handling authentication requests and a set of operational parameter values; determining, based at least in part on the stochastic model and the set of operational parameter values, that adjusting an authentication scheme will improve a probable degree to which the authentication system will meet the set of preferences; responsive to the determination that adjusting the authentication scheme will improve the probable degree to which the system for authenticating users will meet the set of preferences, adjusting the authentication scheme of the system for authenticating users; and performing an authentication of a user based on the adjusted authentication scheme. ## Claims ### Claim 1 A method for authenticating a user, comprising: performing, by a hardware processor, operations comprising: obtaining a stochastic model of a system for authenticating users, wherein the stochastic model includes two or more classes of requests; obtaining a set of preferences for handling authentication requests and a set of operational parameter values; determining, based at least in part on the stochastic model and the set of operational parameter values, that adjusting an authentication scheme will improve a probable degree to which the authentication system will meet the set of preferences; responsive to the determination that adjusting the authentication scheme will improve the probable degree to which the system for authenticating users will meet the set of preferences, adjusting the authentication scheme of the system for authenticating users; and performing an authentication of a user based on the adjusted authentication scheme. ### Claim 2 (depends on 1) The method of claim 1, wherein obtaining a stochastic model of a system for authenticating users comprises generating the stochastic model of the system for authenticating users. ### Claim 3 (depends on 1) The method of claim 1, wherein the set of preferences includes information related to at least one of the following: an authentication method confidence preference, an authentication method usability preference, or an authentication method cost preference. ### Claim 4 (depends on 1) The method of claim 1, wherein adjusting the authentication scheme comprises adjusting at least one of: a service type, a service timing, or a processing resource. ### Claim 5 (depends on 3) The method of claim 3, wherein the authentication method usability preference includes information related to at least one of the following: a time required for a user to respond to a security challenge, a time for the system to process a user response and complete authentication, or an ability of a user to respond to a security challenge. ### Claim 6 (depends on 3) The method of claim 3, wherein: the set of preferences includes information related to authentication method usability; and the authentication method usability information includes a maximum acceptable authentication request service delay. ### Claim 7 (depends on 1) The method of claim 1, wherein the stochastic model includes stochastically modeling authentication request arrival rates for multiple classes of authentication requests. ### Claim 8 (depends on 1) The method of claim 1, wherein the stochastic model includes stochastically modeling service request delays for multiple authentication service types. ### Claim 9 (depends on 1) The method of claim 1, wherein the set of operational parameter values relate to at least one of system context and user context. ### Claim 10 (depends on 1) The method of claim 1, wherein the set of operational parameter values includes value(s) for at least one of: user historical access patterns, authentication system load, network delays, user device location, authentication queue processing history, estimated arrival rates of authentication requests, and risk associated with making an erroneous authentication decision. ### Claim 11 (depends on 1) The method of claim 1, wherein adjusting the authentication scheme includes applying load shedding to a first authentication request. ### Claim 12 (depends on 11) The method of claim 11, wherein the load shedding includes presenting a passive authentication challenge for the first authentication request at a point in time that precedes the first authentication request. ### Claim 13 (depends on 11) The method of claim 11, wherein: the load shedding includes replacing a first set of authentication challenges with a second set of authentication challenges; and the first set of authentication challenges contains at least one challenge not in the second set of authentication challenges. ### Claim 14 A non-transitory computer program product comprising a non-transitory computer readable storage medium having stored thereon: instructions stored on the computer readable storage medium for a processor to perform a process that includes: instructions executable by a processor to cause the processor to obtain a stochastic model of a system for authenticating users, a set of preferences for handling authentication requests, and a set of operational parameter values, wherein the stochastic model includes two or more classes of requests; instructions executable by a processor to cause the processor to determine, based at least in part on the model and the operational values, that adjusting an authentication scheme will improve a probable degree to which the authentication system will meet the set of preferences; instructions executable by a processor to cause the processor to adjust, responsive to the determination that adjusting the authentication scheme will improve the probable degree to which the system for authenticating users will meet the set of preferences, the authentication scheme of the system for authenticating users; and instructions executable by a processor to cause the processor to perform an authentication based on the adjusted authentication scheme. ### Claim 15 (depends on 14) The non-transitory computer program product of claim 14, wherein the stochastic model includes stochastically modeling authentication request arrival rates for multiple classes of authentication requests and service request delays for multiple authentication service types. ### Claim 16 (depends on 14) The non-transitory computer program product of claim 14, wherein adjusting the authentication scheme includes applying load shedding to a first authentication request. ### Claim 17 A computer system comprising: a hardware processor(s) set; and a non-transitory computer readable storage medium; wherein: the processor set is structured, located, connected or programmed to execute instructions for a process stored on the computer readable storage medium, the instructions including: instructions executable by the processor set to obtain a stochastic model of a system for authenticating users, a set of preferences for handling authentication requests, and a set of operational parameter values, wherein the stochastic model includes two or more classes of requests; instructions executable by the processor set to cause the processor set to determine, based at least in part on the model and the operational values, that adjusting an authentication scheme will improve a probable degree to which the authentication system will meet the set of preferences; and instructions executable by the processor set to cause the processor set to adjust, responsive to the determination that adjusting the authentication scheme will improve the probable degree to which the system for authenticating users will meet the set of preferences, the authentication scheme of the system for authenticating users. ### Claim 18 (depends on 17) The system of claim 17, wherein the instructions to obtain the stochastic model of a system for authenticating users comprises generating the stochastic model of a system for authenticating users. ### Claim 19 (depends on 17) The system of claim 17, wherein the instructions to adjust the authentication scheme comprise adjusting at least one of: a request service type, a request service timing, or a request for processing resources. ### Claim 20 (depends on 17) The system of claim 17, wherein the instructions to adjust the authentication scheme include applying load shedding to a first authentication request.