Back to results
US 11,537,706 B1Granted
Risk-based scheduling for credential rotation
AssigneeAmazon Technologies, Inc.
InventorNima Sharifi Mehr
Life of this patent
Estimating the term…
Abstract
A service provider receives a set of credentials from a customer and a request to access one or more services provided by the service provider. An authentication service of the service provider receives the set of credentials and, based at least in part on the received set of credentials, one or more activities performed by the customer, the customer's user profile, and the system configuration of the customer's computing device, calculates a risk score. The authentication service subsequently utilizes the calculated risk score to determine a credential rotation schedule for the set of credentials. The authentication service updates one or more servers to enforce the new credential rotation schedule and enables the customer to utilize the set of credentials to access the one or more services.
Claims20
A computer-implemented method, comprising:
- receiving, from a computing system operated by a customer, a credential for the customer associated with a service provider;
- determining a first risk score factor based at least in part on an entropy value for the credential;
- determining a second risk score factor based at least in part on a log including information generated as a result of one or more activities using the credential and performed by the customer in interacting with the service provider and payment information included in a customer profile corresponding to the customer;
- determining a third risk score factor based at least in part on a system configuration of the computing system, the system configuration indicating one or more applications installed on the computing system and supported by an operating system installed on the computing system;
- calculating a first composite risk score based at least in part on the first risk score factor, the second risk score factor, and the third risk score factor;
- determining, based at least in part on the first composite risk score, a first credential rotation schedule for the credential including a first amount of time that the credential is valid;
- updating an authentication server to enforce the first credential rotation schedule for the credential;
- calculating a second composite risk score based at least in part on an update of the first risk score factor, an update of the second risk score factor, and an update of the third risk score factor;
- determining, based at least in part on the second composite risk score, a second credential rotation schedule for the credential including a non-zero second amount of time that the credential is valid that is different from the first amount of time based at least in part on the second composite risk score;
- and
- updating the authentication server to enforce the second credential rotation schedule for the credential.
8 more elements
A system, comprising:
- one or more processors;
- and
- memory storing instructions that, as a result of being executed by the one or more processors, cause the system to:
- receive a credential for an entity;
- calculate a first risk score based at least in part on the credential, one or more activities associated with the credential and caused at least in part by a first operation performed by the entity and recorded in a log maintained by the system, payment information included in a profile corresponding to the entity, and a first system configuration of a first computing device associated with the credential, the first system configuration indicating a change to a first set of applications installed on the first computing device and supported by a first operating system installed on the first computing device;
- determine;
- based at least in part on the first risk score, a first credential rotation schedule for the credential indicating a first amount of time for which the credential is valid;
- update the first credential rotation schedule for the credential based at least in part on the first risk score;
- determine;
- based at least in part on a second risk score, a second credential rotation schedule for the credential including a non-zero second amount of time that the credential is valid that is different from the first amount of time, the non-zero second amount of time being different than the first amount of time based at least in part on the second risk score, the second risk score comprising an update of the first risk score including one or more further activities associated with the credential and caused at least in part by a second operation performed by the entity and a second system configuration of a second computing device associated with the credential, the second system configuration indicating a second set of applications installed on the second computing device and supported by a second operating system installed on the second computing device;
- and
- update an authentication server to enforce the second credential rotation schedule for the credential.
9 more elements
A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to:
- in response to receiving a credential, calculate a first risk score based at least in part on the credential, one or more activities associated with the credential and caused at least in part by an operation performed by a user during access to one or more services provided by a service provider, the one or more activities indicated in a log maintained by the service provider, payment information included in a user profile corresponding to the user, and a system configuration of a computing device from which the credential was received, the system configuration indicating one or more applications installed on the computing device and supported by an operating system installed on the computing device;
- determine, based at least in part on the first risk score, a first credential rotation schedule for the credential indicating a first amount of time;
- determine, based at least in part on a second risk score that is an update of the first risk score, a second credential rotation schedule for the credential indicating a non-zero second amount of time that is different from the first credential rotation schedule;
- and
- update a computing device responsible for managing the credential.
2 more elements
Dependencies are inferred from the claim text.