US 11,909,746 B2Granted

Multi-path user authentication and threat detection system and related methods

AssigneeDell Products L.P.

InventorsFnu Jasleen, Joseph P. Marquardt

Life of this patent

Estimating the term…

Loading patent…

Abstract

Embodiments of systems and methods are provided to enhance network security by providing secure, multi-path user authentication, while also providing a more convenient login experience to the user. In the present disclosure, a cloud-based user authentication and threat detection system is provided with an artificial intelligence (AI) engine and a training dataset. Utilizing a cloud-based system enables the AI engine to collect data from multiple devices located within different physical locations or environments (such as, for example, the user's home and office). The collected data is stored within the training dataset and used to create a personalized user profile for each user. Each time a user initiates login to a system or network from a particular location, the AI engine collects data from multiple devices within that location and utilizes the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats.

Claims25

Dependent claims

A user authentication and threat detection system, comprising:

an artificial intelligence (AI) engine comprising a plurality of software modules, which are stored within a computer-readable medium and executed by a processing device of a first cloud-based information handling system (IHS) to:
collect data from multiple devices located within different locations, wherein the collected data comprises system and user-related data, which is:
first collected from a first set of devices located at a first location when a user initiates login to a protected network from the first location;
and
then collected from a second set of devices located at a second location, which differs from the first location, when the user initiates log-in to the protected network from the second location;
store the collected data within a training dataset as user profile data;
and
securely authenticate the user initiating login to the protected network from the second location or detect potential security threats to the protected network from the user initiating login to the protected network from the second location based, at least in part, on the user profile data comprising system and user-related data previously collected from the first location that is stored within the training dataset;
and
the training dataset, wherein the training dataset is stored within the first cloud-based IHS or a second cloud-based IHS communicatively coupled to the first cloud-based IHS;
where the system and user-related data collected at each of the first and second locations comprises:
system data collected from a respective IHS from which the user initiates login at each of the first and second locations,
data collected from one or more respective trusted peripheral devices at each of the first and second locations, and
data collected from one or more devices linked to the trusted peripheral devices at each of the first and second locations.

11 more elements

A user authentication and threat detection system, comprising:

an artificial intelligence (AI) engine comprising a plurality of software modules, which are stored within a computer-readable medium and executed by a processing device of a first cloud-based information handling system (IHS) to:
collect data from multiple devices located within different locations, wherein the collected data comprises system and user-related data, which is collected from:
a first set of devices located at a first location when a user initiates login to a protected network from the first location;
and
a second set of devices located at a second location, which differs from the first location, when the user initiates login to the protected network from the second location;
store the collected data within a training dataset as user profile data;
and
securely authenticate the user or detect potential security threats to the protected network based, at least in part, on the user profile data stored within the training dataset;
and
the training dataset, wherein the training dataset is stored within the first cloud-based IHS or a second cloud-based IHS communicatively coupled to the first cloud-based IHS;
wherein the plurality of software modules comprise a data collection module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the data collection module is executed by the processing device to:
collect data from the IHS and one or more trusted devices located within the particular location, wherein the one or more trusted devices comprise at least one trusted peripheral device and/or one or more devices linked to the at least one trusted peripheral device, and
add the collected data to the user profile data stored within the training dataset;
and
wherein the plurality of software modules comprise a new device detection module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the new device detection module is executed by the processing device to:
detect a new device located within the particular location,
establish trust between the IHS and the new device by exchanging a token between the IHS and the new device, and
add the new device as a trusted device, if the token exchange is successful, so that the data collection module can begin collecting data from the new device and adding the collected data to the user profile data.

15 more elements

A user authentication and threat detection system, comprising:

an artificial intelligence (AI) engine comprising a plurality of software modules, which are stored within a computer-readable medium and executed by a processing device of a first cloud-based information handling system (IHS) to:
collect data from multiple devices located within different locations, wherein the collected data comprises system and user-related data, which is collected from:
a first set of devices located at a first location when a user initiates login to a protected network from the first location;
and
a second set of devices located at a second location, which differs from the first location, when the user initiates login to the protected network from the second location;
store the collected data within a training dataset as user profile data;
and
securely authenticate the user or detect potential security threats to the protected network based, at least in part, on the user profile data stored within the training dataset;
and
the training dataset, wherein the training dataset is stored within the first cloud-based IHS or a second cloud-based IHS communicatively coupled to the first cloud-based IHS;
wherein the plurality of software modules comprise a data collection module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the data collection module is executed by the processing device to:
collect data from the IHS and one or more trusted devices located within the particular location, wherein the one or more trusted devices comprise at least one trusted peripheral device and/or one or more devices linked to the at least one trusted peripheral device, and
add the collected data to the user profile data stored within the training dataset;
and
wherein the plurality of software modules comprise a user authentication and threat detection module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the user authentication and threat detection module is executed by the processing device to:
attempt to detect an identity or presence of the user at the particular location based on the user profile data stored within the training dataset and the data, which was collected from the IHS and the one or more trusted devices located within the particular location when the user initiated log-in,
authenticate the user and grant access to the protected network, if the identity or presence of the user is detected at the particular location, and
deny the user access to the protected network, if the identity or presence of the user is not detected at the particular location.

15 more elements

A computer implemented method, comprising:

first receiving a notification of user login from an information handling system (IHS) located at a first location when a user initiates login to a protected network from the IHS;
then collecting data from the IHS and one or more trusted devices located within the first location, wherein the collected data comprises system and user-related data;
then adding the collected data from the IHS and one or more trusted devices located within the first location to user profile data previously stored within a training dataset;
and
then using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network on the information handling system (IHS) located at the first location;
wherein the user profile data previously stored within the training dataset comprises system and user-related data previously collected from an IHS and one or more trusted devices located within a second location when the user previously initiated login to the protected network from the second location;
and
where the system and user-related data collected at each of the first and second locations comprises:
system data collected from a respective IHS from which the user initiates login at each of the first and second locations,
data collected from one or more respective trusted peripheral devices at each of the first and second locations, and
data collected from one or more devices linked to the trusted peripheral devices at each of the first and second locations.

8 more elements

A computer implemented method, comprising:

receiving a notification of user login from an information handling system (IHS) located at a first location when a user initiates login to a protected network from the IHS;
collecting data from the IHS and one or more trusted devices located within the first location, wherein the collected data comprises system and user-related data;
adding the collected data to user profile data previously stored within a training dataset;
and
using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network;
wherein said using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network comprises using the collected data and the user profile data to:
determine if the user's login behavior is normal, and
detect if at least one trusted device of the one or more trusted devices is in range of the IHS located at the first location;
and
where the user's login behavior is determined to be normal if the user initiates the log-in from the IHS located at a first location during normal work hours of the user and/or during a previously scheduled meeting time, and where the user's log-in behavior is determined to be abnormal if the user initiates the login from the IHS located at a first location not during normal work hours of the user and/or not during a previously scheduled meeting time.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/167,582Filed 4 Feb 2021
Published: US 2022/0247762 A14 Aug 2022
Granted: 20 Feb 2024
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/1433
For detecting or protecting against malicious traffic: vulnerability analysis
G06F 18/214
Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation: generating training…
H04L 63/08
Network architectures or network communication protocols for network security: for authentication of entities

Family

US 2022/0247762 A1Pre-grant publication · published 4 Aug 2022
US 11,909,746 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key