# US 11,909,746 B2 · Multi-path user authentication and threat detection system and related methods

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,909,746 B2
- Document ID: US11909746B2
- Status: Granted
- Kind: B2
- Application number: 17/167,582
- Filed: 2021-02-04
- Published: 2022-08-04
- Granted: 2024-02-20
- Earliest claimed: 2021-02-04
- Assignees: Dell Products L.P.
- Applicants: Dell Products L.P.
- Inventors: Fnu Jasleen; Joseph P. Marquardt
- Web page: https://patentgrep.com/patent/US11909746B2

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1433: {Vulnerability analysis}
- G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/102: {Entity profiles}
- H04L 2463/082: applying multi-factor authentication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Embodiments of systems and methods are provided to enhance network security by providing secure, multi-path user authentication, while also providing a more convenient login experience to the user. In the present disclosure, a cloud-based user authentication and threat detection system is provided with an artificial intelligence (AI) engine and a training dataset. Utilizing a cloud-based system enables the AI engine to collect data from multiple devices located within different physical locations or environments (such as, for example, the user's home and office). The collected data is stored within the training dataset and used to create a personalized user profile for each user. Each time a user initiates login to a system or network from a particular location, the AI engine collects data from multiple devices within that location and utilizes the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats.

## Claims

### Claim 1

A user authentication and threat detection system, comprising:
an artificial intelligence (AI) engine comprising a plurality of software modules, which are stored within a computer-readable medium and executed by a processing device of a first cloud-based information handling system (IHS) to:
collect data from multiple devices located within different locations, wherein the collected data comprises system and user-related data, which is:
first collected from a first set of devices located at a first location when a user initiates login to a protected network from the first location; and
then collected from a second set of devices located at a second location, which differs from the first location, when the user initiates log-in to the protected network from the second location;
store the collected data within a training dataset as user profile data; and
securely authenticate the user initiating login to the protected network from the second location or detect potential security threats to the protected network from the user initiating login to the protected network from the second location based, at least in part, on the user profile data comprising system and user-related data previously collected from the first location that is stored within the training dataset; and
the training dataset, wherein the training dataset is stored within the first cloud-based IHS or a second cloud-based IHS communicatively coupled to the first cloud-based IHS;
where the system and user-related data collected at each of the first and second locations comprises:
system data collected from a respective IHS from which the user initiates login at each of the first and second locations,
data collected from one or more respective trusted peripheral devices at each of the first and second locations, and
data collected from one or more devices linked to the trusted peripheral devices at each of the first and second locations.

### Claim 2 (depends on 1)

The user authentication and threat detection system as recited in claim 1, wherein the plurality of software modules comprise a data collection module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the data collection module is executed by the processing device to:
collect data from the IHS and one or more trusted devices located within the particular location, wherein the one or more trusted devices comprise at least one of the trusted peripheral devices and the one or more devices linked to the at least one trusted peripheral device; and
add the collected data to the user profile data stored within the training dataset.

### Claim 3 (depends on 2)

The user authentication and threat detection system as recited in claim 2, wherein the at least one trusted peripheral device is selected from a group comprising a laptop computer, a tablet computer, a security camera, and a smart device.

### Claim 4 (depends on 2)

The user authentication and threat detection system as recited in claim 2, wherein the one or more devices linked to the at least one trusted peripheral device is a smart device.

### Claim 5 (depends on 1)

The user authentication and threat detection system as recited in claim 1, where the system data collected from the respective IHS from which the user initiates login at each of the first and second locations comprises at least one of calendar data, voice commands, or a list comprising one or more of the user's most frequently used applications.

### Claim 6 (depends on 1)

The user authentication and threat detection system as recited in claim 1, where the data collected from each of the one or more respective trusted peripheral devices at each of the first and second locations comprises at least one of a signal strength of a cellular signal emitted from each of the one or more respective trusted peripheral devices, audio signals obtained by each of the one or more respective trusted peripheral devices, or video signals obtained by each of the one or more respective trusted peripheral devices.

### Claim 7 (depends on 1)

The user authentication and threat detection system as recited in claim 1, where the data collected from each of the one or more devices linked to the trusted peripheral devices at each of the first and second locations comprises at least one of a signal strength of a cellular signal emitted from each of the one or more devices linked to the trusted peripheral devices, audio signals obtained by each of the one or more devices linked to the trusted peripheral devices, or video signals obtained by each of the one or more devices linked to the trusted peripheral devices.

### Claim 8

A user authentication and threat detection system, comprising:
an artificial intelligence (AI) engine comprising a plurality of software modules, which are stored within a computer-readable medium and executed by a processing device of a first cloud-based information handling system (IHS) to:
collect data from multiple devices located within different locations, wherein the collected data comprises system and user-related data, which is collected from:
a first set of devices located at a first location when a user initiates login to a protected network from the first location; and
a second set of devices located at a second location, which differs from the first location, when the user initiates login to the protected network from the second location;
store the collected data within a training dataset as user profile data; and
securely authenticate the user or detect potential security threats to the protected network based, at least in part, on the user profile data stored within the training dataset; and
the training dataset, wherein the training dataset is stored within the first cloud-based IHS or a second cloud-based IHS communicatively coupled to the first cloud-based IHS;
wherein the plurality of software modules comprise a data collection module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the data collection module is executed by the processing device to:
collect data from the IHS and one or more trusted devices located within the particular location, wherein the one or more trusted devices comprise at least one trusted peripheral device and/or one or more devices linked to the at least one trusted peripheral device, and
add the collected data to the user profile data stored within the training dataset; and
wherein the plurality of software modules comprise a new device detection module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the new device detection module is executed by the processing device to:
detect a new device located within the particular location,
establish trust between the IHS and the new device by exchanging a token between the IHS and the new device, and
add the new device as a trusted device, if the token exchange is successful, so that the data collection module can begin collecting data from the new device and adding the collected data to the user profile data.

### Claim 9

A user authentication and threat detection system, comprising:
an artificial intelligence (AI) engine comprising a plurality of software modules, which are stored within a computer-readable medium and executed by a processing device of a first cloud-based information handling system (IHS) to:
collect data from multiple devices located within different locations, wherein the collected data comprises system and user-related data, which is collected from:
a first set of devices located at a first location when a user initiates login to a protected network from the first location; and
a second set of devices located at a second location, which differs from the first location, when the user initiates login to the protected network from the second location;
store the collected data within a training dataset as user profile data; and
securely authenticate the user or detect potential security threats to the protected network based, at least in part, on the user profile data stored within the training dataset; and
the training dataset, wherein the training dataset is stored within the first cloud-based IHS or a second cloud-based IHS communicatively coupled to the first cloud-based IHS;
wherein the plurality of software modules comprise a data collection module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the data collection module is executed by the processing device to:
collect data from the IHS and one or more trusted devices located within the particular location, wherein the one or more trusted devices comprise at least one trusted peripheral device and/or one or more devices linked to the at least one trusted peripheral device, and
add the collected data to the user profile data stored within the training dataset; and
wherein the plurality of software modules comprise a user authentication and threat detection module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the user authentication and threat detection module is executed by the processing device to:
attempt to detect an identity or presence of the user at the particular location based on the user profile data stored within the training dataset and the data, which was collected from the IHS and the one or more trusted devices located within the particular location when the user initiated log-in,
authenticate the user and grant access to the protected network, if the identity or presence of the user is detected at the particular location, and
deny the user access to the protected network, if the identity or presence of the user is not detected at the particular location.

### Claim 10 (depends on 9)

The user authentication and threat detection system as recited in claim 9, wherein if the identity or presence of the user is not detected at the particular location, the user authentication and threat detection module is further executed by the processing device to:
attempt to authenticate the user via one or more additional authentication methods or factors before granting or denying user access to the protected network;
grant the user access to the protected network, if the one or more additional authentication methods or factors successfully authenticate the user; and
deny the user access to the protected network, if the one or more additional authentication methods or factors fail to authenticate the user.

### Claim 11 (depends on 9)

The user authentication and threat detection system as recited in claim 9, wherein the plurality of software modules further comprise an accuracy module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the accuracy module is executed by the processing device to:
determine a prediction accuracy or probability that the user is physically present at the particular location.

### Claim 12 (depends on 11)

The user authentication and threat detection system as recited in claim 11, wherein the user authentication and threat detection module is further executed by the processing device to:
authenticate the user and grant access to the protected network, if the prediction accuracy is greater than a predetermined prediction threshold;
attempt to authenticate the user via one or more additional authentication methods or factors, if the prediction accuracy is less than the predetermined accuracy threshold; and
deny the user access to the protected network, if the prediction accuracy is less than the predetermined accuracy threshold and the one or more additional authentication methods or factors fail to authenticate the user.

### Claim 13 (depends on 11)

The user authentication and threat detection system as recited in claim 11, wherein the user authentication and threat detection module is further executed by the processing device to:
detect a security threat to the protected network, if the prediction accuracy is less than the predetermined accuracy threshold and the one or more additional authentication methods or factors fail to authenticate the user.

### Claim 14

A computer implemented method, comprising:
first receiving a notification of user login from an information handling system (IHS) located at a first location when a user initiates login to a protected network from the IHS;
then collecting data from the IHS and one or more trusted devices located within the first location, wherein the collected data comprises system and user-related data;
then adding the collected data from the IHS and one or more trusted devices located within the first location to user profile data previously stored within a training dataset; and
then using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network on the information handling system (IHS) located at the first location;
wherein the user profile data previously stored within the training dataset comprises system and user-related data previously collected from an IHS and one or more trusted devices located within a second location when the user previously initiated login to the protected network from the second location; and
where the system and user-related data collected at each of the first and second locations comprises:
system data collected from a respective IHS from which the user initiates login at each of the first and second locations,
data collected from one or more respective trusted peripheral devices at each of the first and second locations, and
data collected from one or more devices linked to the trusted peripheral devices at each of the first and second locations.

### Claim 15 (depends on 14)

The computer implemented method as recited in claim 14, where the system data collected from the respective IHS from which the user initiates login at each of the first and second locations comprises at least one of calendar data, voice commands, or a list comprising one or more of the user's most frequently used applications.

### Claim 16 (depends on 14)

The computer implemented method as recited in claim 14, where the data collected from each of the one or more respective trusted peripheral devices at each of the first and second locations comprises at least one of a signal strength of a cellular signal emitted from each of the one or more respective trusted peripheral devices, audio signals obtained by each of the one or more respective trusted peripheral devices, or video signals obtained by each of the one or more respective trusted peripheral devices.

### Claim 17 (depends on 14)

The computer implemented method as recited in claim 14, where the data collected from each of the one or more devices linked to the trusted peripheral devices at each of the first and second locations comprises at least one of a signal strength of a cellular signal emitted from each of the one or more devices linked to the trusted peripheral devices, audio signals obtained by each of the one or more devices linked to the trusted peripheral devices, or video signals obtained by each of the one or more devices linked to the trusted peripheral devices.

### Claim 18

A computer implemented method, comprising:
receiving a notification of user login from an information handling system (IHS) located at a first location when a user initiates login to a protected network from the IHS;
collecting data from the IHS and one or more trusted devices located within the first location, wherein the collected data comprises system and user-related data;
adding the collected data to user profile data previously stored within a training dataset; and
using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network;
where after receiving the notification of user login, the computer implemented method further comprises:
detecting a new device located within the first location, and
establishing trust between the IHS located at the first location and the new device located at the first location by exchanging a token between the IHS located at the first location and the new device located at the first location to ensure physical proximity of the new linked device to the IHS; and
wherein if the token exchange is successful, the computer-implemented method further comprises:
adding the new device as a new trusted device,
collecting data from the new trusted device, and
adding the data collected from the new trusted device to the user profile data.

### Claim 19

A computer implemented method, comprising:
receiving a notification of user login from an information handling system (IHS) located at a first location when a user initiates login to a protected network from the IHS;
collecting data from the IHS and one or more trusted devices located within the first location, wherein the collected data comprises system and user-related data;
adding the collected data to user profile data previously stored within a training dataset; and
using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network;
wherein said using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network comprises using the collected data and the user profile data to:
determine if the user's login behavior is normal, and
detect if at least one trusted device of the one or more trusted devices is in range of the IHS located at the first location; and
where the user's login behavior is determined to be normal if the user initiates the log-in from the IHS located at a first location during normal work hours of the user and/or during a previously scheduled meeting time, and where the user's log-in behavior is determined to be abnormal if the user initiates the login from the IHS located at a first location not during normal work hours of the user and/or not during a previously scheduled meeting time.

### Claim 20 (depends on 19)

The computer implemented method as recited in claim 19, wherein if the user's login behavior is normal and the at least one trusted device is in range of the IHS, the computer implemented method further comprises:
authenticating the user; and
logging the user into the protected network.

### Claim 21 (depends on 19)

The computer implemented method as recited in claim 19, wherein if the user's login behavior is abnormal, or the at least trusted device is not in range of the IHS, the computer implemented method further comprises:
determining if the collected data and the user profile data can be used to detect user presence at the location of the IHS located at the first location with an accuracy greater than a predetermined accuracy threshold.

### Claim 22 (depends on 21)

The computer implemented method as recited in claim 21, wherein if user presence is detected at the location of the IHS located at the first location with an accuracy greater than the predetermined accuracy threshold, the computer implemented method further comprises:
authenticating the user; and
logging the user into the protected network.

### Claim 23 (depends on 21)

The computer implemented method as recited in claim 21, wherein if user presence is detected at the location of the IHS located at the first location with an accuracy less than the predetermined accuracy threshold, the computer implemented method further comprises:
determining user authentication via one or more additional authentication methods or factors;
granting the user access to the protected network, if the one or more additional authentication methods or factors successfully authenticate the user; and
denying the user access to the protected network, if the one or more additional authentication methods or factors fail to authenticate the user.

### Claim 24 (depends on 21)

The computer implemented method as recited in claim 21, if the one or more additional authentication methods or factors successfully authenticate the user, the computer implemented method further comprises:
logging the user into the protected network; and
opening one or more of the user's frequently used applications.

### Claim 25

A computer implemented method, comprising:
receiving a notification of user login from an information handling system (IHS) located at a first location when a user initiates login to a protected network from the IHS;
collecting data from the IHS and one or more trusted devices located within the first location, wherein the collected data comprises system and user-related data;
adding the collected data to user profile data previously stored within a training dataset; and
using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network;
wherein said using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network comprises using the collected data and the user profile data to:
determine if the user's login behavior is normal, and
detect if at least one trusted device of the one or more trusted devices is in range of the IHS;
wherein if the user's login behavior is normal and the at least one trusted device is in range of the IHS, the computer implemented method further comprises:
authenticating the user, and
logging the user into the protected network; and
wherein if the user's login behavior is normal and the at least one trusted device is in range of the IHS, the computer implemented method further comprises:
opening one or more of the user's frequently used applications.