# US 12,015,614 B2 · Authentication and access management for heterogeneous sources of anomaly detection data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,614 B2 - Document ID: US12015614B2 - Status: Granted - Kind: B2 - Application number: 17/673,692 - Filed: 2022-02-16 - Published: 2022-08-18 - Granted: 2024-06-18 - Earliest claimed: 2021-02-16 - Assignees: Ping Identity International, Inc. - Applicants: Ping Identity International, Inc. - Inventors: Darryl Jones; Benjamin Goodman; Sudhakar Peddibhotla - Web page: https://patentgrep.com/patent/US12015614B2 ## CPC - H04L 63/102: {Entity profiles} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The disclosed technology teaches aggregating 3rd-party risk measures during an authentication journey, including providing a risk measure aggregation node, a JSON transform, and a configuration for 3rd-party risk measures to request. Responsive to invocation of the risk measure aggregation node during the authentication journey, the method includes setting a timer for receipt of a configured 3rd-party risk measure, wherein expiration of the timer causes the risk measure aggregation node to stop waiting for a timed-out 3rd party risk measure provider and requesting the configured 3rd-party risk measures. Upon receiving at least some of the requested 3rd-party risk measures, included is applying the JSON transform to aggregate the returned 3rd-party risk measures into an aggregate score, and the risk measure aggregation node providing to another node in the authentication journey an aggregated score taking into account the configured 3rd-party risk measures received prior to expiration of the timer. ## Claims ### Claim 1 A computer-implemented method of aggregating 3rd-party risk measures during an authentication journey, including: providing a risk measure aggregation node, a J SON transform, and a configuration for requesting 3rd-party risk measures; responsive to invocation of the risk measure aggregation node during the authentication journey: setting a timer for receipt of a configured 3rd-party risk measure, wherein expiration of the timer causes the risk measure aggregation node to stop waiting for a timed-out 3 party risk measure provider; requesting the configured 3rd-party risk measures; receiving at least some of the requested 3″-party risk measures; applying the J SON transform to aggregate the received 3rd-party risk measures into an aggregate score; and the risk measure aggregation node providing to another node in the authentication journey an aggregated score taking into account on the configured 3″-party risk measures received prior to expiration of the timer. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further including: the risk measure aggregation node caching results from the 3rd party risk measure provider in a cache; the timer expiring on 3rd party risk measure provider during the authentication journey; the risk measure aggregation node accessing the cache and retrieving some non-stale data, previously obtained from the 3rd party risk measure provider, that is responsive to the authentication journey; and the applying the JSON transform using the non-stale data from the cache. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein returned attributes from at least one of the 3rd-party risk measure providers includes one or more quantitative attributes and one or more categorical attributes. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein timeout handling requires a response to the request within 0.1 to 4.0 seconds or any range bounded by this interval. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein specification of the timeout handling is an organization configurable parameter. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further including providing an API suite for invoking the risk measure aggregation node and returning details of access scores and reasons, on a per-user and per-authentication journey basis. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further including providing an API suite for invoking the risk measure aggregation node by query and receiving a readout of configuration data. ### Claim 8 A tangible non-transitory computer readable storage media, including program instructions loaded into memory that, when executed on processors cause the processors to implement a method of aggregating 3rd-party risk measures during a n authentication journey, the method including: providing a risk measure aggregation node, a J SON transform, and a configuration for requesting 3rd-party risk measures; responsive to invocation of the risk measure aggregation node during the authentication journey: setting a timer for receipt of a configured 3rd-party risk measure, wherein expiration of the timer causes the risk measure aggregation node to stop waiting for a timed-out 3 party risk measure provider; requesting the configured 3 rd-party risk measures; receiving at least some of the requested 3″-party risk measures; applying the J SON transform to aggregate the received 3rd-party risk measures into a n aggregate score; and the risk measure aggregation node providing to another node in the authentication journey an aggregated score taking into account on the configured 3″-party risk measures received prior to expiration of the timer. ### Claim 9 (depends on 8) The tangible non-transitory computer readable storage media of claim 8, further including: the risk measure aggregation node caching results from the 3rd party risk measure provider in a cache; the timer expiring on 3rd party risk measure provider during the authentication journey; the risk measure aggregation node accessing the cache and retrieving some non-stale data, previously obtained from the 3rd party risk measure provider, that is responsive to the authentication journey; and the applying the JSON transform using the non-stale data from the cache. ### Claim 10 (depends on 8) The tangible non-transitory computer readable storage media of claim 8, wherein returned attributes from at least one of the configured 3rd-party risk measure providers includes one or more quantitative attributes and one or more categorical attributes. ### Claim 11 (depends on 8) The tangible non-transitory computer readable storage media of claim 8, wherein timeout handling requires a response to the request within 0.1 to 4.0 seconds or any range bounded by this interval. ### Claim 12 (depends on 11) The tangible non-transitory computer readable storage media of claim 11, wherein specification of the timeout handling is an organization configurable parameter. ### Claim 13 (depends on 8) The tangible non-transitory computer readable storage media of claim 8, further including providing an API suite for invoking the risk measure aggregation node and returning details of access scores and reasons, on a per-user and per-authentication journey basis. ### Claim 14 (depends on 8) The tangible non-transitory computer readable storage media of claim 8, further including providing an API suite for invoking the risk measure aggregation node by query and receiving a readout of configuration data. ### Claim 15 (depends on 8) A system for aggregating 3rd-party risk measures during an authentication journey, the system including a processor, memory coupled to the processor and program instructions from the non-transitory computer readable storage media of claim 8 loaded into the memory. ### Claim 16 (depends on 15) The system of claim 15, wherein the program instructions extend the method including: the risk measure aggregation node caching results from the 3rd party risk measure provider in a cache; the timer expiring on 3rd party risk measure provider during the authentication journey; the risk measure aggregation node accessing the cache and retrieving some non-stale data, previously obtained from the 3rd party risk measure provider, that is responsive to the authentication journey; and the applying the JSON transform using the non-stale data from the cache. ### Claim 17 (depends on 15) The system of claim 15, wherein returned attributes from at least one of the configured 3rd-party risk measure providers includes one or more quantitative attributes and one or more categorical attributes. ### Claim 18 (depends on 15) The system of claim 15, wherein timeout handling requires a response to the request within 0.1 to 4.0 seconds or any range bounded by this interval. ### Claim 19 (depends on 18) The system of claim 18, wherein specification of the timeout handling is an organization configurable parameter. ### Claim 20 (depends on 15) The system of claim 15, further including providing an API suite for invoking the risk measure aggregation node and returning details of access scores and reasons, on a per-user and per-authentication journey basis. ### Claim 21 (depends on 15) The system of claim 15, further including providing an API suite for invoking the risk measure aggregation node by query and receiving a readout of configuration data.