# US 2018/0025148 A1 · Incorporating risk-based decision in standard authentication and authorization systems

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0025148 A1
- Document ID: US20180025148A1
- Status: Published application
- Kind: A1
- Application number: 15/654,096
- Filed: 2017-07-19
- Published: 2018-01-25
- Earliest claimed: 2016-07-22
- Assignees: Aetna Inc.
- Applicants: Aetna Inc.
- Inventors: Salil Kumar Jain; Abbie Barbir; Derek Swift
- Web page: https://patentgrep.com/patent/US20180025148A1

## CPC

- G06F 21/40: by quorum, i.e. whereby two or more security principals are required
- G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards
- G06F 21/35: communicating wirelessly
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 9/0872: {using geo-location information, e.g. location data, time, relative position or proximity to other entities}
- H04L 9/3215: {using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18)}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- G06F 21/1013: {to locations}
- G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints
- G06F 2221/2109: Game systems
- G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS
- G06F 2221/2137: Time limited access, e.g. to a computer or data
- H04L 9/006: {involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04W 12/67: Risk-dependent, e.g. selecting a security level depending on risk profiles
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Embodiments of the disclosure provide a method for enhancing standard authentication systems to include risk-based decisions. Risk-based decisions can be selectively implemented within existing authentication systems to strategically modify and supplement security if an unacceptable risk is detected. Embodiments capture information pertaining to a user and user device. Information is stored to create a profile for the user and user device. A comparison between the stored information and live data can be performed within authentication systems to optimize security. If the results of the comparison demonstrate the presence of an acceptable risk, then the need for subsequent authentication can be reduced or eliminated, which improves a user experience.

## Claims

### Claim 1

A method for providing an enhanced authentication process with risk-based decision making, the method comprising:
enrolling a user and user device;
capturing attributes pertaining to the user and/or user device;
determining a risk of data security based on the attributes pertaining to the user and/or the user device;
when the risk is an unacceptable risk, requiring additional authentication for access to protected services; and
when the risk is an acceptable risk, granting access to the protected services without requiring additional authentication.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
when the risk of data security is acceptable, refreshing access to protected services without requiring additional authentication.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
when the risk of data security is unacceptable, requiring the user to provide one or more of a password and biometric data.

### Claim 4 (depends on 1)

The method of claim 1, wherein determining the risk of data security occurs after a time expiration of the access token.

### Claim 5 (depends on 1)

The method of claim 1, wherein determining the risk of data security occurs prior to a time expiration of the access token.

### Claim 6 (depends on 1)

The method of claim 1, wherein capturing the attributes pertaining to the user and/or user device comprises:
an Oauth authorization call to an application; and
gathering user and/or user device attributes while accessing the application,
wherein determining the risk of data security is further based on the user and/or user device attributes gathered while accessing the application.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
storing the attributes pertaining to the user and/or user device at an authorization database configured to store unique attributes for a plurality of users and/or user devices.

### Claim 8 (depends on 1)

The method of claim 1, wherein the attributes pertaining to the user and/or user device comprise one or more of: a cryptographic key, geographic location, time of day, day of week, device hygiene, a user usage pattern, a swipe pattern for touch sensitive displays, malware detection, jailbreak/root detection, debugger mode detection, location reading, accelerometer readings, gyroscope readings, compass readings, user device navigation patterns, application tamper detection, a user device identifier, user device hardware details, user device certificate, user device software details, an International Mobile Station Equipment Identifier (IMEI), a Personal Identification Number (PIN), a password, user biometric data, a device token, a Service Set Identifier (SSID), network proxy detection, device power state, and Virtual Private Network (VPN) detection.

### Claim 9

A system for authorizing a user device for access to protected services based on risk-based decisions, the system comprising:
a resource server hosting an application that accesses protected services;
a user device configured to communicate with the resource server to access the protected services;
an authentication server providing an authentication service for the application that accesses the protected services, the authentication server is configured for performing an authentication process, the authentication process comprising:
enrolling the user device with the application hosted by the application server;
capturing attributes pertaining to a user of the user device and/or the user device;
determining a risk of data security based on the attributes pertaining to the user and/or the user device;
when the risk is an unacceptable risk, requiring additional authentication for access to the protected services; and
when the risk is an acceptable risk, granting access to the protected services without requiring additional authentication.

### Claim 10 (depends on 9)

The system of claim 9, further comprising:
an authentication database configured to store the attributes captured by the authentication server.

### Claim 11 (depends on 9)

The system of claim 9, wherein the authentication process further comprises:
when the risk of data security is acceptable, refreshing access to protected services without requiring additional authentication.

### Claim 12 (depends on 9)

The system of claim 9, wherein the authentication process further comprises:
when the risk of data security is unacceptable, requiring the user to provide one or more of a password and biometric data.

### Claim 13 (depends on 9)

The system of claim 9, wherein determining the risk of data security occurs after a time expiration of the access token.

### Claim 14 (depends on 9)

The system of claim 9, wherein determining the risk of data security occurs prior to a time expiration of the access token.

### Claim 15 (depends on 9)

The system of claim 9, wherein capturing the attributes pertaining to the user of the user device and/or the user device comprises:
an Oauth authorization call to an application; and
gathering user and/or user device attributes while accessing the application,
wherein determining the risk of data security is further based on the user and/or user device attributes gathered while accessing the application.

### Claim 16

A non-transitory computer readable storage device for providing an enhanced authentication process with risk-based decision making for granting and maintaining access to an application that accesses protected services, the non-transitory computer readable storage device having computer executable instructions for performing the steps of:
enrolling a user and user device;
capturing attributes pertaining to the user and/or the user device;
determining a risk of data security based on the attributes pertaining to the user and/or the user device;
when the risk is an unacceptable risk, requiring additional authentication for access to protected services; and
when the risk is an acceptable risk, granting access to the protected services without requiring additional authentication.

### Claim 17 (depends on 16)

The non-transitory computer readable storage device of claim 16, further comprising computer executable instructions for:
when the risk of data security is acceptable, refreshing access to protected services without requiring additional authentication.

### Claim 18 (depends on 16)

The non-transitory computer readable storage device of claim 16, further comprising computer executable instructions for:
when the risk of data security is unacceptable, requiring the user to provide one or more of a password and biometric data.

### Claim 19 (depends on 16)

The non-transitory computer readable storage device of claim 16, wherein determining the risk of data security occurs after a time expiration of the access token.

### Claim 20 (depends on 16)

The non-transitory computer readable storage device of claim 16, wherein determining the risk of data security occurs prior to a time expiration of the access token.

### Claim 21 (depends on 16)

The non-transitory computer readable storage device of claim 16, wherein capturing the attributes pertaining to the user and/or the user device comprises:
an Oauth authorization call to an application; and
gathering user and/or user device attributes while accessing the application,
wherein determining the risk of data security is further based on the user and/or user device attributes gathered while accessing the application.