# US 2018/0026983 A1 · System and methods to establish user profile using multiple channels > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0026983 A1 - Document ID: US20180026983A1 - Status: Published application - Kind: A1 - Application number: 15/655,076 - Filed: 2017-07-20 - Published: 2018-01-25 - Earliest claimed: 2016-07-20 - Assignees: Aetna Inc. - Applicants: Aetna Inc. - Inventors: Salil Kumar Jain; Abbie Barbir; Sylvan Tran; Jayavardhan N. Marehalli; Derek Swift - Web page: https://patentgrep.com/patent/US20180026983A1 ## CPC - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/102: {Entity profiles} - H04L 67/306: User profiles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments of the disclosure provide a method of establishing a user profile using multiple channels. Embodiments allow compatibility of the user profile across several authentication systems. The user profile is created upon registration and is updated with attributes after authenticating and authorizing the user according to a pre-defined assurance level. The user profile contains attributes pertaining to the user and user device. The attributes can be analyzed by authentication systems to optimize data security. ## Claims ### Claim 1 A method for creating a user profile for authenticating a user to access information and services protected by an authentication system, the method comprising: performing an authentication of a user attempting access to the information and services from a user device, wherein the information and services are protected by the authentication system; determining whether the user is a new user never before having accessed the information and services protected by the authentication system; collecting attributes uniquely identifying the user and compiling those as part of the user profile; and storing the user profile in a database associated with the authentication system. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining whether the user device is a new user device never before having accessed the information and services protected by the authentication system; and collecting attributes uniquely identifying the user device and compiling those as part of the user profile. ### Claim 3 (depends on 2) The method of claim 2, further comprising: determining whether an application running on the user device is a new application never before having accessed the information and services protected by the authentication system; and collecting attributes uniquely identifying the user and the user device pertaining to the application and compiling those as part of the user profile. ### Claim 4 (depends on 1) The method of claim 1, wherein the attributes uniquely identifying the user comprise user credentials or user biometric data for accessing the information and services protected by the authentication system. ### Claim 5 (depends on 2) The method of claim 2, wherein the attributes uniquely identifying the user device comprise one or more of a device type, a device hardware/software configuration, an access technology used to access the information and services and device hygiene data. ### Claim 6 (depends on 3) The method of claim 3, wherein the attributes uniquely identifying the user and the user device pertaining to the application comprise one or more of an application identifier (ID), a navigation pattern with respect to how the user navigates the application while accessing the information and services protected by the authentication system, and an application usage pattern. ### Claim 7 (depends on 6) The method of claim 6, wherein the application usage pattern comprises a day and time when the application is utilized. ### Claim 8 (depends on 6) The method of claim 6, wherein the user device running the application comprises a touch sensitive display and the attributes uniquely identifying the user and the user device pertaining to the application further comprises a swipe pattern for touch sensitive displays utilized when navigating the application at the user device. ### Claim 9 A method for authenticating a user to access information and services protected by an authentication system, the method comprising: performing an authentication of a user device accessing the information and services protected by the authentication system; capturing device, application and user authentication attributes during the authentication; comparing the captured device, application and user authentication attributes against previously obtained device, application and user authentication attributes stored as part of a user profile; calculating a risk score based on the comparison of the captured device, application and user authentication attributes against the previously obtained device, application and user authentication attributes; and determining whether to grant access to the information and services based on the risk score. ### Claim 10 (depends on 9) The method of claim 9, wherein determining whether to grant access to the information and services based on the risk score comprises: comparing the risk score to a predetermined threshold risk level; and granting access to the information and services when the risk score meets or exceeds the predetermined threshold risk level. ### Claim 11 (depends on 10) The method of claim 10, wherein the predetermined threshold risk level is set such that when the risk score meets or exceeds the predetermined threshold risk level, authentication of the user to access the information and services is achieved with a high assurance. ### Claim 12 (depends on 11) The method of claim 11, wherein the captured device, application and user authentication attributes are used to update the previously obtained device, application and user authentication attributes stored as part of the user profile. ### Claim 13 (depends on 10) The method of claim 10, wherein the predetermined threshold risk level is set such that when the risk score meets or exceeds the predetermined threshold risk level, authentication of the user to access the information and services is achieved with a low assurance. ### Claim 14 (depends on 13) The method of claim 13, wherein when the captured device, application and user authentication attributes are the same as the previously obtained device, application and user authentication attributes, upgrade from the low assurance of the authentication to an authentication with a high assurance. ### Claim 15 A non-transitory computer readable storage device for authenticating a user to access information and services protected by an authentication system, the non-transitory computer readable storage device having computer executable instructions for performing the steps of: performing an authentication of a user device accessing the information and services protected by the authentication system; capturing device, application and user authentication attributes during the authentication; comparing the captured device, application and user authentication attributes against previously obtained device, application and user authentication attributes stored as part of a user profile; calculating a risk score based on the comparison of the captured device, application and user authentication attributes against the previously obtained device, application and user authentication attributes; and determining whether to grant access to the information and services based on the risk score. ### Claim 16 (depends on 15) The non-transitory computer readable storage device of claim 15, wherein determining whether to grant access to the information and services based on the risk score comprises: comparing the risk score to a predetermined threshold risk level; and granting access to the information and services when the risk score meets or exceeds the predetermined threshold risk level. ### Claim 17 (depends on 16) The non-transitory computer readable storage device of claim 16, wherein the predetermined threshold risk level is set such that when the risk score meets or exceeds the predetermined threshold risk level, authentication of the user to access the information and services is achieved with a high assurance. ### Claim 18 (depends on 17) The non-transitory computer readable storage device of claim 17, wherein the captured device, application and user authentication attributes are used to update the previously obtained device, application and user authentication attributes stored as part of the user profile. ### Claim 19 (depends on 16) The non-transitory computer readable storage device of claim 16, wherein the predetermined threshold risk level is set such that when the risk score meets or exceeds the predetermined threshold risk level, authentication of the user to access the information and services is achieved with a low assurance. ### Claim 20 (depends on 19) The non-transitory computer readable storage device of claim 19, wherein when the captured device, application and user authentication attributes are the same as the previously obtained device, application and user authentication attributes, upgrade from the low assurance of the authentication to an authentication with a high assurance.