US 8,621,586 B1Granted

Using baseline profiles in adaptive authentication

AssigneeEMC Corporation

InventorsOded Peer, Yedidya Dotan, Yael Villa, Marcelo Blatt

Life of this patent

Estimating the term…

Loading patent…

Abstract

An improved technique of processing an authentication request from an authentication requestor involves an adaptive authentication device comparing a behavioral history of fact values associated with a user over a current time window with a user's baseline profile that includes a behavioral history of the fact values. The adaptive authentication device accesses such a behavioral history over several previous time windows from a database whose entries include a user identifier, a time interval and user data which represents fact value behavioral history over the time interval. When the device receives an authentication request from an authentication requestor, the adaptive authentication device matches a username of the request with a user identifier of an entry of the database whose time period is the current time period. The adaptive authentication device then updates fact values representing the user's current behavioral history and compares the current behavioral history to the user's baseline profile.

Claims17

Dependent claims

A method of processing an authentication request from an authentication requestor, the authentication request including a user identifier and current user data, the method comprising:

receiving the authentication request at an adaptive authentication system which includes a database having a set of entries, each entry of the set of entries including an identifier and previous user data, the adaptive authentication system being constructed and arranged to perform an adaptive authentication operation on the authentication request, the adaptive authentication operation being constructed and arranged to generate an adaptive authentication result which indicates a likelihood of the authentication request being associated with fraudulent activity;
performing the adaptive authentication operation on the authentication request, including:
matching the user identifier of the authentication request with an identifier of a particular entry of the database;
performing a comparison of the current user data of the authentication request with the previous user data of the particular entry, the comparison producing a comparison result;
and
generating an adaptive authentication result based on the comparison result;
and
sending the adaptive authentication result to the authentication requestor;
wherein the current user data includes a fact identifier and a current fact value which is associated with the fact identifier;
wherein the previous data of the particular entry includes a set of previous fact values, each previous fact value being associated with the fact identifier and including a fact value count;
and
wherein performing the adaptive authentication operation on the authentication request further includes:
if the current fact value is equal to a previous fact value of the set of previous fact values:
incrementing the fact value count of the previous fact value to which the current fact value is equal;
and
if the current fact value is not equal to a previous fact value of the set of previous fact values:
locating a minimal previous fact value of the set of previous fact values, the minimal previous fact value having the smallest fact value count of the fact value counts of the previous fact values of the set of previous fact values;
decrementing the fact value count of the minimal previous fact value;
if the fact value count of the minimal previous fact value is less than or equal to zero:
removing the minimal previous fact value from the set of previous fact values;
and
adding the current fact value to the set of previous fact values;
and
if the fact value count of the minimal previous fact value is greater than zero:
retaining the minimal previous fact value in the set of previous fact values.

22 more elements

A system constructed and arranged to process an authentication request from an authentication requestor, the authentication request including a user identifier and current user data, the system comprising:

a storage system which includes a database having a set of entries, each entry of the set of entries including an identifier and previous user data, and
an adaptive authentication device which is constructed and arranged to perform an adaptive authentication operation on the authentication request, the adaptive authentication operation being constructed and arranged to generate an adaptive authentication result which indicates a likelihood of the authentication request being associated with fraudulent activity, the adaptive authentication device including a network interface, a memory and a controller which includes controlling circuitry coupled to the memory, the controlling circuitry being constructed and arranged to:
receive the authentication request;
perform the adaptive authentication operation on the authentication request, including:
matching the user identifier of the authentication request with an identifier of a particular entry of the database;
performing a comparison of the current user data of the authentication request with the previous user data of the particular entry, the comparison producing a comparison result;
and
generating an adaptive authentication result based on the comparison result;
and
send the adaptive authentication result to the authentication requestor;
wherein the current user data includes a fact identifier and a current fact value which is associated with the fact identifier;
wherein the previous data of the particular entry includes a set of previous fact values, each previous fact value being associated with the fact identifier and including a fact value count;
and
wherein performing the adaptive authentication operation on the authentication request further includes:
if the current fact value is equal to a previous fact value of the set of previous fact values:
incrementing the fact value count of the previous fact value to which the current fact value is equal;
and
if the current fact value is not equal to a previous fact value of the set of previous fact values:
locating a minimal previous fact value of the set of previous fact values, the minimal previous fact value having the smallest fact value count of the fact value counts of the previous fact values of the set of previous fact values;
decrementing the fact value count of the minimal previous fact value;
if the fact value count of the minimal previous fact value is less than or equal to zero:
removing the minimal previous fact value from the set of previous fact values;
and
adding the current fact value to the set of previous fact values;
and
if the fact value count of the minimal previous fact value is greater than zero:
retaining the minimal previous fact value in the set of previous fact values.

24 more elements

A computer program product having a non-transitory computer readable storage medium which stores code to process an authentication request from an authentication requestor, the computer-readable storage medium being included in an adaptive authentication system which is constructed and arranged to perform an adaptive authentication operation on the authentication request, the adaptive authentication operation being constructed and arranged to generate an adaptive authentication result which indicates a likelihood of the authentication request being associated with fraudulent activity, the adaptive authentication system including a database having a set of entries, each entry of the set of entries including an identifier and previous user data, the code including instructions to:

receive the authentication request;
perform the adaptive authentication operation on the authentication request, including:
matching the user identifier of the authentication request with an identifier of a particular entry of the database;
performing a comparison of the current user data of the authentication request with the previous user data of the particular entry, the comparison producing a comparison result;
and
generating an adaptive authentication result based on the comparison result;
and
send the adaptive authentication result to the authentication requestor;
wherein the code further includes instructions to:
receive, from another authentication requestor, another authentication request having a user identifier which is distinct from the user identifier of the authentication request;
and
perform the adaptive authentication operation on the another authentication request;
wherein an entry having an identifier which matches the user identifier of the another authentication request is distinct from the particular entry;
wherein the current user data includes a fact identifier and a current fact value which is associated with the fact identifier;
wherein the previous data of the particular entry includes a set of previous fact values, each previous fact value being associated with the fact identifier and including a fact value count;
and
wherein performing the adaptive authentication operation on the authentication request further includes:
if the current fact value is equal to a previous fact value of the set of previous fact values:
incrementing the fact value count of the previous fact value to which the current fact value is equal;
and
if the current fact value is not equal to a previous fact value of the set of previous fact values:
locating a minimal previous fact value of the set of previous fact values, the minimal previous fact value having the smallest fact value count of the fact value counts of the previous fact values of the set of previous fact values;
decrementing the fact value count of the minimal previous fact value;
if the fact value count of the minimal previous fact value is less than or equal to zero:
removing the minimal previous fact value from the set of previous fact values;
and
adding the current fact value to the set of previous fact values;
and
if the fact value count of the minimal previous fact value is greater than zero:
retaining the minimal previous fact value in the set of previous fact values.

27 more elements

Dependencies are inferred from the claim text.