Confounder generation in knowledge-based authentication for an enterprise
AssigneeEMC Corporation
InventorsYedidya Dotan, Shai Gabai
Life of this patent
Estimating the term…
Abstract
An improved technique generates confounders for KBA questions from personal information management (PIM) data created from within an organization. An enterprise KBA (eKBA) server collects PIM data such as email data for a particular member of the organization. For email data, the eKBA server extracts facts from the headers of emails and generates queries having a corresponding correct answer from a first subset of the facts. Moreover, the eKBA server extracts a set of confounders from a second subset of the facts. The eKBA server then forms a multiple-choice KBA question from the query, the corresponding correct answer, and selected confounders.
Claims15
A method of generating a knowledge-based authentication (KBA) question configured to be provided to a person requesting authentication as a user that is a member of an organization, the KBA question including a query, a correct answer corresponding to the query, and a set of incorrect answers corresponding to the query, the method comprising:
- producing, by a processor of a KBA system, personal information management (PIM) data from communications involving members of the organization, PIM data from communications involving a particular member of the organization including a reference to the particular member;
- obtaining, by the processor, a set of user facts from the PIM data that includes a reference to the user;
- storing the set of user facts in a memory of the KBA system;
- generating, by the processor, a set of confounders from user facts of the set of user facts stored in the memory of the KBA system;
- and
- selecting, by the processor, incorrect answers from the set of confounders to form the set of incorrect answers corresponding to the query of the KBA question;
- wherein the method further comprises:
- producing the query and the corresponding correct answer of the KBA question from a first subset of the user facts;
- wherein generating the set of confounders from the user facts includes:
- producing the set of confounders from a second subset of the user facts, the second subset of the user facts being distinct from the first subset of the user facts;
- wherein the PIM data includes a set of emails, each email of the set of emails including a header containing i) a user identifier that identifies the user, and ii) a context that identifies subject matter of the email;
- wherein producing the query and the corresponding correct answer of the KBA question includes:
- extracting the context from the header of an email of a first subset of emails of the set of emails, the first subset of user facts being derived from the first subset of emails;
- wherein producing the set of confounders includes:
- extracting a confounder of the set of confounders from the header of an email of a second subset of emails of the set of emails, the second subset of user facts being derived from the second subset of emails;
- and
- wherein the method further comprises:
- arranging the user identifier, the context, and the set of confounders in an entry in a confounder database.
A knowledge-based authentication (KBA) system constructed and arranged to generate a KBA question configured to be provided to a person requesting authentication as a user that is a member of an organization, the KBA question including a query, a correct answer corresponding to the query, and a set of incorrect answers corresponding to the query, the KBA system comprising:
- a network interface;
- memory;
- and
- a controller including controlling circuitry, the controlling circuitry being constructed and arranged to:
- produce personal information management (PIM) data from communications involving members of the organization, PIM data from communications involving a particular member of the organization including a reference to the particular member;
- obtain a set of user facts from the PIM data that includes a reference to the user;
- generate a set of confounders from user facts of the set of user facts;
- and
- select incorrect answers from the set of confounders to form the set of incorrect answers corresponding to the query of the KBA question;
- wherein the controlling circuitry is further constructed and arranged to:
- produce the query and the corresponding correct answer of the KBA question from a first subset of the user facts;
- wherein generating the set of confounders from the user facts includes:
- producing the set of confounders from a second subset of the user facts, the second subset of the user facts being distinct from the first subset of the user facts;
- wherein the PIM data includes a set of emails, each email of the set of emails including a header containing i) a user identifier that identifies the user, and ii) a context that identifies subject matter of the email;
- wherein producing the query and the corresponding correct answer of the KBA question includes:
- extracting the context from the header of an email of a first subset of emails of the set of emails, the first subset of user facts being derived from the first subset of emails;
- wherein producing the set of confounders includes:
- extracting a confounder of the set of confounders from the header of an email of a second subset of emails of the set of emails, the second subset of user facts being derived from the second subset of emails;
- and
- wherein the controlling circuitry is further constructed and arranged to:
- arrange the user identifier, the context, and the set of confounders in an entry in a confounder database.
A computer program product having a non-transitory, computer-readable storage medium which stores code to generate a knowledge-based authentication (KBA) question configured to be provided to a person requesting authentication as a user that is a member of an organization, the KBA question including a query, a correct answer corresponding to the query, and a set of incorrect answers corresponding to the query, the code including instructions to:
- produce personal information management (PIM) data from communications involving members of the organization, PIM data from communications involving a particular member of the organization including a reference to the particular member;
- obtain a set of user facts from the PIM data that includes a reference to the user;
- generate a set of confounders from user facts of the set of user facts;
- and
- select incorrect answers from the set of confounders to form the set of incorrect answers corresponding to the query of the KBA question;
- wherein the code includes further instructions to:
- produce the query and the corresponding correct answer of the KBA question from a first subset of the user facts;
- wherein generating the set of confounders from the user facts includes:
- producing the set of confounders from a second subset of the user facts, the second subset of the user facts being distinct from the first subset of the user facts;
- wherein the PIM data includes a set of emails, each email of the set of emails including a header containing i) a user identifier that identifies the user, and ii) a context that identifies subject matter of the email;
- wherein producing the query and the corresponding correct answer of the KBA question includes:
- extracting the context from the header of an email of a first subset of emails of the set of emails, the first subset of user facts being derived from the first subset of emails;
- wherein producing the set of confounders includes:
- extracting a confounder of the set of confounders from the header of an email of a second subset of emails of the set of emails, the second subset of user facts being derived from the second subset of emails;
- and
- wherein the code includes further instructions to:
- arrange the user identifier, the context, and the set of confounders in an entry in a confounder database.
A method of generating a knowledge-based authentication (KBA) question configured to be provided to a person requesting authentication as a user that is a member of an organization, the KBA question including a query, a correct answer corresponding to the query, and a set of incorrect answers corresponding to the query, the method comprising:
- producing, by a processor of a KBA system, personal information management (PIM) data from communications involving members of the organization, PIM data from communications involving a particular member of the organization including a reference to the particular member;
- obtaining, by the processor, a set of user facts from the PIM data that includes a reference to the user;
- storing the set of user facts in a memory of the KBA system;
- generating, by the processor, a set of confounders from user facts of the set of user facts stored in the memory of the KBA system;
- and
- selecting, by the processor, incorrect answers from the set of confounders to form the set of incorrect answers corresponding to the query of the KBA question;
- wherein the communications involving members of the organization include records of communications between parties, the parties including the user and other members of the organization;
- and
- wherein obtaining the set of user facts from the PIM data includes forming, as a user fact of the set of user facts, a statement describing an interaction that took place between the user and one of the other members of the organization, a confounder generated from the user fact including a reference to the one of the other members of the organization;
- wherein the records of the communications between the parties include (i) a record of a first communication between the user and a first other member of the organization and (ii) a record of a second communication between the user and a second other member of the organization;
- wherein obtaining the set of user facts includes:
- producing a first user fact from the first communication, the first fact having references to the user and the first other member of the organization, and
- producing a second user fact from the first communication, the second user fact having references to the user and the second other member of the organization;
- wherein generating the set of confounders includes identifying, as a confounder of the set of confounders, an incorrect answer from the reference to the first other member of the organization;
- and
- wherein the method further comprises forming the correct answer from the reference to the second other member of the organization.
Dependencies are inferred from the claim text.