System and method for performing device isolation in authentication network

Abstract

In some embodiments, a method includes monitoring, in an authentication network, a behavior pattern of a plurality of devices associated with a user; generating a behavioral accuracy score for each of the plurality of devices based on the behavioral pattern of each of the plurality of devices in the authentication network; generating a deviation score for each of the plurality of devices based on a deviation of behavior of each of the plurality of devices from conventional device behavior; and using the behavioral accuracy score and the deviation score to determine whether to isolate a device of the plurality of devices from the authentication network. In some embodiments, the method further includes determining whether the behavioral accuracy score for a first device of the plurality of devices is within a first behavioral accuracy score category, a second behavioral accuracy score category, or a third behavioral accuracy score category.

Description

[0001] Cross-reference to related applications

[0002] This patent application claims the benefit of U.S. Provisional Patent Application No. 63 / 400,012, filed on August 22, 2022, entitled "SYSTEM AND METHOD FOR PERFORMING DEVICE ISOLATION IN ANAUTHENTICATION NETWORK," which is incorporated herein by reference in its entirety. Background Art

[0003] The background description provided herein is for the purpose of generally presenting the context of the present disclosure. To the extent described in this background section, the work of the presently named inventors and various aspects described that may not otherwise be prior art at the time of filing are neither explicitly nor implicitly admitted as prior art to the present disclosure.

[0004] The security of an authentication network is of utmost importance to users of the authentication network. In order to prevent malicious actors from gaining unauthorized access to the authentication network, the authentication network should be designed to ensure that user devices registered with users of the authentication network remain authentic when connected to the authentication network. Unsecured user devices should be isolated from the authentication network to prevent disruption of the authentication network or misuse of user devices. Therefore, there is a need to provide an authentication network that prevents unauthorized user devices from accessing the authentication network. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] Figure 1A A block diagram of a system according to some example embodiments is shown.

[0006] Figure 1B A block diagram of an isolation system is shown in accordance with some embodiments.

[0007] Figure 2 A block diagram of an isolation unit according to some embodiments is shown.

[0008] Figure 3 To illustrate the Figure 2 A table of isolation actions performed by the isolation unit.

[0009] Figure 4 A flow chart illustrating a method for performing user device isolation according to some embodiments. DETAILED DESCRIPTION

[0010] Figure 1AA block diagram of an exemplary system 100 for implementing embodiments consistent with the present disclosure is shown. In some embodiments, the system 100 includes an input / output (IO) interface 101, a processor 102, a storage interface 104, a network interface 103, and a memory 105. In some embodiments, the memory 105 may include an operating system 107, a process 120, and an isolation unit 130. In some non-limiting embodiments or aspects, the system 100 may utilize the isolation unit 130 to implement a method for isolating a user device in an authentication network (in Figure 1B ), as further described herein.

[0011] In some embodiments, the processor 102 may include at least one data processor for executing program components for dynamic resource allocation at run time. The processor 102 may include a dedicated processing unit, such as an integrated system (bus) controller, a memory management control unit, a floating point unit, a graphics processing unit, a digital signal processing unit, etc. In some embodiments, the processor 102 may be arranged to communicate with one or more input / output (I / O) devices (not shown) via an I / O interface 101. The I / O interface 101 may employ a communication protocol / method, such as, but not limited to, audio, analog, digital, mono, RCA, stereo, IEEE-1394, serial bus, universal serial bus (USB), infrared, PS / 2, BNC, coaxial, component, composite, digital video interface (DVI), high-definition multimedia interface (HDMi), RF antenna, S-Video, VGA, IEEE 802.1n / b / g / n / x, Cellular (e.g., Code Division Multiple Access (CDMA), High Speed ​​Packet Access (HSPA+), Global System for Mobile Communications (GSM), Long Term Evolution (LTE), etc.

[0012] In some embodiments, the system 100 may communicate with one or more I / O devices using the I / O interface 101. For example, an input device (not shown) may be an antenna, keyboard, mouse, joystick, (infrared) remote control, camera, card reader, fax machine, dongle, biometric reader, microphone, touch screen, touch pad, trackball, stylus, scanner, storage device, transceiver, video device / source, etc. An output device (not shown) may be a printer, fax machine, video display (e.g., cathode ray tube (CRT), liquid crystal display (LCD), light emitting diode (LED), plasma, plasma display panel (PDP), organic light emitting diode display (OLED), etc.), audio speaker, etc.

[0013] In some embodiments, the processor 102 may be arranged to communicate with a communication network or other type of network via a network interface 103. The network interface 103 may communicate with the communication network. The network interface 103 may employ connection protocols including, but not limited to, direct connection, Ethernet (e.g., twisted pair 10 / 100 / 1000Base T), Transmission Control Protocol / Internet Protocol (TCP / IP), Token Ring, IEEE 802.11a / b / g / n / x, etc. The communication network may include, but not limited to, direct interconnection, e-commerce network, peer-to-peer (P2P) network, local area network (LAN), wide area network (WAN), wireless network (e.g., using wireless application protocol), the Internet, Etc. Using the network interface 103 and the communication network, the system 100 can communicate with one or more service operators.

[0014] In some non-limiting embodiments or aspects, the processor 102 may be arranged to communicate with a memory 105 (e.g., RAM, ROM, etc.) via a storage interface 104. In some embodiments, the storage interface 104 may be connected to a memory 105, including but not limited to a memory drive, a removable optical drive, etc., using a connection protocol such as Serial Advanced Technology Attachment (SATA), Integrated Drive Electronics (IDE), IEEE-1394, Universal Serial Bus (USB), Fibre Channel, Small Computer System Interface (SCSI), etc. The memory drive may also include a drum, a magnetic disk drive, a magneto-optical disk drive, an optical disk drive, a redundant array of independent disks (RAID), a solid-state memory device, a solid-state hard disk, etc.

[0015] In some embodiments, the memory 105 may store a collection of program or database components, including but not limited to a user interface, an operating system 107, a web server, etc. In some non-limiting embodiments or aspects, the system 100 may store user / application data, such as data, variables, records, etc., as described in the present disclosure. Such a database may be implemented as a fault-tolerant, relational, scalable, secure database, such as Oracle or Sybase.

[0016] In some embodiments, operating system 107 may facilitate resource management and operation of system 100. Examples of operating systems include, but are not limited to, Apple OS UNIX-like distributions (e.g., BERKELEY SOFTWARE (BSD), OPENBSD, etc.), DISTRIBUTIONS (e.g., RED wait), ( / 7 / 8, 10, etc.), GOOGLE TM ANDROID TM , OS, etc.

[0017] In some non-limiting embodiments or aspects, the system 100 may implement a program component stored in a web browser (not shown). The web browser (not shown) may be a hypertext viewing application such as Microsoft INTERNET GOOGLE TM CHROME TM , Secure web browsing can be provided using Hypertext Transfer Protocol Secure (HTTPS), Secure Sockets Layer (SSL), Transport Layer Security (TLS), etc. Web browsers can use technologies such as AJAX, DHTML, Application programming interface (API) and other facilities.

[0018] In some embodiments, "authentication" may refer to the process of verifying the identity of a user or a user device associated with a user to access a network or an application running on the network or user device. Authentication may be biometric authentication. In some embodiments, biometric authentication is the authentication of a user or user device using a "biometric feature" (e.g., any human feature unique to an individual or user). In some embodiments, for example, a biometric feature may be a person's fingerprint, face, DNA, etc. In some embodiments, another form of authentication is two-factor authentication or multi-factor authentication. In some embodiments, two-factor authentication or multi-factor authentication is an authentication method in which a user or user device is authorized to access an authentication network only after successfully presenting two or more pieces of evidence (e.g., a unique code or password).

[0019] In addition, one or more computer-readable storage media can be utilized to implement embodiments consistent with the present disclosure. In some embodiments, a computer-readable storage medium refers to a physical memory of any type that can store information or data that can be read by a processor. Therefore, a computer-readable storage medium can store instructions executed by one or more processors, including instructions that cause the processor to execute steps or stages consistent with the embodiments described herein. The term "computer-readable medium" should be understood to include tangible items, and does not include carrier waves and transient signals, such as non-transient. Examples include random access memory (RAM), read-only memory (ROM), volatile memory, non-volatile memory, hard disk drive, compact disk (CD) ROM, digital video disk (DVD), flash drive, disk, and any other known physical storage medium.

[0020] Figure 1B A diagram of an isolation system 190 according to some embodiments is shown. In some embodiments, isolation system 190 includes user device 112, user device 113, gateway 181, and authentication network 170. In some embodiments, as previously described with reference to Figure 1A As stated, the term authentication may refer to the process of verifying the identity of a user or a user device associated with a user to access a network or an application running on a network or user device. In some embodiments, the authentication network 170 may be, for example, a network that performs the process of verifying the identity of a user or user device (e.g., a user of the user device 112 and the user device 113) to access a network or an application running on a network or user device. In some embodiments, the authentication network 170 may include multiple servers, computers, and user devices, or be connected to multiple servers, computers, and user devices across multiple protocols through a network gateway such as a gateway 181. In some embodiments, the user device 112 and the user device 113 may be, for example, a mobile phone, a tablet computer, a laptop computer, or some other type of computer device. In some embodiments, the user device 112 includes an authentication application 150, and the user device 113 includes an authentication application 151. In some embodiments, the authentication application 150 may be an authentication application configured to be used by a user of the user device 112 to register and authenticate the user device 112 to the authentication network 170. In some embodiments, the authentication application 151 may be an authentication application configured to be used by a user of the user device 113 to register and authenticate the user device 113 to the authentication network 170. In some embodiments, registration of user devices 112 and 113 and users associated with user devices 112 and 113 with authentication network 170 may require providing information unique to user devices 112, 113, and users of user devices 112 and 113 via, for example, authentication application 150 and / or authentication application 151. In some embodiments, the information may include, for example, the user's name, the user's address, account information associated with the user, and a unique user device identifier associated with the user device. In some embodiments, although two user devices (e.g., user device 112 and user device 113) are in Figure 1B 1 is shown as being registered with authentication network 170 for a user, but there may be additional user devices and / or users of user devices registered with authentication network 170.

[0021] In some embodiments, authentication network 170 may register one or more accounts associated with a user of user device 112 and user device 113 (e.g., a bank account associated with a user of user device 112) for user device 112 or user device 113. In some embodiments, authentication network 170 may register one or more accounts for user device 112 by linking one or more unique device identifiers of user device 112 (e.g., a unique application identifier associated with an authentication application installed on user device 112, a media access control (MAC) address of user device 112, an identifier assigned to user device 112 by authentication network 170, etc.) with the one or more accounts. In some embodiments, similarly, authentication network 170 may register one or more accounts for user device 113 by linking one or more unique device identifiers of user device 113 with the one or more accounts.

[0022] In some embodiments, isolation system 190 is configured to perform an isolation analysis on each user device registered with authentication network 170 to determine whether to isolate the user device from authentication network 170. In some embodiments, as part of the isolation analysis, isolation system 190 continuously evaluates and performs a behavioral analysis of each user device registered with authentication network 170 to determine whether user device 112 or user device 113 should be isolated from authentication network 170, as described below with reference to Figures 2 to 4 Further description.

[0023] Figure 2 According to some embodiments Figure 1AThe isolation unit 130 of the authentication network 170. In some embodiments, the isolation unit 130 is an executable code configured to isolate one or more user devices in the authentication network (e.g., the authentication network 170) based on the isolation analysis of each user device (e.g., the user device 112 and the user device 113) in the authentication network. In some embodiments, the isolation unit 130 includes a behavior monitoring unit 250, a deviation analysis unit 260, and an isolation analysis unit 270. In some embodiments, the behavior monitoring unit 250 is an executable code configured to monitor the behavior of users and / or user devices registered with the authentication network 170. In some embodiments, the deviation analysis unit 260 is an executable code configured to analyze the deviation of the behavior of the user and / or user device from the normal behavior of the user and / or user device. In some embodiments, the isolation analysis unit 270 is an executable code configured to perform an isolation analysis of the user and / or user device to determine whether the user device should be isolated from the authentication network 170. In some embodiments, the behavior monitoring unit 250, the deviation analysis unit 260, and the isolation analysis unit 270 are collectively configured to analyze the behavior of user devices in the authentication network 170, determine the deviation of the behavior of the user devices from the normal behavior of the user devices in the authentication network 170, and determine whether the user devices among multiple user devices should be isolated from the authentication network 170 based on the results of the isolation analysis, as further described herein.

[0024] In some embodiments, in operation, the behavior monitoring unit 250 monitors the behavior of each user device (e.g., user device 112 and user device 113) registered by the user to the authentication network 170. In some embodiments, the behavior monitoring unit 250 monitors the behavior of each user device by collecting behavior data associated with each user device. In some embodiments, the behavior data collected by the behavior monitoring unit 250 may include, for example, a sliding pattern associated with the user device, an input pattern associated with the user device, location data associated with the user device, a navigation path associated with the user device, a touch heat map associated with the user device, battery usage associated with the user device, application (App) usage details associated with the user device, accelerometer data associated with the user device, device security usage patterns associated with the user device, screen views associated with the user device, various sessions associated with the user device, and time data associated with the user device. In some embodiments, the behavior data is collected by the behavior monitoring unit 250 and stored in a database associated with the authentication network 170, which is configured to store the behavior data for further processing.

[0025] In some embodiments, when (or after) the behavior data is collected by the behavior monitoring unit 250, the behavior monitoring unit 250 generates a behavior accuracy score for each user device using the behavior data. In some embodiments, the behavior accuracy score is a numerical score indicating the accuracy of the behavior associated with the user device. In some embodiments, the behavior monitoring unit 250 generates the behavior accuracy score using a machine learning model generated using machine learning techniques. In some embodiments, for example, unsupervised machine learning techniques (e.g., K-means clustering, hybrid models, hierarchical clustering), supervised machine learning techniques (e.g., decision tree analysis, classification and regression trees, K nearest neighbor algorithms (KNN), random forests, change models (before and after events), time series analysis, and neural networks can be used to generate machine learning models, which are used to generate behavior accuracy scores. In some embodiments, machine learning techniques can be applied to the behavior data to generate statistical patterns in the history of the behavior data, and extract individual unique behaviors about each device for a specific user.

[0026] In some embodiments, after generating the behavior accuracy score, the behavior monitoring unit 250 determines the accuracy level of the behavior accuracy score (e.g., whether the behavior accuracy score is a low behavior accuracy score, a medium behavior accuracy score, or a high behavior accuracy score) by comparing the behavior accuracy score with a predetermined number of behavior accuracy score categories. In some embodiments, the behavior accuracy score category is a category indicating the accuracy level of the behavior of the user device. In some embodiments, the behavior accuracy score category includes a first behavior accuracy score category, a second behavior accuracy score category, and a third behavior accuracy score category. In some embodiments, the first behavior accuracy score category is a high behavior accuracy score category, the second behavior accuracy score category is a medium behavior accuracy score category, and the third behavior accuracy score category is a low behavior accuracy score category. In some embodiments, after the behavior accuracy score category associated with the behavior accuracy score is generated by the behavior monitoring unit 250, the behavior monitoring unit 250 provides the behavior accuracy score and the associated behavior accuracy score category to the isolation analysis unit 270 and the deviation analysis unit 260 for further processing.

[0027] In some embodiments, the deviation analysis unit 260 receives the behavior accuracy score and the behavior accuracy score category and evaluates the behavior accuracy score category to determine whether to perform a deviation analysis of the user device associated with the behavior accuracy score. Figure 3Further describing, the deviation analysis may include, for example, initiating a process of recording deviations of the conventional behavior of a user device from the actual behavior of the user device (e.g., current behavior), generating a deviation score using the deviations of the conventional behavior of the user device from the actual behavior of the user device, and comparing the behavior changes on another one or more user devices. In some embodiments, the conventional behavior of the user device is a typical behavior of the user device associated with a high behavior accuracy score. In some embodiments, for example, when the deviation analysis unit 260 evaluates the behavior accuracy score category and determines that the behavior accuracy score has been classified as a high behavior accuracy score, the deviation analysis unit 260 does not perform the deviation analysis and does not record the deviation pattern of the behavior of the user device from the conventional behavior of the user device.

[0028] In some embodiments, when the deviation analysis unit 260 determines that the behavior accuracy score has been classified as a medium behavior accuracy score, the deviation analysis unit 260 records the deviation pattern and associated deviation data of the behavior of the user device from the normal behavior of the user device, and scores the distance of the actual behavior of the user device to the normal behavior of the user device (e.g., generating a deviation score for the user device as further described herein).

[0029] In some embodiments, when the deviation analysis unit 260 determines that the behavior accuracy score has been classified as a low behavior accuracy score, in addition to recording the deviation pattern and scoring the distance of the actual behavior of the user device to the regular behavior, the isolation unit 130 begins to compare the behavior changes on another device (for example, comparing the behavior changes on another user device registered to the user with the behavior changes on the current user device registered to the user).

[0030] In some embodiments, further referring to the deviation score generated by the deviation analysis 260, when the deviation analysis unit 260 records or collects the deviation pattern and the associated deviation data, the deviation analysis unit 260 utilizes the deviation data to generate a deviation score for each user device in the plurality of user devices. In some embodiments, the deviation score is a numerical score indicating the deviation of the behavior associated with the user device from the normal behavior of the user device. In some embodiments, the deviation analysis unit 260 may utilize a machine learning model generated using the aforementioned machine learning techniques to generate the deviation score. In some embodiments, the deviation score is generated for each user device in the plurality of user devices based on the deviation of the behavior of each user device in the plurality of user devices in the authentication network 170. In some embodiments, the deviation score is further utilized by the deviation analysis unit 260 to generate an associated deviation score category.

[0031] In some embodiments, after generating the deviation score, the deviation analysis unit 260 analyzes the deviation score and determines the deviation score level of the deviation score (e.g., whether the deviation score is a low deviation score, a medium deviation score, or a high deviation score). In some embodiments, the deviation analysis unit 260 determines whether the deviation score is a low deviation score, a medium deviation score, or a high deviation score by comparing the score with a predetermined number of deviation score categories. In some embodiments, the deviation score category is a category indicating the deviation level of the user device (e.g., a classification representation of the deviation of the behavior of the user device from the conventional behavior of the user device). In some embodiments, the deviation score category includes a first deviation score category, a second deviation score category, and a third deviation score category. In some embodiments, the first deviation score category is a low deviation score category, the second deviation score category is a medium deviation score category, and the third deviation score category is a high deviation score category. In some embodiments, the deviation score and the deviation score category generated by the deviation analysis unit 260 are provided to the isolation analysis unit 270 for further isolation analysis processing.

[0032] In some embodiments, isolation analysis unit 270 receives the behavior accuracy score (and associated behavior accuracy score category) from behavior monitoring unit 250 and receives the deviation score (and associated deviation score category) from deviation analysis unit 260, and evaluates the deviation score and the classification of the behavior accuracy score to determine whether to isolate the user device (e.g., user device 112 or user device 113) from authentication network 170. In some embodiments, for example, Figure 3 As shown in Table 300 of FIG. 1 , when quarantine analysis unit 270 determines that the behavior accuracy score is within a second behavior accuracy score category (e.g., a medium behavior accuracy score category) and the deviation score is within a first deviation score category (e.g., a low deviation score category), the associated user device is temporarily logged out of authentication network 170 by quarantine unit 130, and authentication network 170 requests biometric authentication from the user of the user device to log into authentication network 170. In some embodiments, after the user provides biometric information and biometrically authenticates, quarantine unit 130 releases the temporary logout of the user device and allows the user device to log into authentication network 170.

[0033] In some embodiments, when the quarantine analysis unit 270 determines that the behavioral accuracy score is within a second behavioral accuracy score category (e.g., a medium behavioral accuracy score category) and the deviation score is within a second deviation score category (e.g., a medium deviation score category), the associated user device is temporarily logged out of the authentication network 170 by the quarantine unit 130, and a biometric authentication and two-factor authentication are requested from the user associated with the user device to log into the authentication network 170. In some embodiments, biometric authentication and two-factor authentication are requested from the user of the user device associated with the user who has received a high behavioral accuracy score (e.g., a “high confidence” device). In some embodiments, after the user is biometrically authenticated and the two-factor authentication is completed, the quarantine unit 130 releases the temporary logout of the user device and allows the user device to log into the authentication network 170.

[0034] In some embodiments, when quarantine analysis unit 270 determines that the behavior accuracy score is within the second behavior accuracy score category (e.g., medium behavior accuracy score category) and the deviation score is within the third deviation score category (e.g., high deviation score category), the user device is temporarily logged out of authentication network 170 by quarantine unit 130 for a fixed duration (e.g., a fixed number of seconds m or a fixed number of minutes n) and further evaluation of the deviation score by quarantine analysis unit 270 indicates an action by quarantine unit 130. In some embodiments, for example, when quarantine analysis unit 270 determines that the deviation score is not within the third deviation score category (e.g., high deviation score category), quarantine unit 130 proceeds with an action corresponding to the first deviation score category (e.g., low deviation score category) or an action corresponding to the second deviation score category (e.g., medium deviation score category).

[0035] In some embodiments, when isolation analysis unit 270 determines that the behavior accuracy score is within a third behavior accuracy score category (e.g., a low behavior accuracy score category) and the deviation score is within a first deviation score category (e.g., a low deviation score category), the user device is temporarily logged out of authentication network 170 for a fixed amount of time (e.g., n minutes), and based on a similarity assessment of the deviation scores of multiple user devices that are not associated user devices, the behavior accuracy score of the user device is adjusted so that the behavior accuracy score is in the second behavior accuracy score category and the deviation score of the user device is in the third deviation score category. For example, in some embodiments, if the deviation scores of other user devices registered with the user are similar to the deviation score of the current user device registered with the user, the behavior accuracy score is adjusted or changed to "medium" by isolation analysis unit 270, and the deviation score is adjusted or changed to "high".

[0036] In some embodiments, when isolation analysis unit 270 determines that the behavior accuracy score is within a third behavior accuracy score category (e.g., a low behavior accuracy score category) and the deviation score is within a second deviation score category (e.g., a medium deviation score category), the user device is temporarily logged out of authentication network 170 for a fixed amount of time (e.g., n minutes), and based on a similarity evaluation of the deviation scores of multiple devices that are not the current user device, the deviation score of the user device is adjusted so that the deviation score is in the first deviation score category. For example, in some embodiments, if the deviation scores of other user devices registered with the user are similar to the deviation score of the current user device, the deviation score is changed to a "low" deviation score.

[0037] In some embodiments, when the isolation analysis unit 270 determines that the behavioral accuracy score is within a third behavioral accuracy score category (e.g., a low behavioral accuracy score category) and the deviation score is within a third deviation score category (e.g., a high deviation score category), the user device is isolated from the authentication network 170. In some embodiments, when the isolation analysis unit 270 determines that the behavioral accuracy score is within a third behavioral accuracy score category (e.g., a low behavioral accuracy score category) and the deviation score is within a third deviation score category (e.g., a high deviation score category), the user device is isolated from the authentication network 170 until the user of the user device re-initiates the registration process (e.g., registration of the user and / or the user device). Reference Figure 3 Further description and references Figure 2 Describes the behavioral accuracy score categories and the isolation actions corresponding to the device score categories.

[0038] Figure 3 Table 300 is shown, which depicts isolation actions 340 taken by isolation unit 130 based on isolation analysis of user devices registered with authentication network 170 (previously referred to as Figure 2 In some embodiments, table 300 includes columns representing behavior accuracy score 310, deviation analysis 320, deviation score 330, and isolation action 340. In some embodiments, behavior accuracy score 310, deviation analysis 320, deviation score 330, and isolation action 340 are mapped to the previously referenced Figure 2 Describes behavioral accuracy scores and behavioral accuracy score classifications, deviation analysis, deviation scores and deviation score classifications, and isolation actions. Figure 3 As shown in Table 300, when the behavior accuracy score is classified as a "low" behavior accuracy score and the deviation score is classified as a "high" deviation score, the user device is isolated by the isolation unit 130, thereby protecting the user of the authentication network 170 from the impact of the isolated user device.

[0039] Figure 4Flowchart showing a method 400 for performing device isolation according to some embodiments. The methods, process steps, or stages shown in the figures may be implemented as independent routines or processes, or as part of a larger routine or process. Note that in other embodiments, each process step or stage depicted may be implemented as an apparatus, method, or system including a processor that executes a set of instructions. In some embodiments, the method 400 is described with reference to the figures described herein.

[0040] In some embodiments, at operation 405, the behavior monitoring unit 250 monitors the behavior patterns of multiple user devices (e.g., user device 112 and user device 113) associated with the user and registered with the authentication network 170 in the authentication network 170. In some embodiments, at operation 410, the behavior monitoring unit 250 generates a behavior accuracy score for each of the multiple user devices based on the behavior pattern of each of the multiple user devices in the authentication network 170. In some embodiments, at operation 415, the deviation analysis unit 260 generates a deviation score for each of the multiple user devices based on the deviation of the behavior of each of the multiple user devices from the normal behavior of the user devices.

[0041] In some embodiments, at operation 420, the behavior accuracy score and the deviation score are used to determine whether to isolate a user device in a plurality of user devices from the authentication network 170. In some embodiments, the behavior accuracy score and the deviation score are associated with or used to generate a behavior accuracy score category and a deviation score category, which are used to determine whether to isolate a user device in a plurality of user devices from the authentication network. In some embodiments, at operation 430, based on the isolation analysis performed by the isolation analysis unit 270, the user device in the plurality of user devices is isolated from the authentication network. In some embodiments, by utilizing the isolation method described herein, the isolation analysis unit 270 improves the existing network by preventing unwanted user devices from staying in the network. In addition, in some embodiments, the isolation system described herein provides technical benefits related to improvements in computing technology, such as improving computing efficiency and the security of the network by, for example, utilizing isolation analysis of the user device based on the behavioral deviation of the user device so that the authentication network self-monitors the user device and isolates the user device based on the deviation performed as part of the isolation analysis.

[0042] In some embodiments, a computer-implemented method includes: monitoring behavior patterns of multiple devices associated with a user in an authentication network; generating a behavior accuracy score for each of the multiple devices based on the behavior pattern of each of the multiple devices in the authentication network; generating a deviation score for each of the multiple devices based on the deviation of the behavior of each of the multiple devices from the behavior of conventional devices; and using the behavior accuracy score and the deviation score to determine whether to isolate a device of the multiple devices from the authentication network.

[0043] In some embodiments, the computer-implemented method further includes determining whether a behavioral accuracy score of a first device of the plurality of devices is within a first behavioral accuracy score category, a second behavioral accuracy score category, or a third behavioral accuracy score category.

[0044] In some embodiments, the computerized implemented method further includes determining whether the deviation score is within the first deviation score category, the second deviation score category, or the third deviation score category.

[0045] In some embodiments of the computer-implemented method, when the behavioral accuracy score is within the second behavioral accuracy score category and the deviation score is within the first deviation score category, the first device temporarily logs out of the authentication network and requests biometric authentication from a user of the first device to log into the authentication network.

[0046] In some embodiments of the computer-implemented method, when the behavioral accuracy score is within a second behavioral accuracy score category and the deviation score is within a second deviation score category, the first device temporarily logs out of the authentication network and requests biometric authentication and two-factor authentication from a user of the first device to log into the authentication network.

[0047] In some embodiments of the computer-implemented method, when the behavioral accuracy score is within a second behavioral accuracy score category and the deviation score is within a third deviation score category, the first device temporarily logs out of the authentication network for a fixed amount of time and makes a determination based on the deviation score as to whether to proceed with an action corresponding to the first deviation score category or an action corresponding to the second deviation score category.

[0048] In some embodiments of the computer-implemented method, when the behavioral accuracy score is within a third behavioral accuracy score category and the deviation score is within the first deviation score category, the first device is temporarily logged out of the authentication network for a fixed amount of time, and based on a similarity assessment of the deviation scores of multiple devices that are not the first device, the behavioral accuracy score of the first device is adjusted so that the behavioral accuracy score is in the second behavioral accuracy score category and the deviation score of the first device is in the third deviation score category.

[0049] In some embodiments of the computer-implemented method, when the behavioral accuracy score is within a third behavioral accuracy score category and the deviation score is within a second deviation score category, the first device is temporarily logged out of the authentication network for a fixed amount of time, and based on a similarity assessment of the deviation scores of multiple devices that are not the first device, the deviation score of the first device is adjusted so that the deviation score is in the first deviation score category.

[0050] In some embodiments of the computer-implemented method, when the behavioral accuracy score is within a third behavioral accuracy score category and the deviation score is within a third deviation score category, the first device is isolated from the authentication network until a user of the first device re-initiates registration of the first device.

[0051] In some embodiments of the computer-implemented method, the first behavioral accuracy score category is a high behavioral accuracy score category, the second behavioral accuracy score category is a medium behavioral accuracy score category, the third behavioral accuracy score category is a low behavioral accuracy score category, the first deviation score category is a low deviation score category, the second deviation score category is a medium deviation score category, and the third deviation score category is a high deviation score category.

[0052] In some embodiments, a system includes: a processor; and a non-transitory computer-readable medium coupled to the processor, the non-transitory computer-readable medium including code, the code: monitoring behavior patterns of multiple devices associated with a user in an authentication network; generating a behavior accuracy score for each of the multiple devices based on the behavior pattern of each of the multiple devices in the authentication network; generating a deviation score for each of the multiple devices based on the deviation of the behavior of each of the multiple devices from the behavior of conventional devices; and using the behavior accuracy score and the deviation score to determine whether to isolate a device of the multiple devices from the authentication network.

[0053] In some embodiments of the system, the non-transitory computer-readable medium further includes code that: determines whether a behavioral accuracy score of a first device among a plurality of devices is within a first behavioral accuracy score category, a second behavioral accuracy score category, or a third behavioral accuracy score category; and determines whether a deviation score is within the first deviation score category, the second deviation score category, or the third deviation score category.

[0054] In some embodiments of the system, when the behavioral accuracy score is within the second behavioral accuracy score category and the deviation score is within the first deviation score category, the first device temporarily logs out of the authentication network and requests biometric authentication from a user of the first device to log into the authentication network.

[0055] In some embodiments of the system, when the behavioral accuracy score is within a second behavioral accuracy score category and the deviation score is within a second deviation score category, the first device temporarily logs out of the authentication network and requests biometric authentication and two-factor authentication from a user of the first device to log into the authentication network.

[0056] In some embodiments of the system, when the behavioral accuracy score is within a second behavioral accuracy score category and the deviation score is within a third deviation score category, the first device temporarily logs out of the authentication network for a fixed amount of time and makes a determination as to whether to proceed with an action corresponding to the first deviation score category or an action corresponding to the second deviation score category.

[0057] In some embodiments of the system, when the behavioral accuracy score is within a third behavioral accuracy score category and the deviation score is within a first deviation score category, the first device is temporarily logged out of the authentication network for a fixed amount of time, and based on a similarity assessment of the deviation scores of multiple devices that are not the first device, the behavioral accuracy score of the first device is adjusted so that the behavioral accuracy score is in the second behavioral accuracy score category and the deviation score of the first device is in the third deviation score category.

[0058] In some embodiments of the system, when the behavioral accuracy score is within a third behavioral accuracy score category and the deviation score is within a second deviation score category, the first device is temporarily logged out of the authentication network for a fixed amount of time, and based on a similarity assessment of the deviation scores of multiple devices that are not the first device, the deviation score of the first device is adjusted so that the deviation score is in the first deviation score category.

[0059] In some embodiments, a device includes: an isolation analysis unit; a behavior monitoring unit coupled to the isolation analysis unit; and a deviation analysis unit coupled to the isolation analysis unit and the isolation analysis unit, wherein the isolation analysis unit determines whether to isolate a device from multiple devices in the authentication network based on an isolation evaluation of a behavior accuracy score and a deviation score associated with each of multiple devices in the authentication network.

[0060] In some embodiments of the apparatus, the quarantine analysis unit compares the behavior accuracy score to a behavior accuracy score category and compares the deviation score to a deviation score category to determine whether to quarantine the device.

[0061] In some embodiments of the apparatus, when the behavior accuracy score is in a low behavior accuracy score category and the deviation score is in a high deviation score category, the device is isolated from the authentication network until a user of the device re-initiates registration of the device.

Claims

1. A computer-implemented method comprising: monitoring a behavior pattern of a plurality of devices associated with a user in an authentication network; generating a behavior accuracy score for each of the plurality of devices in the authentication network based on the behavior pattern of each of the plurality of devices; generating a deviation score for each of the plurality of devices based on a deviation of a behavior of each of the plurality of devices from a conventional device behavior; as well as The behavioral accuracy score and the deviation score are used to determine whether to isolate a device of the plurality of devices from the authentication network.

2. The computer-implemented method of claim 1 , further comprising: A determination is made as to whether the behavioral accuracy score of a first device of the plurality of devices is within a first behavioral accuracy score category, a second behavioral accuracy score category, or a third behavioral accuracy score category.

3. The computer-implemented method of claim 2, further comprising: A determination is made as to whether the deviation score is within a first deviation score category, a second deviation score category, or a third deviation score category.

4. The computer-implemented method of claim 3, wherein: When the behavioral accuracy score is within the second behavioral accuracy score category and the deviation score is within the first deviation score category, the first device temporarily logs out of the authentication network and requests biometric authentication from a user of the first device to log into the authentication network.

5. The computer-implemented method of claim 3, wherein: When the behavioral accuracy score is within the second behavioral accuracy score category and the deviation score is within the second deviation score category, the first device temporarily logs out of the authentication network and requests biometric authentication and two-factor authentication from a user of the first device to log into the authentication network.

6. The computer-implemented method of claim 3, wherein: When the behavioral accuracy score is within the second behavioral accuracy score category and the deviation score is within the third deviation score category, the first device temporarily logs out of the authentication network for a fixed amount of time and makes a determination based on the deviation score as to whether to proceed with an action corresponding to the first deviation score category or an action corresponding to the second deviation score category.

7. The computer-implemented method of claim 3, wherein: When the behavioral accuracy score is within the third behavioral accuracy score category and the deviation score is within the first deviation score category, the first device temporarily logs out of the authentication network for a fixed amount of time, and based on a similarity assessment of the deviation scores of the multiple devices that are not the first device, adjusts the behavioral accuracy score of the first device so that the behavioral accuracy score is in the second behavioral accuracy score category and the deviation score of the first device is in the third deviation score category.

8. The computer-implemented method of claim 3, wherein: When the behavioral accuracy score is within the third behavioral accuracy score category and the deviation score is within the second deviation score category, the first device temporarily logs out of the authentication network for a fixed amount of time, and based on a similarity assessment of the deviation scores of the multiple devices that are not the first device, adjusts the deviation score of the first device so that the deviation score is in the first deviation score category.

9. The computer-implemented method of claim 3, wherein: When the behavioral accuracy score is within the third behavioral accuracy score category and the deviation score is within the third deviation score category, the first device is isolated from the authentication network until a user of the first device re-initiates registration of the first device.

10. The computer-implemented method of claim 3, wherein: The first behavior accuracy score category is a high behavior accuracy score category, the second behavior accuracy score category is a medium behavior accuracy score category, the third behavior accuracy score category is a low behavior accuracy score category, the first deviation score category is a low deviation score category, the second deviation score category is a medium deviation score category, and the third deviation score category is a high deviation score category.

11. A system comprising: processor; as well as A non-transitory computer readable medium coupled to the processor, the non-transitory computer readable medium comprising code, the code: monitoring a behavior pattern of a plurality of devices associated with a user in an authentication network; generating a behavior accuracy score for each of the plurality of devices in the authentication network based on the behavior pattern of each of the plurality of devices; generating a deviation score for each of the plurality of devices based on a deviation of a behavior of each of the plurality of devices from a conventional device behavior; as well as The behavioral accuracy score and the deviation score are used to determine whether to isolate a device of the plurality of devices from the authentication network.

12. The system of claim 11, wherein the non-transitory computer readable medium further comprises code, the code: determining whether the behavioral accuracy score of a first device of the plurality of devices is within a first behavioral accuracy score category, a second behavioral accuracy score category, or a third behavioral accuracy score category; and A determination is made as to whether the deviation score is within a first deviation score category, a second deviation score category, or a third deviation score category.

13. The system of claim 12, wherein: When the behavioral accuracy score is within the second behavioral accuracy score category and the deviation score is within the first deviation score category, the first device temporarily logs out of the authentication network and requests biometric authentication from a user of the first device to log into the authentication network.

14. The system of claim 12, wherein: When the behavioral accuracy score is within the second behavioral accuracy score category and the deviation score is within the second deviation score category, the first device temporarily logs out of the authentication network and requests biometric authentication and two-factor authentication from a user of the first device to log into the authentication network.

15. The system of claim 12, wherein: When the behavioral accuracy score is within the second behavioral accuracy score category and the deviation score is within the third deviation score category, the first device temporarily logs out of the authentication network for a fixed amount of time and makes a determination as to whether to proceed with an action corresponding to the first deviation score category or an action corresponding to the second deviation score category.

16. The system of claim 12, wherein: When the behavioral accuracy score is within the third behavioral accuracy score category and the deviation score is within the first deviation score category, the first device temporarily logs out of the authentication network for a fixed amount of time, and based on a similarity assessment of the deviation scores of the multiple devices that are not the first device, adjusts the behavioral accuracy score of the first device so that the behavioral accuracy score is in the second behavioral accuracy score category and the deviation score of the first device is in the third deviation score category.

17. The system of claim 12, wherein: When the behavioral accuracy score is within the third behavioral accuracy score category and the deviation score is within the second deviation score category, the first device temporarily logs out of the authentication network for a fixed amount of time, and based on a similarity assessment of the deviation scores of the multiple devices that are not the first device, adjusts the deviation score of the first device so that the deviation score is in the first deviation score category.

18. An apparatus comprising: Isolate analytical units; a behavior monitoring unit coupled to the isolation analysis unit; as well as a deviation analysis unit coupled to the isolation analysis unit and the isolation analysis unit, wherein the isolation analysis unit determines whether to isolate a device from a plurality of devices in the authentication network based on an isolation evaluation of a behavior accuracy score and a deviation score associated with each of the plurality of devices in the authentication network.

19. The apparatus of claim 18, wherein: The quarantine analysis unit compares the behavior accuracy score to a behavior accuracy score category and compares the deviation score to a deviation score category to determine whether to quarantine the device.

20. The apparatus of claim 19, wherein: When the behavioral accuracy score is in a low behavioral accuracy score category and the deviation score is in a high deviation score category, the device is isolated from the authentication network until a user of the device re-initiates registration of the device.

Images