Access Prediction Service for Risk-Based Step-Up Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing step-up authentication mechanisms burden legitimate users with unnecessary challenges, causing frustration and inefficiency, while still being necessary for security against malicious actors and bots.
Innovation Solution
A system that detects anomalous authentication requests using a combination of machine learning models and rule-based heuristics to conditionally invoke step-up authentication, providing explainable risk scores to minimize false positives and user burden.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If step-up authentication is invoked for all anomalous requests, then security against malicious actors is improved, but user experience deteriorates due to unnecessary challenges for legitimate users
Solution Approach 1:
The system changes the parameter of authentication challenge invocation from a binary all-or-nothing approach to a probabilistic approach based on anomaly scores. By calculating anomaly scores and comparing them against thresholds, the system dynamically adjusts which requests receive step-up authentication challenges, resolving the contradiction between security and user experience.
Solution Approach 2:
The patent replaces the mechanical rule-based system (if anomaly then challenge) with a machine learning-based predictive model that calculates anomaly scores. This substitution enables nuanced decision-making that balances security requirements with user experience by identifying patterns that simple rules cannot detect.
2Ease of operation
If step-up authentication is reduced for legitimate users, then user experience improves, but security coverage may be compromised
Solution Approach 1:
The system implements feedback loops where authentication outcomes (challenge results, access decisions) are fed back into the machine learning model to continuously refine anomaly detection. This feedback mechanism ensures that security coverage is maintained and improved over time while reducing false positives that burden legitimate users.
Solution Approach 2:
The authentication challenge invocation is made dynamic rather than static. The system continuously adapts thresholds and model parameters based on incoming data, allowing it to respond to evolving threat patterns while maintaining appropriate user experience. The dynamic nature enables the system to tighten or relax security measures as conditions change.
3Measurement precision
If machine learning models are trained on authentication journey data, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent segments the authentication system into distinct components: the authentication journey execution engine, the access prediction service with machine learning models, and the challenge invocation logic. This segmentation allows each component to be developed, trained, and maintained independently, managing complexity while enabling sophisticated anomaly detection through specialized machine learning models.
Data Source
AI summary
A process, system and medium for building a training set and performing supervised training of a Machine Learning (ML) model that determines a risk score used to decide whether to impose stepped up authentication during an authentication journey are described. The process includes selecting examples of completed authentication journeys, including failed and successful authentication outcomes after step-up requirements during the example journeys. The process includes pairing ground truth outcomes from the example journeys with authentication request features initially available prior to imposition of the step-up requirements to produce request feature-outcome pairs. The process includes using at least the request feature-outcome pairs to perform the supervised training of the ML model to determine a risk score that can be used to decide whether to impose the stepped up authentication during an authentication journey. The system and medium are configured to execute the process.