Composite Authentication Assurance Using User and Account Indicators
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems require users to consistently provide multiple authentication factors, which can diminish user experience and increase security challenges, especially when factors like one-time codes are involved, and do not adequately differentiate between user and account authentication levels.
Innovation Solution
An authentication assurance system that determines a composite measure of authentication assurance using a combination of user-level and account-level indicators, applying an algorithmic decay model to historical authentication events, and considering both historical and runtime-provided inputs to dynamically adjust authentication requirements based on transaction types and user confidence levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multi-factor authentication is implemented, then security is improved, but user experience deteriorates due to additional authentication steps
Solution Approach 1:
The system dynamically adjusts authentication requirements based on real-time risk assessment of authentication events. Instead of requiring all authentication factors consistently, the system adapts the number and type of factors needed based on the specific risk level of each authentication attempt, making the process flexible rather than static
Solution Approach 2:
The system changes the parameters of authentication requirements based on risk assessment. When risk is low, fewer authentication factors are required; when risk is high, more factors are demanded. This parameter adjustment resolves the contradiction by making security requirements proportional to actual risk levels rather than uniformly high
2Reliability
If authentication factors are required for each log-in, then security is improved, but productivity deteriorates due to repeated authentication steps
Solution Approach 1:
The system applies partial authentication action by requiring only the necessary number of authentication factors based on risk assessment. When risk is low, partial authentication (fewer factors) is sufficient; when risk is high, excessive authentication (more factors) is applied. This prevents the need for full multi-factor authentication in every case
Solution Approach 2:
The system implements periodic risk assessment of authentication events rather than continuous high-level authentication requirements. By periodically evaluating the risk level of authentication attempts and adjusting requirements accordingly, the system maintains security while reducing redundant authentication steps during low-risk periods
3Reliability
If consistent multi-factor authentication is required, then security is improved, but device complexity increases due to multiple authentication mechanisms
Solution Approach 1:
The system segments authentication requirements into different levels based on risk assessment. Instead of uniformly applying all authentication factors, the system divides the authentication process into conditional stages, requiring only the appropriate segment of factors based on the specific risk level of each authentication attempt
Data Source
AI summary
Disclosed are various embodiments for determining authentication assurance based on both user-level and account-level indicators. An authentication request associated with an account is received responsive to an input from a user via a user interface. A user-level measure of authentication assurance corresponding to the user is determined. An account-level measure of authentication assurance corresponding to the account is determined. A composite measure of authentication assurance is then determined from a combination of the user-level measure of authentication assurance and the account-level measure of authentication assurance. A response to the authentication request is generated based at least in part on comparing the composite measure of authentication assurance to a threshold.