Contextual User Logon Authentication via Novelty Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication systems face security limitations due to the insecurity of username and password combinations and the vulnerability of multi-factor authentication methods, which can be circumvented by malicious actors.
Innovation Solution
A contextual-based user logon authentication method that builds user logon profiles using features like network address, geolocation, and user agent data, calculates novelty scores, and uses distance functions to assess the legitimacy of logon requests, combining this with failed logon attempt analysis to determine authentication outcomes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If username and password authentication is used, then ease of operation is improved, but security is worsened
Solution Approach 1:
The system performs preliminary actions by building user logon profiles and calculating novelty scores for logon features (IP address, user agent, geolocation) before the actual authentication occurs. This pre-analysis enables the system to detect anomalous patterns and trigger additional authentication factors only when necessary, rather than requiring all users to always provide multiple factors.
Solution Approach 2:
The system dynamically changes authentication parameters based on the calculated novelty score. When the novelty score indicates normal behavior, the system allows simple username/password authentication. When the novelty score indicates anomalous behavior, the system automatically increases authentication requirements by requesting additional factors, thus adapting security parameters to the specific logon context.
2Reliability
If multi-factor authentication is implemented, then security is improved, but device complexity is worsened
Solution Approach 1:
The system applies multi-factor authentication partially rather than universally. It calculates a novelty score based on logon features and only requests additional authentication factors when the novelty score exceeds a threshold, indicating potential security risks. This partial application of MFA reduces complexity for normal users while maintaining enhanced security for suspicious logon attempts.
Solution Approach 2:
The novelty score calculation acts as an intermediary between the simple username/password input and the complex multi-factor authentication system. This intermediary layer analyzes logon features (IP address, user agent, geolocation) and determines whether additional authentication factors are necessary, thus mediating between ease of use and security requirements without requiring full MFA complexity for all users.
3Reliability
If contextual analysis is performed on all logon attempts, then security is improved, but productivity is worsened
Solution Approach 1:
The system performs contextual analysis partially by focusing only on logon attempts that exhibit anomalous characteristics. It calculates novelty scores for key features (IP address, user agent, geolocation) and only triggers comprehensive security measures when the novelty score indicates potential threats. This selective analysis maintains security while minimizing the performance overhead associated with analyzing every single logon attempt in detail.
Data Source
AI summary
A method and system of authenticating a user logon builds a user logon profile with a plurality of user logon features gathered during at least one successful attempted user logon, determines a logon feature novelty score for each feature, receives a user logon request for authentication and extracts current user logon features, retrieves corresponding logon feature novelty scores, determines a first distance function score for the corresponding logon feature novelty scores of the current user logon features, builds a failed logon attempt database, determines a failed logon feature novelty score, extracts the failed logon feature novelty scores corresponding to current user logon features, determines a second distance function score for the corresponding failed logon feature novelty scores of the current user logon features, and determining to one of allow or deny the user logon request based on at least one of the first distance function score and the second distance function score.