Dynamic Authentication Tiering for Session Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication-based applications face challenges in balancing user experience with security, as additional authentication steps (AAS) can decrease user engagement and increase costs when retrofitted to delay AAS challenges, while short session expiry for security may lead to poor user experience due to unintended logouts.
Innovation Solution
Implementing a dynamically tiered authentication system using special session identifiers to defer AAS for restricted actions, allowing authentication tiers to be automatically downgraded based on client activity, thereby reducing the need for frequent re-authentication and maintaining security without logging users out unnecessarily.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If additional authentication steps (AAS) are required before allowing user access to restricted actions, then application security is improved, but user engagement and conversion rates deteriorate
Solution Approach 1:
The patent implements dynamic authentication tiering where the authentication level required is not fixed but adapts based on the specific restricted action being accessed. The system dynamically determines whether AAS is needed by evaluating the risk level of the requested action, allowing low-risk actions to proceed with standard authentication while reserving AAS for high-risk actions, thus balancing security with user engagement
2Productivity
If AAS requirements are waived to improve user experience, then user engagement improves, but application security deteriorates
Solution Approach 1:
The patent applies local quality by differentiating authentication requirements based on the specific restricted action being accessed. Instead of uniformly waiving or requiring AAS across all actions, the system evaluates each restricted action individually and applies AAS only where necessary based on the action's risk profile, data sensitivity, and user context, thus maintaining security while improving user experience for low-risk operations
3Reliability
If short session expiry is implemented to maintain security, then application security is improved, but user experience deteriorates due to unintended logouts
Solution Approach 1:
The patent implements dynamic session management where session expiry timing is not fixed but adapts based on real-time risk assessment. The system continuously evaluates user behavior, device trustworthiness, and action patterns during the session, extending session duration for trusted users performing routine actions while maintaining shorter effective sessions for untrusted contexts, thus balancing security with user convenience
Data Source
AI summary
Techniques are described herein for using special session identifiers to defer additional authentication steps (AAS) for at least some restricted application actions. A client session is associated with a special session identifier that is mapped to an authentication tier (AT) achieved for the session based on the satisfied authentication steps. Web servers that are enabled for AAS deferral include context information, which identifies a requested action, with session verification requests to an authentication service. The authentication service determines that AAS is required to perform an action when (a) the AT associated with the action is a higher-security tier than the AT associated with the session, or (b) the session is associated with an AT that is lower than the highest-security AT and there is no context information accompanying the request for session validation, in which case the authentication service assumes that the highest-security AT is required to perform the request.