Dynamic User Authentication via Cross-Node ML Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current user authentication methods in computing environments are inadequate in preventing malicious activities by insiders, as they rely on static access controls and fail to differentiate between authorized and unauthorized user behavior, especially in cases of lateral movement within the network.
Innovation Solution
The implementation of a system that uses machine learning models to authenticate users by characterizing their interactions across multiple computing nodes, calculating authentication scores based on user profiles and behavior patterns, and initiating actions such as connection severance or re-authentication when thresholds are exceeded, while transmitting scores between nodes for centralized processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static role-based access control mechanisms are used to restrict user activities and access, then access security is improved, but the system fails to detect and prevent malicious activities by authorized users performing unusual actions
Solution Approach 1:
The patent transforms static role-based access control into a dynamic system that continuously monitors user behavior and adapts authentication requirements in real-time. Machine learning models analyze user interactions with computing nodes and dynamically adjust authentication scores, enabling the system to respond to evolving threats while maintaining security for legitimate users.
Solution Approach 2:
The system implements continuous feedback loops where user behavior is monitored, authentication scores are calculated and updated, and actions are taken based on threshold evaluations. This closed-loop feedback mechanism enables the system to learn from ongoing user interactions and improve its ability to distinguish between legitimate and malicious activities over time.
2Measurement precision
If machine learning models are deployed to dynamically authenticate users across multiple computing nodes, then authentication precision is improved, but system complexity increases due to distributed model execution and score transmission
Solution Approach 1:
The patent divides the authentication system into distributed components, with machine learning models executed independently on each computing node. Each node calculates local authentication scores based on observed user interactions, and these scores are transmitted to a central server for aggregation. This segmentation enables parallel processing and reduces the computational burden on any single component.
Solution Approach 2:
The machine learning models are designed to be universal and can be deployed across multiple different computing nodes regardless of their specific functions or types. The same authentication framework and scoring mechanisms work consistently across diverse systems, enabling centralized policy enforcement while maintaining local adaptability.
3Reliability
If continuous monitoring of user traversal across computing nodes is implemented, then detection of lateral movement is improved, but computational resources and processing time are increased
Solution Approach 1:
The system implements partial monitoring by focusing computational resources on evaluating specific authentication scores at each computing node rather than analyzing all user activities in detail. Machine learning models process only the most relevant behavioral features and transmit condensed authentication scores, reducing overall computational overhead while maintaining effective detection capability.
Data Source
AI summary
An identity of a user on a first computing node of a plurality of nodes within a computing environment is authenticated. A first authentication score for the user is calculated at the first computing node using at least one machine learning model. The first authentication score characterize interactions of the user with the first computing node. Subsequent to such authentication, traversal of the user from the first computing node to other computing nodes among the plurality of computing nodes are monitored. An authentication score characterizing interactions of the user with the corresponding computing node are calculated at each of the nodes using respective machine learning models executing on such nodes The respective machine learning models use, as an attribute, an authentication score calculated at a previously traversed computing node. Thereafter, an action is initiated at one of the computing nodes based on the calculated authentication scores.