Edge Network User Recognition Service for Account Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies, such as Akamai Bot Manager, primarily focus on mitigating bot-driven account takeover but fail to effectively address human-driven account takeover in content delivery networks (CDNs), leaving a significant gap in security measures.
Innovation Solution
Implementing a user recognition service within CDNs that constructs a true user profile based on multiple characteristics, including connection, session, and context data from successful logins, and calculates a true user score to differentiate authentic users from potential imposters, thereby enhancing security policies and bot detection systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If bot detection systems are used to mitigate credential abuse, then bot-driven account takeover is reduced, but human-driven account takeover cannot be detected
Solution Approach 1:
The user recognition service is designed to detect both bot-driven and human-driven account takeover attempts using a unified approach. It collects user recognition data from successful logins, constructs true user profiles, and calculates true user scores to identify imposters regardless of whether they are bots or humans with stolen credentials. This multi-functional system replaces the need for separate detection mechanisms for different attack types.
2Ease of operation
If traditional authentication based on user identifier and credentials is used, then login simplicity is maintained, but user recognition accuracy is insufficient
Solution Approach 1:
The system performs preliminary data collection during successful logins by gathering user recognition data including connection information, session data, and device characteristics. This data is used to construct true user profiles before authentication challenges occur. When an imposter attempts to login, the system can immediately compare their characteristics against the pre-built profile, enabling accurate detection without adding friction to the normal login flow.
3Measurement precision
If user recognition data is collected for each login attempt, then user profile accuracy improves, but system complexity increases
Solution Approach 1:
The user recognition service leverages existing authentication infrastructure and data collection mechanisms already present in the CDN environment. It reuses connection information, session data, and device characteristics that are naturally captured during the authentication process, rather than requiring separate data collection systems. This self-service approach minimizes additional system complexity while building accurate user profiles.
Data Source
AI summary
An account protection service to prevent user login or other protected endpoint request abuse. In one embodiment, the service collects user recognition data, preferably for each login attempt (e.g. data about the connection, session, and other relevant context), and it constructs a true user profile for each such user over time, preferably using the recognition data from successful logins. The profile evolves as additional recognition data is collected from successful logins. The profile is a model of what the user “looks like” to the system. For a subsequent login attempt, the system then calculates a true user score. This score represents how well the current user recognition data matches the model represented by the true user profile. The user recognition service is used to drive policy decisions and enforcement capabilities.