Access Prediction Service for Explainable Step-Up Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing step-up authentication mechanisms burden legitimate users with unnecessary challenges, causing frustration and inefficiency, while still being necessary to prevent security breaches from malicious actors and bots.
Innovation Solution
A system that conditionally invokes step-up authentication based on anomalous authentication requests during an authentication journey, using machine learning models and heuristics to detect anomalies and provide explainable risk scores, reducing false positives and minimizing user burden.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If step-up authentication is invoked for all anomalous requests, then network security is improved, but user experience deteriorates due to unnecessary challenges for legitimate users
Solution Approach 1:
The system applies different authentication requirements to different users based on their specific risk profiles. Legitimate users with approved anomaly patterns experience no additional friction, while malicious actors face step-up authentication. This localized differentiation resolves the contradiction by making security measures context-specific rather than universal.
Solution Approach 2:
The system dynamically changes the authentication parameter (whether to invoke step-up) based on the risk score and anomaly explanation. When the risk score is low and the anomaly is approved, the authentication parameter remains unchanged. When the risk score is high and the anomaly is unapproved, step-up authentication is invoked. This dynamic parameter adjustment resolves the contradiction between security and user experience.
2Reliability
If step-up authentication is invoked frequently, then security against malicious actors is improved, but time efficiency deteriorates due to extra authentication steps
Solution Approach 1:
The system applies step-up authentication partially - only when necessary based on risk assessment. Instead of applying full step-up authentication to all anomalous requests, it selectively applies it only to high-risk cases where the anomaly explanation does not match approved patterns. This partial action maintains security while minimizing time loss for legitimate users.
Solution Approach 2:
The system uses feedback from anomaly detection and risk scoring to dynamically determine whether step-up authentication is needed. The feedback loop continuously monitors authentication patterns, compares them against approved anomalies, and adjusts authentication requirements accordingly. This feedback mechanism ensures step-up is invoked only when necessary, balancing security with time efficiency.
3Measurement precision
If anomaly detection sensitivity is increased, then detection of malicious requests is improved, but false positives increase burdening legitimate users
Solution Approach 1:
The system introduces an intermediary layer - the anomaly explanation matching mechanism - between anomaly detection and step-up authentication invocation. Instead of directly invoking step-up based on anomaly detection, the system first checks whether the anomaly explanation matches approved patterns. This intermediary filtering step reduces false positives while maintaining detection sensitivity, resolving the contradiction between detection accuracy and user burden.
Solution Approach 2:
The system performs preliminary action by pre-approving certain anomaly patterns before they trigger step-up authentication. Common legitimate anomalies (such as telework locations or scheduled travel) are pre-approved and stored as acceptable patterns. When an anomaly occurs, the system first checks against these pre-approved patterns before invoking step-up. This preliminary preparation reduces false positives while maintaining sensitive detection of truly malicious activity.
Data Source
AI summary
A process, system and medium for detecting anomalous authentication requests to a protected resource during an authentication journey, in order to regulate step-up authentication are described. The process includes obtaining request features from the authentication request that triggered the authentication journey. The process includes processing, by an ensemble of Machine Learning (ML) models and a set of rule-based heuristics, a set of features based on the request features, the set of features associated with a userID. The process includes deriving risk sub-scores for each ML model and each heuristic. The process includes deriving a risk score based on the risk sub-scores. The process includes determining that the risk score exceeds an explanation-triggering threshold. The process includes providing, to a node in the authentication journey, the risk score with an explanation of the risk score. The system and medium are configured to execute the process, and configured to provide the explanation.