Identity Risk Scoring Using Dynamic Digital Fingerprints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional access credentials are vulnerable to attacks and require additional active authentication methods that impose administrative burdens and are not suitable for continuous validation or multiple account access scenarios, lacking a fully automated and customizable authentication process.
Innovation Solution
A computer-implemented method and system for quantifying identity risk using a dynamic digital fingerprint, combining access request data with external risk signals and user historical data to compute a likelihood score, allowing customizable weight settings based on business logic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional access credentials (username, password) are used for authentication, then ease of operation is improved, but reliability deteriorates due to vulnerability to attacks and credential theft
Solution Approach 1:
The patent introduces an authentication intermediary system that sits between the user and the resource. This intermediary continuously monitors authentication requests, analyzes risk signals from multiple sources, and dynamically adjusts authentication requirements. The intermediary processes authentication data through multiple layers including risk signal collection, analysis, and decision-making, providing enhanced security without requiring direct user intervention beyond the initial credential submission.
Solution Approach 2:
The system performs preliminary risk assessment and signal collection before final authentication decisions are made. Risk signals are continuously gathered and analyzed in advance, allowing the system to proactively identify potential threats and adjust authentication requirements before compromised credentials can be exploited. This preliminary action enables the system to be prepared for authentication challenges rather than reacting to them after occurrence.
2Reliability
If additional active authentication measures (MFA, biometrics, physical devices) are implemented, then reliability is improved, but device complexity and ease of operation worsen due to administrative burdens and user friction
Solution Approach 1:
The patent implements a dynamic authentication system that continuously adapts its requirements based on real-time risk assessment. Rather than applying static multi-factor authentication rules, the system adjusts authentication stringency dynamically based on analyzed risk signals, user behavior patterns, and contextual factors. This allows the system to apply stronger authentication measures only when necessary, reducing overall complexity while maintaining security.
Solution Approach 2:
The system changes authentication parameters dynamically based on risk levels. Instead of fixed authentication requirements, the system adjusts parameters such as required authentication factors, monitoring intensity, and decision thresholds based on continuous analysis of risk signals. This parameter adaptation allows the system to optimize between security and complexity based on current conditions rather than maintaining constant high complexity.
3Reliability
If predetermined MFA methods are used, then reliability is improved for specific scenarios, but adaptability deteriorates when facing different situations (e.g., stolen phone, various access scenarios)
Solution Approach 1:
The patent creates a universal authentication framework that can handle multiple authentication scenarios and methods through a single system. The intermediary architecture is designed to process various types of authentication requests (credentials, biometrics, device-based) and apply appropriate risk-based decisions universally. This multi-functional design allows the same system to adapt to different situations including stolen devices, various access scenarios, and different user contexts without requiring separate predetermined methods for each case.
4Reliability
If continuous validation and revalidation are implemented, then reliability is improved for detecting compromised credentials, but loss of time and productivity worsen
Solution Approach 1:
The patent implements continuous authentication monitoring that operates in the background without interrupting user workflows. The intermediary system continuously analyzes risk signals, monitors user behavior patterns, and assesses authentication requests in real-time without requiring periodic user interventions or breaking the authentication session. This continuous background operation detects compromised credentials promptly while avoiding the time losses associated with periodic revalidation prompts.
5Reliability
If active authentication measures requiring user interaction are used, then reliability is improved, but productivity deteriorates due to additional user steps and delays
Solution Approach 1:
The patent implements a self-service authentication system where the intermediary automatically performs risk assessment, signal analysis, and authentication decisions without requiring additional user actions. The system autonomously processes authentication requests, evaluates risk factors, and makes access decisions based on pre-configured policies and real-time data. This eliminates the need for users to manually complete additional authentication steps while maintaining enhanced verification, thereby preserving productivity.
Data Source
AI summary
Disclosed are a method and computer system for quantifying identity risk associated with an agent's request for access to online resources using valid credentials of an authorized user. The likelihood that the agent is the authorized user is computed using access request data, historical access data for the authorized user, and identity risk signal data collected from open source intelligence (OSINT) and other external identity risk data sources. The likelihood may be based on the distance between the current digital fingerprint, which in an embodiment is a high-dimensional vector comprising identity risk signal data, and a similar historical digital fingerprint for the authorized user, or, alternatively, the deviation from mean between a current weighted risk score comprising the identity risk signal data and the historical weighted risk scores for the authorized use.