Risk-Based Authentication With Variable Proof-of-Work Challenges
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current login systems face challenges in effectively differentiating between legitimate and illegitimate access attempts, often impacting legitimate users with restrictive measures such as CAPTCHA, and fail to adapt the difficulty of proof-of-work challenges to the specific risk level of an access request.
Innovation Solution
A risk-based authentication service that uses a variable-strength proof-of-work challenge, adjustable based on the riskiness of the access attempt, by publishing a risk function that scores the access attempt and adjusts the complexity of the proof-of-work challenge accordingly, allowing legitimate users to access resources while deterring unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a fixed-strength proof-of-work challenge is used for all login attempts, then the security against brute-force attacks is improved, but the user experience and productivity for legitimate users deteriorates due to unnecessary delays
Solution Approach 1:
The patent applies dynamics by making the proof-of-work challenge strength variable rather than fixed. The challenge strength dynamically adjusts based on the risk assessment of each login attempt, using factors such as device reputation, location, and authentication history. This allows the system to maintain strong security for high-risk attempts while enabling fast access for low-risk legitimate users, resolving the contradiction between security and productivity.
Solution Approach 2:
The patent changes the parameter of proof-of-work challenge strength based on risk assessment results. By modifying this critical parameter dynamically, the system can adapt the authentication difficulty to match the actual security risk level, allowing legitimate users to experience minimal delay while maintaining robust security protections against attackers.
2Ease of operation
If a variable-strength proof-of-work challenge is used, then the user experience for legitimate users is improved, but the complexity of the authentication system increases
Solution Approach 1:
The patent introduces a risk assessment service as an intermediary component that sits between the user authentication module and the proof-of-work challenge generation. This intermediary evaluates user behavior patterns, device fingerprints, and authentication history to determine challenge strength, thereby managing system complexity through modular design while improving user experience through adaptive authentication.
Solution Approach 2:
The authentication system is segmented into distinct functional modules: a risk assessment service that evaluates authentication requests, a challenge generation service that creates proof-of-work challenges based on risk level, and an authentication verification service. This segmentation allows each module to be optimized independently, managing overall system complexity while enabling variable-strength authentication.
3Reliability
If the authentication difficulty is increased to deter unauthorized access, then the security against unauthorized access is improved, but the time required for authentication increases
Solution Approach 1:
The patent makes authentication difficulty dynamic by adjusting proof-of-work challenge strength based on real-time risk assessment. The system continuously monitors authentication patterns and device behavior to determine the appropriate challenge level, ensuring that high-time-cost attacks are deterred while legitimate users experience minimal authentication time delays.
Solution Approach 2:
The system implements feedback mechanisms where authentication results and user behavior patterns are continuously monitored and fed back into the risk assessment service. This feedback loop enables the system to learn from past authentication events and adjust future challenge strengths accordingly, optimizing the balance between security and authentication speed.
Data Source
AI summary
A method for authenticating a request for access to resources is described. A request for access to a resource is received from a user, and the user accesses a proof-of-work challenge. An adjustment factor associated with the user is determined. The adjustment factor may be generated as a function of a password associated with the user and the requested resource. The proof-of-work challenge may have a complexity that is determined based on the adjustment factor. A selected password and a solution to the proof-of-work challenge are received from the user. It is determined whether the received solution is correct based on the determined adjustment factor.