Risk-Based MFA Using Network Baselines and Verification Scores
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing multi-factor authentication systems rely heavily on a single method of verification, which can be compromised, leading to potential security breaches, particularly when email accounts are compromised.
Innovation Solution
A risk-based multi-factor authentication system that dynamically determines a verification score based on network risk factors, using a combination of verification methods including biometrics, trusted/untrusted parties, and device information to ensure secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single verification method is used for authentication, then the system is simple to operate, but the security reliability is compromised when that method is compromised
Solution Approach 1:
The authentication system is segmented into multiple independent verification methods (email verification, device fingerprinting, behavioral biometrics, trusted device verification). Each method operates independently and contributes a portion of the required verification score, so compromise of one method does not affect the others. This segmentation resolves the contradiction by distributing security across multiple channels while maintaining operational simplicity through automated score aggregation.
Solution Approach 2:
The system uses a composite authentication approach combining multiple verification methods into a unified score. Rather than relying on a single verification mechanism, the system aggregates results from email verification, device fingerprinting, behavioral biometrics, and trusted device status to create a composite security assessment. This composite approach maintains ease of operation while significantly improving reliability.
2Reliability
If multiple verification methods are used to improve security, then the reliability increases, but the device complexity and user burden increase
Solution Approach 1:
The system dynamically adjusts the number and type of verification methods required based on the calculated risk score. When connection risk is low (e.g., trusted device, normal behavior patterns), fewer verification methods are required. When risk is high (e.g., unusual location, anomalous behavior), the system automatically increases verification requirements. This dynamic approach improves reliability when needed while reducing complexity during normal operations.
Solution Approach 2:
The system performs automated risk assessment and verification score calculation without requiring user intervention to select or configure verification methods. The server automatically evaluates connection parameters, device information, and behavioral patterns to determine the appropriate verification requirements. This self-service approach manages system complexity internally while presenting a simple interface to users.
3Reliability
If verification requirements are increased for all connections, then security reliability improves, but the productivity and user experience deteriorate
Solution Approach 1:
The system applies different verification requirements to different connection scenarios based on local risk characteristics. Connections from trusted devices with normal behavior patterns require minimal verification (maintaining productivity), while connections exhibiting risky characteristics trigger enhanced verification (improving reliability where needed). This localized approach ensures security is strengthened precisely where threats exist without broadly impacting productivity.
Solution Approach 2:
The system changes the verification score threshold parameter dynamically based on risk assessment. For low-risk connections, the required verification score is lower, allowing faster access. For high-risk connections, the threshold increases, requiring more verification evidence. This parameter adjustment resolves the contradiction by adapting security stringency to the specific context of each connection attempt.
Data Source
AI summary
A system for risk-based multi-factor authentication having a multi-dimensional time series data server configured to monitor and record a network's traffic data and to serve the traffic data to other modules and a directed computation graph module configured to receive network traffic data from the multi-dimensional time series data server, determine a network traffic baseline from the network traffic data, and determine a verification score needed before granting access based at least in part by the network traffic baseline. A plurality of verification methods build up a user's verification score to required level to gain access.