Geolocation dependent variable authentication

• US 10,027,648 B2
• Filed: 07/28/2017
• Issued: 07/17/2018
• Est. Priority Date: 09/19/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bowman, Stephen D., Parker, Philip E.
• Primary Examiner(s): Shaifer Harriman, Dant B
• Application Number:
  US15/662,316
• Publication Number:
  US 20180083943A1
• Time in Patent Office: 354 Days
• Field of Search: 726 7
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal

Abstract

In an approach to variable authentication, one or more computer processors receive a request to access secure data from a computing device. The one or more computer processors receive geolocation data associated with the computing device. The one or more computer processors compare the geolocation data to authentication parameters associated with the computing device to determine if the geolocation data falls within the authentication parameters. The one or more computer processors determine whether the geolocation data falls within the authentication parameters. If the geolocation data does not, the one or more computer processors send a request for authentication from the computing device via an authentication method wherein the authentication method corresponds to an identified location and time of the computing device associated with the request to access secure data and a time associated with the request to access secure data. The one or more computer processors receive the authentication.

Claims

1. A method for variable authentication, the method comprising:

receiving, by one or more microprocessors, a request to access secure data from a computing device;

identifying, by the one or more microprocessors, data associated with the request to access the secure data from the computing device, wherein the identified data includes geographical coordinates of the computing device representing the geographical coordinates of the computing device upon making the request to access the secure data and a time stamp corresponding to a time at which the request to access the secure data was made;

identifying, by the one or more microprocessors, geographic coordinates corresponding to a location that is classified as an allowed location;

identifying, by the one or more microprocessors, a first threshold radius from the allowed location, a second threshold radius from the allowed location, and a third threshold radius from the allowed location, wherein;

the second threshold radius is greater than the first threshold radius and the third threshold radius is greater than the second threshold radius; and

the first threshold radius is associated with a primary authentication zone, the second threshold radius is associated with a secondary authentication zone, and the third threshold radius is associated with a tertiary authentication zone, wherein;

the primary authentication zone is associated with a primary authentication method including a first password type having a first minimum password length, the secondary authentication zone is associated with a secondary authentication method including a second password type having a second minimum password length, and the tertiary authentication zone is associated with a tertiary authentication method including a third password type having a third minimum password length, wherein the second minimum password length is longer the first minimum password length and the third minimum password length is longer than the second minimum password length; and

in response to determining, by the one or more microprocessors, that a distance between the geographical coordinates of the computing device and the allowed location is less than the third threshold radius;

requesting, by the one or more microprocessors, an authentication in accordance with the secondary authentication method;

receiving, by the one or more microprocessors, the authentication;

in response to determining, by the one or more microprocessors, that the authenticating meets pre-defined criteria associated with the secondary authentication method, authorizing, by the one or more computer processors, the request to access secure data;

identifying, by the one or more microprocessors, a count of requests to access secure data associated with the geographical coordinates of the computer devices; and

in response to determining, by the one or more microprocessors, that the count of requests to access the secure data exceeds a threshold count, classifying the geographical coordinates of the computer device as an allowed location.