Data sensitivity based authentication and authorization

• US 10,581,924 B2
• Filed: 07/19/2018
• Issued: 03/03/2020
• Est. Priority Date: 06/12/2013
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Gaddam, Ajit, Aissi, Selim, Kgil, Taeho
• Primary Examiner(s): Callahan, Paul E
• Application Number:
  US16/040,340
• Publication Number:
  US 20180352005A1
• Time in Patent Office: 593 Days
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

Systems, devices, apparatuses, and methods of the present invention distribute authentication across multiple users. A data sensitivity model can define the sensitivity of different types of data. When an application requests access to a particular data item, the sensitivity of that data item can be determined. If the data item has a low sensitivity, access to the data item can be granted. If the data item has a high sensitivity, the system can request authentication before granting access to the data item.

Claims

1. A method comprising:

receiving, by a mobile device, a request from a user to access data for an application executing on the mobile device;

dynamically determining, by the mobile device, a data sensitivity level associated with the data for the application that is requested, wherein the dynamically determining the data sensitivity level associated with the data comprises;

analyzing, by an access decision engine of the mobile device, at least one of access control data for the requested data, data sensitivity level definitions for the requested, or event log information for the requested data, wherein the event log information comprises a history of data access attempts of the data that is requested;

monitoring a plurality of requests to access the data; and

reclassifying the data sensitivity level of the data based on the plurality of requests to access the data;

determining, by the mobile device, an authentication level associated the user requesting the data;

determining, by the mobile device, whether the authentication level of the user is in accordance with the data sensitivity level associated with the data; and

in response to determining whether the authentication level of the user satisfies the data sensitivity level associated with the data, granting or denying access to the requested data.

2. The method according to claim 1, wherein the data sensitivity level definitions define a requirement and a restriction corresponding to the data sensitivity level of the requested data.

3. The method according to claim 1, wherein the dynamically determining the data sensitivity level further comprises

after reclassifying the data sensitivity level of the data, modifying an access requirement for accessing the data.

4. The method according to claim 1, wherein the access that is granted for the requested data comprises a time-limited restriction or event-limited restriction for accessing the data.

5. The method according to claim 1, further comprising determining whether the data that is requested has been previously requested, in response to determining that the data has not been previously requested, determining whether the request to access the data is malicious.

6. A mobile device comprising:

one or more processors; and

a memory communicatively coupled to the one or more processor, wherein the one or more processors are configured to execute instructions to perform operations comprising;

receiving a request from a user to access data for an application executing on the mobile device;

dynamically determining a data sensitivity level associated with the data for the application that is requested, wherein the dynamically determining the data sensitivity level associated with the data comprises;

analyzing at least one of access control data for the requested data, data sensitivity level definitions for the requested, or event log information for the requested data, wherein the event log information comprises a history of data access attempts of the data that is requested;

monitoring a plurality of requests to access the data; and

reclassifying the data sensitivity level of the data based on the plurality of requests to access the data;

determining an authentication level associated the user requesting the data;

determining whether the authentication level of the user is in accordance with the data sensitivity level associated with the data; and

in response to determining whether the authentication level of the user satisfies the data sensitivity level associated with the data, granting or denying access to the requested data.

7. The mobile device according to claim 6, wherein the data sensitivity level definitions define a requirement and a restriction corresponding to the data sensitivity level of the requested data.

8. The mobile device according to claim 6, wherein the dynamically determining the data sensitivity level further comprises

after reclassifying the data sensitivity level of the data, modifying an access requirement for accessing the data.