Federating devices to improve user experience with adaptive security

• US 10,681,031 B2
• Filed: 11/02/2015
• Issued: 06/09/2020
• Est. Priority Date: 11/02/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Sreedhar, Pranam C., Wardrop, Patrick R.
• Primary Examiner(s): Gracia, Gary S
• Application Number:
  US14/930,010
• Publication Number:
  US 20170126662A1
• Time in Patent Office: 1,681 Days
• Field of Search: 726 8, 726 9, 713168
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

A method, system and computer-usable medium for performing an adaptive security operation comprising: performing an authentication operation via a first device, the authentication operation analyzing an obligation performed by a first user; establishing access to a protected resource by the first device based upon the obligation performed by the first user; generating an attribute list comprising at least one attribute of the first device; analyzing a second device to determine whether the second device comprises an attribute corresponding to the at least one attribute of the first device; and, allowing access to the protected resource by the second device when the second device comprises the attribute corresponding to the at least one attribute of the first device.

Claims

1. A computer-implemented method for performing an adaptive security operation comprising:

performing an authentication operation via a first device, the authentication operation analyzing an obligation performed by a first user, the obligation comprising a two factor authentication;

establishing access to a protected resource by the first device based upon the obligation performed by the first user;

generating an attribute list comprising at least one attribute of the first device, the at least one attribute enabling identification of similar devices from a usage perspective;

analyzing a second device to determine whether the second device comprises an attribute corresponding to the at least one attribute of the first device, the attribute corresponding to the at least one attribute of the first device indicating that the second device is similar to the first device from a usage perspective, the attribute list being dynamically extended when an attribute is the same across the first and second devices, the attribute being the same across the first and second devices indicating a common pattern across the first and second devices, the common pattern representing a similarity of the first and second devices from a usage perspective;

allowing access to the protected resource by the second device when the second device comprises the attribute corresponding to the at least one attribute of the first device; and

,

requiring another two factor authentication based upon a dynamic risk policy, the another two factor authentication being performed before allowing the second device access to the protected resource when the second device does not comprise the attribute corresponding to the at least one attribute of the first device, the second device corresponding to a subset of devices; and

wherein

when the first and second devices no longer have the common pattern, a corresponding attribute is removed from the attribute list.

2. The method of claim 1, further comprising:

calculating a risk score based on the first device and the second device belonging to the user, the risk score being applied when determining whether the another two factor authentication should be triggered for the second device.

3. The method of claim 1, further comprising:

receiving a request for access to the protected resource from the first user via a third device;

determining whether the first and third devices are associated with the first user; and

,

allowing access to the protected resource by the third device when the third device is associated with the first user.

4. The method of claim 1, wherein:

the second device is associated with a second user; and

further comprising

determining whether the first device and second device correspond to a federation; and

,

allowing the second user access to the protected resource when the first device and the second device correspond to the federation.

5. The method of claim 4, wherein:

the first user and the second user are included within a set of users, each of the set of users having a respective one of a first set of devices; and

further comprising;

performing an authentication process is performed on a first set of users each using a respective one of the first set of devices for a protected resource, wherein the authentication process determines whether a first factor is present;

receiving a request for access to the protected resource from a subset of the first set of users in a new user context;

evaluating the new user context according a security policy based upon the first factor;

requesting a subset of the set of users to input another two factor authentication via respective devices of the first set of devices; and

once a subset of users passes a threshold, allowing access to the network resource to other users belonging to the first set of users without requiring input of the another two factor authentication.

6. The method of claim 1, wherein:

the attribute list reflects a user context; and

,

the user context includes an internet protocol (IP) subnet address and geographic location.

7. A system comprising:

a processor;

a data bus coupled to the processor; and

a tangible computer-usable medium embodying computer program code, the computer-usable medium being coupled to the data bus, the computer program code used for performing an adaptive security operation and comprising instructions executable by the processor and configured for;

performing an authentication operation via a first device, the authentication operation analyzing an obligation performed by a first user, the obligation comprising a two factor authentication;

establishing access to a protected resource by the first device based upon the obligation performed by the first user;

generating an attribute list comprising at least one attribute of the first device, the at least one attribute enabling identification of similar devices from a usage perspective;

analyzing a second device to determine whether the second device comprises an attribute corresponding to the at least one attribute of the first device, the attribute corresponding to the at least one attribute of the first device indicating that the second device is similar to the first device from a usage perspective, the attribute list being dynamically extended when an attribute is the same across the first and second devices, the attribute being the same across the first and second devices indicating a common pattern across the first and second devices, the common pattern representing a similarity of the first and second devices from a usage perspective;

allowing access to the protected resource by the second device when the second device comprises the attribute corresponding to the at least one attribute of the first device; and

,

requiring another two factor authentication based upon a dynamic risk policy, the another two factor authentication being performed before allowing the second device access to the protected resource when the second device does not comprise the attribute corresponding to the at least one attribute of the first device, the second device corresponding to a subset of devices; and

wherein

when the first and second devices no longer have the common pattern, a corresponding attribute is removed from the attribute list.

8. The system of claim 7, wherein the instructions executable by the processor are further configured for:

calculating a risk score based on the first device and the second device belonging to the user, the risk score being applied when determining whether the another two factor authentication should be triggered for the second device.

9. The system of claim 7, wherein the instructions executable by the processor are further configured for:

receiving a request for access to the protected resource from the first user via a third device;

determining whether the first and third devices are associated with the first user; and

,

allowing access to the protected resource by the third device when the third device is associated with the first user.

10. The system of claim 7, wherein:

the second device is associated with a second user; and

the instructions executable by the processor are further configured for;

determining whether the first device and second device correspond to a federation; and

,

allowing the second user access to the protected resource when the first device and the second device correspond to the federation.

11. The system of claim 10, wherein:

the first user and the second user are included within a set of users, each of the set of users having a respective one of a first set of devices; and

the instructions executable by the processor are further configured for;

performing an authentication process is performed on a first set of users each using a respective one of the first set of devices for a protected resource, wherein the authentication process determines whether a first factor is present;

receiving a request for access to the protected resource from a subset of the first set of users in a new user context;

evaluating the new user context according a security policy based upon the first factor;

requesting a subset of the set of users to input another two factor authentication via respective devices of the first set of devices; and

once a subset of users passes a threshold, allowing access to the network resource to other users belonging to the first set of users without requiring input of the another two factor authentication.

12. The system of claim 7, wherein:

the attribute list reflects a user context; and

,

the user context includes an internet protocol (IP) subnet address and geographic location.

13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

performing an authentication operation via a first device, the authentication operation analyzing an obligation performed by a first user, the obligation comprising a two factor authentication;

establishing access to a protected resource by the first device based upon the obligation performed by the first user;

generating an attribute list comprising at least one attribute of the first device, the at least one attribute enabling identification of similar devices from a usage perspective;

analyzing a second device to determine whether the second device comprises an attribute corresponding to the at least one attribute of the first device, the attribute corresponding to the at least one attribute of the first device indicating that the second device is similar to the first device from a usage perspective, the attribute list being dynamically extended when an attribute is the same across the first and second devices, the attribute being the same across the first and second devices indicating a common pattern across the first and second devices, the common pattern representing a similarity of the first and second devices from a usage perspective;

allowing access to the protected resource by the second device when the second device comprises the attribute corresponding to the at least one attribute of the first device; and

,

requiring another two factor authentication based upon a dynamic risk policy, the another two factor authentication being performed before allowing the second device access to the protected resource when the second device does not comprise the attribute corresponding to the at least one attribute of the first device, the second device corresponding to a subset of devices; and

wherein

when the first and second devices no longer have the common pattern, a corresponding attribute is removed from the attribute list.

14. A non-transitory, computer-readable storage medium of claim 13, wherein the computer executable instructions are further configured for:

calculating a risk score based on the first device and the second device belonging to the user, the risk score being applied when determining whether the another two factor authentication should be triggered for the second device.

15. A non-transitory, computer-readable storage medium of claim 13, wherein the computer executable instructions are further configured for:

receiving a request for access to the protected resource from the first user via a third device;

determining whether the first and third devices are associated with the first user; and

,

allowing access to the protected resource by the third device when the third device is associated with the first user.

16. A non-transitory, computer-readable storage medium of claim 13, wherein:

the second device is associated with a second user; and

determining whether the first device and second device correspond to a federation; and

,

allowing the second user access to the protected resource when the first device and the second device correspond to the federation.

17. A non-transitory, computer-readable storage medium of claim 16, wherein:

the first user and the second user are included within a set of users, each of the set of users having a respective one of a first set of devices; and

the computer executable instructions are further configured for;

performing an authentication process is performed on a first set of users each using a respective one of the first set of devices for a protected resource, wherein the authentication process determines whether a first factor is present;

receiving a request for access to the protected resource from a subset of the first set of users in a new user context;

evaluating the new user context according a security policy based upon the first factor;

requesting a subset of the set of users to input another two factor authentication via respective devices of the first set of devices; and

once a subset of users passes a threshold, allowing access to the network resource to other users belonging to the first set of users without requiring input of the another two factor authentication.

18. A non-transitory, computer-readable storage medium of claim 13, wherein:

the attribute list reflects a user context; and

,

the user context includes an internet protocol (IP) subnet address and geographic location.

19. A non-transitory, computer-readable storage medium of claim 13, wherein the computer executable instructions are deployable to a client system from a server system at a remote location.

20. A non-transitory, computer-readable storage medium of claim 13, wherein the computer executable instructions are provided by a service provider to a user on an on-demand basis.