Common data format in knowledge-based authentication

• US 8,776,195 B1
• Filed: 03/30/2012
• Issued: 07/08/2014
• Est. Priority Date: 03/30/2012
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Dotan, Yedidya, Avni, Ayelet, Knauss, Bryan, Yakoel, Erez
• Primary Examiner(s): Zecher, Cordelia
• Assistant Examiner(s): LAKHIA, VIRAL S
• Application Number:
  US13/434,993
• Time in Patent Office: 830 Days
• Field of Search: 726 5- 6, 726/3, 726/26, 726/2, 713180-182, 713/185, 713/171, 713/166, 705/325, 707/705, 707/205
• US Class Current: 726/6
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response

Abstract

An improved technique involves converting facts from multiple fact sources to a common data format. Along these lines, for each fact source having a source-specific format, a KBA system provides an adaptor that converts incoming facts in the source-specific format to the common data format prior to generating questions. The KBA system stores the facts in the common format in a database for subsequent access. In response to an authorization request, the KBA system then builds questions based on the facts from multiple sources in the common data format stored in the database.

Claims

1. In a knowledge-based authentication (KBA) system, a method of providing a set of questions, the method comprising:

receiving facts from multiple fact sources, each fact source being associated with a distinct data format;

providing a set of adaptors, each adaptor being constructed and arranged to convert facts in a distinct data format with which a fact source is associated to a common data format; and

generating the set of questions from the facts in the common data format, the set of questions being configured to elicit, from a user, a corresponding set of responses from which a KBA result is produced;

wherein the method further comprises;

storing the facts in a database when the facts have been converted to the common data format, the database including a set of entries, each entry of the set of entries being associated with a fact and including at least one identifier associated with a customer; and

wherein generating the set of questions from the facts in the common data format includes;

producing a ranking value associated with a candidate question, the ranking value being indicative of a likelihood that a particular response to the question implies that the user is the customer;

including the candidate question in the set of questions when the ranking value is greater than a threshold value; and

excluding the candidate question from the set of questions when the ranking value is less than a threshold value.

2. A method according to claim 1,

wherein generating the set of questions from the facts in the common data format further includes:

receiving a request to authenticate the customer; and

performing a lookup operation on the database in response to the request, the lookup operation being configured to locate entries of the set of entries that include the identifier associated with the customer.

3. A method according to claim 2,

wherein each fact source is further associated with a fact category of a set of fact categories,

wherein each entry of the set of entries of the database includes the fact category of the fact source from which the with which the entry is associated was received,

wherein each question of the set of questions is associated with a question type of a set of question types,

wherein performing the lookup operation on the database in response to the request includes:

collecting fact categories of the entries of the set of entries including the identifier associated with the customer, and

wherein generating the set of questions from the facts in the common data format further includes;

for each question of the set of questions, selecting a question type of the set of question types based on the collected fact categories.

4. A method according to claim 2,

wherein the customer belongs to an organization;

wherein performing the lookup operation on the database in response to the request further includes;

collecting, from the entries of the set of entries including the user identifier associated with the customer, identifiers associated with other customers;

verifying which of the other customers belong to the organization; and

forming a subset of entries, each entry of the subset of entries having identifiers associated with customers belonging to the organization, and

wherein generating the set of questions from the facts in the common data format further includes;

producing the set of questions from the facts with which the subset of entries is associated.

5. A method as in claim 4,

wherein producing the set of questions from the facts with which the subset of entries is associated includes:

excluding from the set of questions those entries of the set of entries having identifiers associated with customers belonging to a different organization.

6. A method according to claim 1,

wherein a fact source either resides at a remote site or is local to the KBA system, and

wherein providing the set of adaptors includes:

when the fact source resides at a remote site, initiating a conversion of the facts from the fact source at the remote site; and

when the fact source is local to the KBA system, initiating the conversion of the facts from the fact source at the KBA system.

7. A method as in claim 1,

wherein excluding the candidate question from the set of questions when the ranking value is less than the threshold value includes:

placing the candidate question into a training pool of questions, each question from the training pool of questions being used to train a risk engine configured to produce ranking values associated with questions.

8. A knowledge-based authentication (KBA) system constructed and arranged to provide a set of questions, comprising:

a set of adaptors, each adaptor of the set of adaptors including;

a network interface;

memory; and

a controller including controlling circuitry couple to the memory, the controlling circuitry being constructed and arranged to;

receive facts from multiple fact sources, each fact source being associated with a distinct data format; and

convert the facts in a distinct data format with which a fact source is associated to a common data format, and

a database server connected to each adaptor of the set of adaptors, the database server including;

a network interface;

memory; and

a controller including controlling circuitry couple to the memory, the controlling circuitry being constructed and arranged to;

generate the set of questions from the facts in the common data format, the set of questions being configured to elicit, from a user, a corresponding set of responses from which a KBA result is produced;

wherein the database server further includes;

a storage device, and

wherein the controlling circuitry of the database server is further constructed and arranged to;

store the facts in a database stored on the storage device of the database server when the facts have been converted to the common data format, the database including a set of entries, each entry of the set of entries being associated with a fact and including at least one identifier associated with a customer; and

wherein generating the set of questions from the facts in the common data format includes;

producing a ranking value associated with a candidate question, the ranking value being indicative of a likelihood that a particular response to the question implies that the user is the customer;

including the candidate question in the set of questions when the ranking value is greater than a threshold value; and

excluding the candidate question from the set of questions when the ranking value is less than a threshold value.

9. A system according to claim 8,

wherein generating the set of questions from the facts in the common data format further includes:

receiving a request to authenticate the customer; and

performing a lookup operation on the database in response to the request, the lookup operation being configured to locate entries of the set of entries that include the identifier associated with the customer.

10. A system according to claim 9,

wherein each fact source is further associated with a fact category of a set of fact categories,

wherein each entry of the set of entries of the database includes the fact category of the fact source from which the with which the entry is associated was received,

wherein each question of the set of questions is associated with a question type of a set of question types,

wherein performing the lookup operation on the database in response to the request includes:

collecting fact categories of the entries of the set of entries including the identifier associated with the customer, and

wherein generating the set of questions from the facts in the common data format further includes;

for each question of the set of questions, selecting a question type of the set of question types based on the collected fact categories.

11. A system according to claim 9,

wherein the customer belongs to an organization;

wherein performing the lookup operation on the database in response to the request further includes;

collecting, from the entries of the set of entries including the user identifier associated with the customer, identifiers associated with other customers;

verifying which of the other customers belong to the organization; and

forming a subset of entries, each entry of the subset of entries having identifiers associated with customers belonging to the organization, and

wherein generating the set of questions from the facts in the common data format further includes;

producing the set of questions from the facts with which the subset of entries is associated.

12. A system according to claim 8,

wherein a fact source either resides at a remote site or is local to the KBA system, and

wherein converting the facts in the distinct data format with which the fact source is associated to the common data format includes:

when the fact source resides at a remote site, initiating a conversion of the facts from the fact source at the remote site; and

when the fact source is local to the KBA system, initiating the conversion of the facts from the fact source at the KBA system.

13. A computer program product having a non-transitory, computer-readable storage medium which stores code to provide a set of questions in a knowledge-based authentication (KBA) system, the code including instructions to:

receive facts from multiple fact sources, each fact source being associated with a distinct data format;

provide a set of adaptors, each adaptor being constructed and arranged to convert facts in a distinct data format with which a fact source is associated to a common data format; and

generate the set of questions from the facts in the common data format, the set of questions being configured to elicit, from a user, a corresponding set of responses from which a KBA result is produced;

wherein the code includes further instructions to;

store the facts in a database when the facts have been converted to the common data format, the database including a set of entries, each entry of the set of entries being associated with a fact and including at least one identifier associated with a customer; and

wherein generating the set of questions from the facts in the common data format includes;

producing a ranking value associated with a candidate question, the ranking value being indicative of a likelihood that a particular response to the question implies that the user is the customer;

including the candidate question in the set of questions when the ranking value is greater than a threshold value; and

excluding the candidate question from the set of questions when the ranking value is less than a threshold value.

14. A computer program product according to claim 13,

wherein generating the set of questions from the facts in the common data format further includes:

receiving a request to authenticate the customer; and

performing a lookup operation on the database in response to the request, the lookup operation being configured to locate entries of the set of entries that include the identifier associated with the customer.

15. A computer program product according to claim 14,

wherein each fact source is further associated with a fact category of a set of fact categories,

wherein each entry of the set of entries of the database includes the fact category of the fact source from which the with which the entry is associated was received,

wherein each question of the set of questions is associated with a question type of a set of question types,

wherein performing the lookup operation on the database in response to the request includes:

collecting fact categories of the entries of the set of entries including the identifier associated with the customer, and

wherein generating the set of questions from the facts in the common data format further includes;

for each question of the set of questions, selecting a question type of the set of question types based on the collected fact categories.

16. A computer program product according to claim 14,

wherein the customer belongs to an organization;

wherein performing the lookup operation on the database in response to the request further includes;

collecting, from the entries of the set of entries including the user identifier associated with the customer, identifiers associated with other customers;

verifying which of the other customers belong to the organization; and

forming a subset of entries, each entry of the subset of entries having identifiers associated with customers belonging to the organization, and

wherein generating the set of questions from the facts in the common data format further includes;

producing the set of questions from the facts with which the subset of entries is associated.