Behavioral profiling method and system to authenticate a user

• US 10,091,180 B1
• Filed: 11/11/2016
• Issued: 10/02/2018
• Est. Priority Date: 03/20/2012
• Status: Active Grant

• Current Assignee: United Services Automobile Association
• Original Assignee: United Services Automobile Association
• Inventors: Moritz, Karen M., Aultman, Stephen Seyler, Campbell, Joseph James Albert, Casillas, Debra R., Neuse, Jonathan Edward, Alonzo, Sara Teresa, Buckingham, Thomas Bret, Fernandez, Gabriel Carlos, Mortensen, Maland Keith
• Primary Examiner(s): Le, Chau
• Application Number:
  US15/349,226
• Time in Patent Office: 690 Days
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 67/143 Termination or inactivation of sessions, e.g. event-controlled end of session
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Methods and systems for behavioral profiling, and in particular, utilizing crowd-managed data architectures to store and manage that profile, are described. In some embodiments, a method includes observing behavioral characteristics of user interactions during a current session with the user through one of a plurality of channels. Variations between the behavioral characteristics of the user interactions observed during the current session and a behavioral profile previously developed based on prior usage patterns of the user through the plurality of channels are identified, in real-time or near real-time.

Claims

1. A computer-implemented method, comprising:

monitoring a plurality of behavioral characteristics of user interactions with a first computing device;

identifying a subset of the plurality of behavioral characteristics to add to a block chain;

sending a request to add the subset of the plurality of behavioral characteristics to the block chain; and

identifying that the subset of the plurality of behavioral characteristics has been added to the block chain, by;

identifying a number of subsequent data records that have been added to the block chain after the subset of the plurality of behavioral characteristics was added; and

receiving an indication of a minimum number of data records to be added to the block chain.

2. The method of claim 1, wherein identifying that the subset of the plurality of behavioral characteristics has been added to the block chain further comprises:

comparing the number of the subsequent data records added to the block chain to the minimum number.

3. The method of claim 1, the method further comprising:

receiving an indication that a second computing device will store at least part of the subsequent data records.

4. The method of claim 3, the method further comprising:

receiving an indication that, as a result of the second computing device storing at least part of the subsequent data records, an individual associated with the second computing device will receive a reward.

5. The method of claim 4, the method further comprising:

identifying a percentage of the subsequent data records that are stored on the second computing device.

6. The method of claim 5, wherein the individual associated with the second computing device only receives the reward when the percentage of the subsequent data records that are stored on the second computing device is less than a threshold percentage.

7. The method of claim 6, wherein the threshold percentage is approximately 20%.

8. The method of claim 1, wherein the user interactions relate to interactions between a user and the first computing device, and wherein the subset of the plurality of behavioral characteristics added to the block chain are encrypted, the method further comprising:

sending a decryption key to a company; and

receiving notification that the company has utilized the decryption key to authenticate the user.

9. The method of claim 8, wherein authenticating the user comprises:

identifying variations between the plurality of behavioral characteristics of the user interactions and a behavior profile that was previously developed and that is based on prior usage patterns of the user.

10. The method of claim 9, wherein the user interactions are over a plurality of channels.

11. The method of claim 10, the method further comprising:

implementing, based on the variations, a challenge level for the user to be authenticated.

12. The method of claim 9, wherein the variations are also with respect to a comparison of the plurality of behavioral characteristics of the user interactions and demographic data relating to website behaviors specific to a generation of the user.

13. The method of claim 12, the method further comprising:

implementing, based on the variations, a challenge level for the user to be authenticated.

14. A system, comprising:

a processor,

a non-transitory computer readable memory coupled with the processor, the memory comprising executable instructions that when executed by the processor cause the processor to effectuate operations comprising;

monitoring a plurality of behavioral characteristics of user interactions with a first computing device;

identifying a subset of the plurality of behavioral characteristics to add to a block chain;

sending a message to add the subset of the plurality of behavioral characteristics to the block chain;

identifying that the subset of the plurality of behavioral characteristics has been added to the block chain, wherein the subset of the plurality of behavioral characteristics added to the block chain are encrypted; and

authenticating the user, wherein authenticating the user comprises identifying variations between the plurality of behavioral characteristics of the user interactions and a behavior profile previously developed based on prior usage patterns of the user.

15. The system of claim 14, wherein identifying that the subset of the plurality of behavioral characteristics has been added to the block chain comprises:

identifying a number of subsequent data records that have been added to the block chain after the subset of the plurality of behavioral characteristics was added;

receiving an indication of a minimum number of data records to be added to the block chain; and

comparing the number of subsequent data records added to the block chain to the minimum number.

16. A non-transitory computer-readable storage medium comprising instructions that, when executed by a processor, cause the processor to effectuate operations comprising:

monitoring a plurality of behavioral characteristics of user interactions with a first computing device, wherein the user interactions are over a plurality of channels;

identifying a subset of the plurality of behavioral characteristics to add to a block chain;

generating encrypted behavioral characteristics via encrypting the subset of the plurality of behavioral characteristics;

sending a message to add the encrypted behavioral characteristics to the block chain;

identifying that the encrypted behavioral characteristics have been added to the block chain by;

identifying a number of the subsequent data records that have been added to the block chain after the subset of the plurality of behavioral characteristics was added;

receiving an indication of a minimum number of data records to be added to the block chain; and

comparing the number of the subsequent data records added to the block chain to the minimum number;

receiving an indication that a second computing device will store at least part of subsequent data records; and

identifying variations between the plurality of behavioral characteristics of the user interactions and a behavior profile previously developed based on prior usage patterns of a user.

17. A computer-implemented method, comprising:

monitoring a plurality of behavioral characteristics of user interactions with a first computing device;

identifying a subset of the plurality of behavioral characteristics to add to a block chain;

sending a request to add the subset of the plurality of behavioral characteristics to the block chain;

identifying that the subset of the plurality of behavioral characteristics has been added to the block chain;

identifying a number of subsequent data records that have been added to the block chain after the subset of the plurality of behavioral characteristics was added;

receiving an indication that a second computing device will store at least part of the subsequent data records;

receiving an indication that, as a result of the second computing device storing at least part of the subsequent data records, an individual associated with the second computing device will receive a reward; and

identifying a percentage of the subsequent data records that are stored on the second computing device.

18. The method of claim 17, wherein the individual associated with the second computing device only receives the reward when the percentage of the subsequent data records that are stored on the second computing device is less than a threshold percentage.

19. The method of claim 17, wherein the threshold percentage is approximately 20%.

20. A computer-implemented method, comprising:

monitoring a plurality of behavioral characteristics of user interactions with a first computing device, wherein the user interactions relate to interactions between a user and the first computing device;

identifying a subset of the plurality of behavioral characteristics to add to a block chain, wherein the subset of the plurality of behavioral characteristics added to the block chain are encrypted;

sending a request to add the subset of the plurality of behavioral characteristics to the block chain;

identifying that the subset of the plurality of behavioral characteristics has been added to the block chain;

sending a decryption key to a company; and

receiving notification that the company has utilized the decryption key to authenticate the user by identifying variations between the plurality of behavioral characteristics of the user interactions and a behavior profile that was previously developed and that is based on prior usage patterns of the user.

21. The method of claim 20, the method further comprising:

implementing, based on the variations, a challenge level for the user to be authenticated.

22. The method of claim 20, wherein the variations are also with respect to a comparison of the plurality of behavioral characteristics of the user interactions and demographic data relating to website behaviors specific to a generation of the user.