Multi-factor authentication using a user behavior profile as a factor

• US 10,326,775 B2
• Filed: 05/08/2018
• Issued: 06/18/2019
• Est. Priority Date: 05/15/2017
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Ford, Richard Anthony, Swafford, Brandon L.
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US15/974,237
• Publication Number:
  US 20180332071A1
• Time in Patent Office: 406 Days
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A system, method, and computer-usable medium are disclosed for performing a multi-factor authentication operation, comprising: monitoring electronically-observable user behavior; converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior; generating a user behavior factor based upon the electronic information representing the electronically-observable user behavior; and, using the user behavior factor as a factor of a multi-factor authentication.

Claims

1. A computer-implementable method for performing a multi-factor authentication operation, comprising:

monitoring electronically-observable user behavior of a user, the electronically-observable user behavior comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior;

generating a user behavior factor based upon the electronic information representing the electronically-observable user behavior;

identifying a first user behavior factor as a known good user behavior factor when the user behavior corresponds to a known good user behavior;

identifying a second user behavior factor as an anomalous user behavior factor when the user behavior corresponds to an anomalous behavior;

using one of the first and second user behavior factors as a factor of a multi-factor authentication when authenticating the user, the multi-factor authentication being strengthened when the user behavior factor comprises the known good user behavior factor; and

,

modifying an outcome of the multi-factor authentication when authenticating the user when the user behavior factor comprises the anomalous user behavior factor; and

wherein

the multi-factor authentication uses three authentication factors in addition to using the user behavior factor when performing the multi-factor authentication;

the user behavior factor provides a fourth authentication factor, the fourth authentication factor being uniquely associated with the user, the fourth authentication factor representing at least one of what the user has done, what the user is currently doing and what the user is expected to do, use of the user behavior factor when performing the multi-factor authentication following the use of the three authentication factors when performing the multifactor authentication; and

,

the multi-factor authentication is strengthened when performing the multi-factor authentication by an addition of the fourth authentication factor, the fourth authentication factor being uniquely associated with the user.

2. The method of claim 1, wherein:

the three authentication factors comprise a first authentication factor, a second authentication factor and a third authentication factor, the first authentication factor being something the user knows, the second authentication factor being something the user possesses and the third authentication factor being something that is inherent to the user.

3. The method of claim 1, wherein:

the user behavior factor includes a user behavior element.

4. The method of claim 3, wherein:

the user behavior element is associated with a corresponding user behavior profile; and

,

the user behavior profile is used when performing the multi-factor authentication.

5. The method of claim 1, wherein:

the multi-factor authentication is performed on at least one of a recurring basis and at certain time intervals during enactment of a particular user behavior.

6. The method of claim 1, wherein:

the multi-factor authentication is performed in response to detection of a particular user behavior.

7. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for;

monitoring electronically-observable user behavior of a user, the electronically-observable user behavior comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior;

generating a user behavior factor based upon the electronic information representing the electronically-observable user behavior;

identifying a first user behavior factor as a known good user behavior factor when the user behavior corresponds to a known good user behavior;

identifying a second user behavior factor as an anomalous user behavior factor when the user behavior corresponds to an anomalous behavior;

using one of the first and second user behavior factors as a factor of a multi-factor authentication when authenticating the user, the multi-factor authentication being strengthened when the user behavior factor comprises the known good user behavior factor; and

,

modifying an outcome of the multi-factor authentication when authenticating the user when the user behavior factor comprises the anomalous user behavior factor; and

wherein

the multi-factor authentication uses three authentication factors in addition to using the user behavior factor when performing the multi-factor authentication;

the user behavior factor provides a fourth authentication factor, the fourth authentication factor being uniquely associated with the user, the fourth authentication factor representing at least one of what the user has done, what the user is currently doing and what the user is expected to do, use of the user behavior factor when performing the multi-factor authentication following the use of the three authentication factors when performing the multifactor authentication; and

,

the multi-factor authentication is strengthened when performing the multi-factor authentication by an addition of the fourth authentication factor, the fourth authentication factor being uniquely associated with the user.

8. The system of claim 7, wherein:

the three authentication factors comprise a first authentication factor, a second authentication factor and a third authentication factor, the first authentication factor being something the user knows, the second authentication factor being something the user possesses and the third authentication factor being something that is inherent to the user.

9. The system of claim 7, wherein:

the user behavior factor includes a user behavior element.

10. The system of claim 7, wherein:

the user behavior element is associated with a corresponding user behavior profile; and

,

the user behavior profile is used when performing the multi-factor authentication.

11. The system of claim 7, wherein:

the multi-factor authentication is performed on at least one of a recurring basis and at certain time intervals during enactment of a particular user behavior.

12. The system of claim 7, wherein:

the multi-factor authentication is performed in response to detection of a particular user behavior.

13. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

monitoring electronically-observable user behavior of a user, the electronically-observable user behavior comprising a behavior exhibited by a user that is observed through the use of at least one of an electronic device, a computer system and a software application executing on the computing system;

converting the electronically-observable user behavior into electronic information representing the electronically-observable user behavior;

generating a user behavior factor based upon the electronic information representing the electronically-observable user behavior;

identifying a first user behavior factor as a known good user behavior factor when the user behavior corresponds to a known good user behavior;

identifying a second user behavior factor as an anomalous user behavior factor when the user behavior corresponds to an anomalous behavior;

using one of the first and second user behavior factors as a factor of a multi-factor authentication when authenticating the user, the multi-factor authentication being strengthened when the user behavior factor comprises the known good user behavior factor; and

,

modifying an outcome of the multi-factor authentication when authenticating the user when the user behavior factor comprises the anomalous user behavior factor; and

wherein

the multi-factor authentication uses three authentication factors in addition to using the user behavior factor when performing the multi-factor authentication;

the user behavior factor provides a fourth authentication factor, the fourth authentication factor being uniquely associated with the user, the fourth authentication factor representing at least one of what the user has done, what the user is currently doing and what the user is expected to do, use of the user behavior factor when performing the multi-factor authentication following the use of the three authentication factors when performing the multifactor authentication; and

,

the multi-factor authentication is strengthened when performing the multi-factor authentication by an addition of the fourth authentication factor, the fourth authentication factor being uniquely associated with the user.

14. The non-transitory, computer-readable storage medium of claim 13, wherein:

the three authentication factors comprise a first authentication factor, a second authentication factor and a third authentication factor, the first authentication factor being something the user knows, the second authentication factor being something the user possesses and the third authentication factor being something that is inherent to the user.

15. The non-transitory, computer-readable storage medium of claim 13, wherein:

the user behavior factor includes a user behavior element.

16. The non-transitory, computer-readable storage medium of claim 13, wherein:

the user behavior element is associated with a corresponding user behavior profile; and

,

the user behavior profile is used when performing the multi-factor authentication.

17. The non-transitory, computer-readable storage medium of claim 13, wherein:

the multi-factor authentication is performed on at least one of a recurring basis and at certain time intervals during enactment of a particular user behavior.

18. The non-transitory, computer-readable storage medium of claim 13, wherein:

the multi-factor authentication is performed in response to detection of a particular user behavior.

19. The non-transitory, computer-readable storage medium of claim 13, wherein:

the computer executable instructions are deployable to a client system from a server system at a remote location.

20. The non-transitory, computer-readable storage medium of claim 13, wherein:

the computer executable instructions are provided by a service provider to a user on an on-demand basis.