Queue management and load shedding for complex authentication schemes

• US 10,652,225 B2
• Filed: 06/24/2015
• Issued: 05/12/2020
• Est. Priority Date: 06/30/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Koved, Lawrence, Zhang, Bo
• Primary Examiner(s): Rahim, Monjur
• Application Number:
  US14/748,266
• Publication Number:
  US 20150381598A1
• Time in Patent Office: 1,784 Days
• Field of Search: 726 3
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

Using a stochastic queuing model to determine adjustments to be made to authentication system operation. In light of operational parameter values and the stochastic queuing model, a determination is made that adjusting the value of a particular parameter for handling authentication requests is likely to improve some aspect of system performance, and the request handling parameter is adjusted accordingly.

Claims

1. A method comprising:

performing, by a hardware processor, operations of a pre-authentication process comprising;

obtaining a stochastic queuing model of a computerized system for authenticating users, a set of preferences for handling authentication requests, and a set of operational parameter values, wherein the stochastic queuing model includes two or more classes of users, a queue for each class of users, and quantifies an overall authentication delay of the computerized system for authenticating users;

determining, based at least in part on the model and the operational values, that adjusting an authentication scheme will improve a probable degree to which the authentication system will meet the set of preferences;

responsive to the determination that adjusting the authentication scheme will improve the probable degree to which the system for authenticating users will meet the set of preferences, adjusting the authentication scheme of the computerized system for authenticating users; and

performing, by the hardware processor, an authentication based on authentication scheme determined by the pre-authentication process.

2. The method of claim 1 wherein obtaining comprises generating the stochastic queuing model of the computerized authentication system.

3. The method of claim 1 wherein the set of preferences includes information related to at least one of the following:

authentication method confidence, authentication method usability, or authentication method cost.

4. The method of claim 1, wherein adjusting the authentication scheme comprises adjusting a value of a first request handling parameter by adjusting at least one of:

request service type, request service timing, or request processing resources.

5. The method of claim 4 wherein:

the first request handling parameter relates to request service type; and

the adjustment of the first request handling parameter includes replacing a first authentication method with a second authentication method.

6. The method of claim 3 wherein:

the set of preferences includes information related to authentication method usability; and

the authentication method usability information includes a maximum acceptable authentication request service delay.

7. The method of claim 1 wherein the stochastic queuing model includes stochastically modeling authentication request arrival rates for multiple classes of authentication requests.

8. The method of claim 1 wherein the stochastic queuing model includes stochastically modeling service request delays for multiple authentication service types.

9. The method of claim 1 wherein the set of operational parameter values relate to at least one of system context and user context.

10. The method of claim 1 wherein the set of operational parameter values includes value(s) for at least one of:

user historical access patterns, authentication system load, network delays, user device location, authentication queue processing history, estimated arrival rates of authentication requests, and risk associated with making an erroneous authentication decision.

11. The method of claim 1, wherein adjusting the authentication scheme includes adjusting a value of a first request handling parameter by applying load shedding to a first authentication request.

12. The method of claim 11 wherein the load shedding includes presenting a passive authentication challenge for the first authentication request to a point in time that precedes the first authentication request.

13. The method of claim 11 wherein:

the load shedding includes replacing a first set of authentication challenges with a second set of authentication challenges; and

the first set of authentication challenges contains at least one challenge not in the second set of authentication challenges.

14. A non-transitory computer program product comprising a non- transitory computer readable storage medium having stored thereon:

instructions stored on the computer readable storage medium for a hardware processor to perform a pre-authentication process that includes;

instructions executable by a device to cause the device to obtain a stochastic queuing model of a computerized system for authenticating users, a set of preferences for handling authentication requests, and a set of operational parameter values, wherein the stochastic queuing model includes two or more classes of users, a queue for each class of user, and quantifies an overall authentication delay of the computerized system for authenticating users;

instructions executable by a device to cause the device to determine, based at least in part on the model and the operational values, that adjusting an authentication scheme will improve a probable degree to which the authentication system will meet the set of preferences;

instructions executable by a device to cause the device to adjust, responsive to the determination that adjusting the authentication scheme will improve the probable degree to which the system for authenticating users will meet the set of preferences, the authentication scheme of the computerized system for authenticating users; and

instructions stored on the computer readable storage medium for the hardware processor to perform an authentication based on the authentication scheme determined by the pre- authentication process.

15. The non-transitory computer program product of claim 14 wherein the stochastic queuing model includes stochastically modeling authentication request arrival rates for multiple classes of authentication requests and service request delays for multiple authentication service types.

16. The non-transitory computer program product of claim, 14 wherein adjusting the authentication scheme includes adjusting a value of a first request handling parameter by applying load shedding to a first authentication request.

17. A computer system comprising:

a hardware processor(s) set; and

a non-transitory computer readable storage medium;

wherein;

the processor set is structured, located, connected or programmed to execute instructions for a pre-authentication process stored on the computer readable storage medium,

the instructions including;

instructions executable by a device to obtain a stochastic queuing model of a computerized system for authenticating users, a set of preferences for handling authentication requests, and a set of operational parameter values, wherein the stochastic queuing model includes two or more classes of users, a queue for each class of user, and quantifies an overall authentication delay of the computerized system for authenticating users;

instructions executable by a device to cause the device to determine, based at least in part on the model and the operational values, that adjusting an authentication scheme will improve a probable degree to which the authentication system will meet the set of preferences;

instructions executable by a device to cause the device to adjust, responsive to the determination that adjusting the authentication scheme will improve the probable degree to which the system for authenticating users will meet the set of preferences, the authentication scheme of the computerized system for authenticating users; and

the processor set is structured, located, connected or programmed to execute instructions for an authentication based on the authentication scheme determined by the pre-authentication process.

18. The system of claim 17 wherein obtaining the stochastic queuing model comprises generating the stochastic queuing model.

19. The system of claim 17, wherein adjusting the authentication scheme comprises adjusting a value of a first request handling parameter by adjusting at least one of:

request service type, request service timing, or request processing resources.

20. The system of claim 17, wherein adjusting the authentication scheme includes adjusting a value of a first request handling parameter by applying load shedding to a first authentication request.