System and method for performing authentication using data analytics

• US 9,875,347 B2
• Filed: 07/31/2014
• Issued: 01/23/2018
• Est. Priority Date: 07/31/2014
• Status: Active Grant

• Current Assignee: Nok Nok Labs Incorporated
• Original Assignee: Nok Nok Labs Incorporated
• Inventors: Baghdasaryan, Davit
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): HOLMES, ANGELA R
• Application Number:
  US14/448,868
• Publication Number:
  US 20170109509A1
• Time in Patent Office: 1,272 Days
• Field of Search: 726 5
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06Q 20/22 Payment schemes or models
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A system, apparatus, method, and machine readable medium are described for performing authentication using data analytics such as machine learning. For example, one embodiment of a method comprises: selecting a set of parameters related to user activity on a client device; receiving a request to authenticate the user for a current transaction; responsively calculating a distance between parameters associated with the current transaction and historical parameters from an existing dataset; determining a risk level associated with the current transaction based on the calculated distances between the parameters associated with the current transaction and the historical parameters; selecting one or more authentication techniques required to authenticate the user based on the risk level; performing the one or more authentication techniques to attempt to authenticate the user and generating an authentication result; and updating the historical parameters using the parameters associated with the current transaction and the authentication result.

Claims

1. A method implemented within an authentication system comprising:

selecting a set of parameters related to user activity on a client device;

receiving a request to authenticate the user for a current transaction;

responsively calculating a distance between parameters associated with the current transaction and historical parameters from an existing dataset;

determining a risk level associated with the current transaction based on the calculated distances between the parameters associated with the current transaction and the historical parameters;

selecting one or more authentication techniques required to authenticate the user based on the risk level;

performing the one or more authentication techniques to attempt to authenticate the user and generating an authentication result;

updating the historical parameters using the parameters associated with the current transaction and the authentication result; and

employing machine learning to select the set of parameters by performing a correlation between each parameter and results of prior authentication events.

2. The method as in claim 1 wherein the parameters include parameters associated with authenticator identifiers or keys used to perform authentication, parameters associated with a time of authentication, parameters associated with a location of authentication, parameters associated with network connectivity and/or parameters associated with a biometric score generated by a client device authenticator.

3. The method as in claim 1 wherein the risk level is set to a first level representing a normal user behavior if the distance between one or more of the parameters associated with the current transaction and the corresponding historical parameters is below a specified threshold.

4. The method as in claim 3 wherein the risk level is set to a second level representing a suspicious user behavior if the distance between one or more of the parameters associated with the current transaction and the corresponding historical parameters is above a specified threshold.

5. The method as in claim 1 wherein selecting comprises:

selecting more rigorous authentication techniques for relatively higher risk levels and selecting relatively less rigorous authentication techniques or no authentication techniques for relatively lower risk levels.

6. The method as in claim 5 wherein the more rigorous authentication techniques comprise explicit biometric user authentication.

7. The method as in claim 6 wherein the less rigorous authentication techniques comprise non-intrusive authentication techniques.

8. The method as in claim 1 wherein parameters are selected to be included in the set of parameters which have a relatively high correlation with successful authentication events and/or unsuccessful authentication events.

9. The method as in claim 1 wherein calculating a distance between parameters associated with the current transaction and historical parameters comprises performing anomaly detection using a Gaussian distribution of the parameters.

10. A non-transitory machine-readable medium having program code stored thereon which, when executed by a machine, causes the machine to perform the operations of:

selecting a set of parameters related to user activity on a client device;

receiving a request to authenticate the user for a current transaction;

responsively calculating a distance between parameters associated with the current transaction and historical parameters from an existing dataset;

determining a risk level associated with the current transaction based on the calculated distances between the parameters associated with the current transaction and the historical parameters;

selecting one or more authentication techniques required to authenticate the user based on the risk level;

performing the one or more authentication techniques to attempt to authenticate the user and generating an authentication result;

updating the historical parameters using the parameters associated with the current transaction and the authentication result; and

employing machine learning to select the set of parameters by performing a correlation between each parameter and results of prior authentication events.

11. The machine-readable medium as in claim 10 wherein the parameters include parameters associated with authenticator identifiers or keys used to perform authentication, parameters associated with a time of authentication, parameters associated with a location of authentication, parameters associated with network connectivity and/or parameters associated with a biometric score generated by a client device authenticator.

12. The machine-readable medium as in claim 10 wherein the risk level is set to a first level representing a normal user behavior if the distance between one or more of the parameters associated with the current transaction and the corresponding historical parameters is below a specified threshold.

13. The machine-readable medium as in claim 12 wherein the risk level is set to a second level representing a suspicious user behavior if the distance between one or more of the parameters associated with the current transaction and the corresponding historical parameters is above a specified threshold.

14. The machine-readable medium as in claim 10 wherein selecting comprises:

selecting more rigorous authentication techniques for relatively higher risk levels and selecting relatively less rigorous authentication techniques or no authentication techniques for relatively lower risk levels.

15. The machine-readable medium as in claim 14 wherein the more rigorous authentication techniques comprise explicit biometric user authentication.

16. The machine-readable medium as in claim 15 wherein the less rigorous authentication techniques comprise non-intrusive authentication techniques.

17. The machine-readable medium as in claim 10 wherein parameters are selected to be included in the set of parameters which have a relatively high correlation with successful authentication events and/or unsuccessful authentication events.

18. The machine-readable medium as in claim 10 wherein calculating a distance between parameters associated with the current transaction and historical parameters comprises performing anomaly detection using a Gaussian distribution of the parameters.

19. A system comprising:

a client device providing a set of parameters related to activity of a current user;

an authentication server to receive a request to authenticate the user for a current transaction;

the authentication server comprising a risk analysis circuitry to responsively calculate a distance between parameters associated with the current transaction and historical parameters from an existing dataset;

the risk analysis circuitry to determine a risk level associated with the current transaction based on the calculated distances between the parameters associated with the current transaction and the historical parameters and selecting one or more authentication techniques required to authenticate the user based on the risk level;

the client device comprising an authentication engine to perform the one or more authentication techniques to attempt to authenticate the user and generating an authentication result;

a result analysis and update circuitry to update the historical parameters using the parameters associated with the current transaction and the authentication result; and

employing machine learning to select the set of parameters by performing a correlation between each parameter and results of prior authentication events.

20. The system as in claim 19 wherein the parameters include parameters associated with authenticator identifiers or keys used to perform authentication, parameters associated with a time of authentication, parameters associated with a location of authentication, parameters associated with network connectivity and/or parameters associated with a biometric score generated by a client device authenticator.

21. The system as in claim 19 wherein the risk level is set to a first level representing a normal user behavior if the distance between one or more of the parameters associated with the current transaction and the corresponding historical parameters is below a specified threshold.

22. The system as in claim 21 wherein the risk level is set to a second level representing a suspicious user behavior if the distance between one or more of the parameters associated with the current transaction and the corresponding historical parameters is above a specified threshold.