Processing authentication requests to secured information systems based on machine-learned user behavior profiles

Patent metadata

Field	Value
Publication number	US-11790062-B2
Application number	US-202117498317-A
Country	US
Kind code	B2
Filing date	Oct 11, 2021
Priority date	Dec 5, 2018
Publication date	Oct 17, 2023
Grant date	Oct 17, 2023

Abstract

Aspects of the disclosure relate to processing authentication requests to secured information systems based on machine-learned user behavior profiles. A computing platform may receive an authentication request corresponding to a request for a user of a client computing device to access one or more secured information resources associated with a user account. The computing platform may capture behavioral parameters associated with the client computing device and may evaluate the behavioral parameters using a behavioral profile associated with the user account to determine a behavioral deviation score. Based on the behavioral deviation score, the computing platform may select an authentication action from a plurality of pre-defined authentication actions. Subsequently, the computing platform may generate commands directing an account portal computing platform to allow access, conditionally allow access, or prevent access based on the selected authentication action. Then, the computing platform may send the commands to the account portal computing platform.

First claim

What is claimed is:

1. A computing platform, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
receive, via the communication interface, from an account portal computing platform, a first authentication request corresponding to a request for a first user of a first client computing device to access one or more secured information resources associated with a first user account in a first client portal session;
based on receiving the first authentication request from the account portal computing platform, capture one or more parameters associated with the first client computing device;
evaluate the one or more parameters associated with the first client computing device using a first profile associated with the first user account to determine a first deviation score;
based on the first deviation score, select a first authentication action from a plurality of pre-defined authentication actions;
generate, based on the first authentication action selected from the plurality of pre-defined authentication actions, one or more commands directing the account portal computing platform to allow access, conditionally allow access, or prevent access to the one or more secured information resources associated with the first user account in the first client portal session; and
send, via the communication interface, to the account portal computing platform, the one or more commands directing the account portal computing platform to allow access, conditionally allow access, or prevent access to the one or more secured information resources associated with the first user account in the first client portal session,

wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
prior to receiving the first authentication request from the account portal computing platform:
capture first interaction data associated with the first user using the first client computing device to access the one or more secured information resources associated with the first user account;
log the first interaction data in a client authentication database;
capture second interaction data associated with the first user using a second client computing device to access the one or more secured information resources associated with the first user account;
log the second interaction data in the client authentication database;
build the first profile associated with the first user account based on the first interaction data and the second interaction data; and
store the first profile associated with the first user account in the client authentication database.

2. The computing platform of claim 1 , wherein receiving the first authentication request from the account portal computing platform comprises receiving one or more login credentials associated with the first user account.

3. The computing platform of claim 1 , wherein capturing the one or more parameters associated with the first client computing device comprises probing the first client computing device to obtain device information from the first client computing device.

4. The computing platform of claim 1 , wherein capturing the one or more parameters associated with the first client computing device comprises receiving, via the communication interface, from the account portal computing platform, activity information associated with the first client computing device.

5. The computing platform of claim 1 , wherein capturing the one or more parameters associated with the first client computing device comprises capturing one or more authenticators used by the first user of the first client computing device in requesting access to the one or more secured information resources associated with the first user account and capturing information identifying one or more events requested by the first user of the first client computing device.

6. The computing platform of claim 5 , wherein capturing the one or more parameters associated with the first client computing device comprises capturing a device identifier associated with the first client computing device, a device location associated with the first client computing device, a network address associated with the first client computing device, an internet service provider associated with the first client computing device, a mobile or desktop indicator associated with the first client computing device, a time zone setting associated with the first client computing device, and a language setting associated with the first client computing device.

7. The computing platform of claim 1 , wherein the first profile associated with the first user account used in evaluating the one or more parameters associated with the first client computing device is determined by the computing platform based on interaction data captured by the computing platform during previous interactions with the first client computing device.

8. The computing platform of claim 1 , wherein evaluating the one or more parameters associated with the first client computing device using the first profile associated with the first user account to determine the first deviation score comprises summing one or more distance increments for each identified difference of one or more identified differences between the one or more parameters associated with the first client computing device and one or more historical parameters associated with the first profile associated with the first user account.

9. The computing platform of claim 1 , wherein the plurality of pre-defined authentication actions comprises permitting access to a specific user account without further authentication, permitting access to the specific user account upon one or more successful responses to one or more challenge prompts generated by the computing platform, and denying access to the specific user account.

10. The computing platform of claim 1 , wherein building the first profile associated with the first user account based on the first interaction data and the second interaction data comprises compiling information identifying a plurality of devices that have been used to access the first user account.

11. The computing platform of claim 10 , wherein building the first profile associated with the first user account based on the first interaction data and the second interaction data further comprises compiling information indicating how many times specific devices of the plurality of devices were used to perform specific functions.

12. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
after sending the one or more commands directing the account portal computing platform to allow access, conditionally allow access, or prevent access to the one or more secured information resources associated with the first user account in the first client portal session, update the first profile associated with the first user account based on fifth interaction data captured by the computing platform during the first client portal session.

13. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
receive, via the communication interface, from the account portal computing platform, a second authentication request corresponding to a reque

Assignees

• Bank Of America

Inventors

• Toth Michael E
• Shah Hitesh
• Zhang Xianhong

Classifications

• G06F21/316 Primary

  by observing the pattern of computer usage, e.g. typical user behaviour · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L67/306

  User profiles · CPC title

• H04L67/535

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title