Adaptive greylist processing

Patent metadata

Field	Value
Publication number	US-2019158501-A1
Application number	US-201715819711-A
Country	US
Kind code	A1
Filing date	Nov 21, 2017
Priority date	Nov 21, 2017
Publication date	May 23, 2019
Grant date	—

Abstract

Adding an internet location to a greylist includes receiving a login pairing that includes login credentials and an internet location that the login credentials are received from. A successful login number of prior successful logins associated with the login pairing is determined and the internet location may be added to the greylist based at least in part on the successful login number.

First claim

What is claimed is:

1 . A computer-implemented method of processing logon attempts, the computer-implemented method comprising:
receiving a login pairing, wherein the login pairing includes login credentials and an internet location that the login credentials are received from; determining a successful login number of prior successful logins associated with the login pairing; and adding the internet location to a greylist based at least in part on the successful login number, wherein login pairings on the greylist are granted conditional access to a network.

2 . The computer-implemented method of claim 1 further comprising:
determining a total historical number of login attempts from the login pairing within a predetermined time window; and
determining a success metric of the login paring based at least in part on the successful login number and the total historical number of login attempts,
wherein adding the internet location to the greylist based at least in part on the successful login number includes adding the internet location to the greylist when the success metric is less than a minimum success metric threshold.

3 . The computer-implemented method of claim 2 , wherein determining the success metric includes dividing the successful login number by the total historical number of login attempts from the login pairing.

4 . The computer-implemented method of claim 2 further comprising:
identifying an attribute of the internet location, wherein the attribute includes at least one of an internet service provider (ISP), a geolocation, or an Internet Protocol (IP) format.

5 . The computer-implemented method of claim 4 further comprising:
adjusting the minimum success metric threshold based at least in part on the attribute that is identified.

6 . The computer-implemented method of claim 2 further comprising:
identifying a wireless carrier network based at least in part on the internet location; and
adjusting the minimum success metric threshold based at least in part on the wireless carrier network that is identified.

7 . The computer-implemented method of claim 1 , wherein the internet location includes an Internet Protocol (IP) address.

8 . The computer-implemented method of claim 7 further comprising:
receiving a subsequent login pairing, wherein the subsequent login pairing includes subsequent login credentials and a subsequent IP address that is providing the subsequent login credentials;
comparing the subsequent IP address to IP addresses of the greylist; and
performing additional verification when the subsequent IP address matches one of the IP addresses of the greylist.

9 . The computer-implemented method of claim 1 , wherein adding the internet location to the greylist includes providing a greylist vector that includes an IP address and at least one of a date time stamp of a login attempt associated with the login pairing, a category of the login attempt, a status of the login attempt, or the login credentials.

10 . The computer-implemented method of claim 1 , wherein the login pairing is received from a mobile device.

11 . One or more computing devices comprising:
one or more processors; and memory having instruction stored therein, the instructions, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving a login pairing, wherein the login pairing includes login credentials and an internet location that is providing the login credentials;
determining a successful login number of prior successful logins associated with the login pairing; and
adding the internet location to a greylist based at least in part on the successful login number, wherein login pairings on the greylist are granted conditional access to a network.

12 . The one or more computing devices of claim 11 , wherein the memory includes further instructions that when executed by the one or more processors, cause the one or more processors to perform operations comprising:
determining a total historical number of login attempts from the login pairing; and determining a success metric, wherein determining the success metric includes dividing the successful login number by the total historical number of login attempts from the login pairing, wherein the internet location includes an IP address, and wherein adding the internet location to the greylist based at least in part on the successful login number includes adding the IP address to the greylist when the success metric is less than a minimum success metric threshold.

13 . The one or more computing devices of claim 12 , wherein the memory includes further instructions that when executed by the one or more processors, cause the one or more processors to perform operations comprising:
identifying a wireless carrier network based at least in part on the IP address; and adjusting the minimum success metric threshold based at least in part on the wireless carrier network that is identified.

14 . The one or more computing devices of claim 12 , wherein the memory includes further instructions that when executed by the one or more processors, cause the one or more processors to perform operations comprising:
adjusting the minimum success metric threshold based at least in part on whether the login pairing is received in an IPv4 format or an IPv6 format.

15 . The one or more computing devices of claim 12 , wherein the memory includes further instructions that when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving a subsequent login pairing, wherein the subsequent login pairing includes subsequent login credentials and a subsequent IP address that is providing the subsequent login credentials; comparing the subsequent IP address to IP addresses of the greylist; and performing additional verification when the subsequent IP address matches one of the IP addresses of the greylist.

16 . The one or more computing devices of claim 12 , wherein adding the IP address to the greylist includes providing a greylist vector that includes the IP address, a date time stamp of a login attempt associated with the login pairing, a category of the login attempt, a status of the login attempt, and the login credentials.

17 . The one or more computing devices of claim 11 , wherein the network is a cellular network.

18 . One or more non-transitory computer-readable media storing computer-executable instructions that upon execution cause one or more processors to perform acts comprising:
receiving a login pairing, wherein the login pairing includes login credentials and an IP address that is providing the login credentials; determining a successful login number of prior successful logins associated with the login pairing; and adding the IP address to a greylist based at least in part on the successful login number, wherein login pairings on the greylist are granted conditional access to a network.

19 . The one or more non-transitory computer-readable media of claim 18 , wherein the one or more non-transitory computer-readable media include further computer-executable instructions that upon execution cause one or more processors to perform acts comprising:
determining a total historical number of login attempts from the login pairing; and determining a success metric, wherein determining the success metric includes dividing the successful login number by the total historical number of login attempts from the login pairing, where

Assignees

• T Mobile Usa Inc

Inventors

• Peppe Brett C

Classifications

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• H04W12/06

  Authentication · CPC title

• H04L63/101 Primary

  Access control lists [ACL] · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04W12/08

  Access security · CPC title