Risk-Based Factor Selection

Patent metadata

Field	Value
Publication number	US-2024250942-A1
Application number	US-202318156974-A
Country	US
Kind code	A1
Filing date	Jan 19, 2023
Priority date	Jan 19, 2023
Publication date	Jul 25, 2024
Grant date	—

Abstract

The present technology provides for altering an authentication technique in response to a detection of a possible attack to which the authentication technique is vulnerable. An authentication provider can receive an authentication request to authenticate to a first resource, where the authentication to the first resource is permitted using a particular authentication technique, includes contextual information associated with the first access device and information identifying the first resource. Based on the contextual information, the authentication provider can determine that the authentication request is subject to an ongoing attack, and determine, an alternative authentication technique that is less vulnerable to the ongoing attack than the particular authentication technique. The authentication provider can require the first user account to authenticate with the first resource using the alternative authentication technique that is less vulnerable to the ongoing attack than the particular authentication technique.

First claim

What is claimed is:

1 . A method, the method comprising:
receiving, by an authentication service, an authentication request to authenticate to a first resource, wherein an authentication to the first resource is permitted using a particular authentication technique, wherein the authentication request includes contextual information associated with a first access device of the authentication request and information identifying the first resource; based on the contextual information, determining that the authentication request is subject to an ongoing attack; determining, an alternative authentication technique that is less vulnerable to the ongoing attack than the particular authentication technique; and requiring a first user account to authenticate with the first resource using the alternative authentication technique that is less vulnerable to the ongoing attack than the particular authentication technique.

2 . The method of claim 1 , wherein the authentication service is a multi-factor authentication service and the particular authentication technique and the alternative authentication technique are multi-factor authentication techniques.

3 . The method of claim 1 , further comprising:
presenting a user interface for a primary authentication technique to authenticate the first user account with the first resource; after successful completion of the primary authentication technique, sending the authentication request to the authentication service, wherein the contextual information associated with the first access device includes one or more of data identifying a network from which the first access device is connected, an IP address of the first access device, a browser version of a browser used to access the first resource, an identification of browser extensions installed in the browser used to access the first resource, an operating system on the first access device, and a type of device for the first access device; determining, by the authentication service, based on the contextual information and the information identifying the first resource that the particular authentication technique is permitted by a policy associated with the first resource; providing the particular authentication technique to the first user account; and determining that the first user account failed the particular authentication technique.

4 . The method of claim 3 , further comprising:
prior to providing the particular authentication technique, offering options for at least two authentication techniques, wherein the first user account selects the particular authentication technique.

5 . The method of claim 3 , wherein determining that the first user account failed the particular authentication technique occurs prior to the determining that the authentication request is subject to the ongoing attack.

6 . The method of claim 1 , further comprising:
setting a period in which an authentication provider will require the first user account to authenticate with the first resource using the alternative authentication technique before allowing the first user account to authenticate with the particular authentication technique.

7 . The method of claim 1 , wherein the first resource is associated with an access policy configured at the authentication service, the access policy specifies a rule for determining that the authentication request is subject to the ongoing attack.

8 . The method of claim 1 , wherein the authentication service determines characteristics associated with at least one attack is below individualized thresholds configured by the authentication service, such as if first resource utilizes a VPN for access devices, wherein the first user account may routinely attempt to authenticate from different IP addresses.

9 . The method of claim 7 , wherein the access policy includes an attack mitigation requirement, the attack mitigation requirement defining when the alternative authentication technique should be applied to the first user account, and when the alternative authentication technique should be applied to all requests for authentication to the first resource.

10 . The method of claim 1 , wherein the alternative authentication technique includes a multi-device push, wherein the multi-device push includes:
sending an access code to the first access device for entry into an authentication device; and receiving the access code from the authentication device.

11 . A non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium including instructions that when executed by at least one processor, cause the at least one processor to:
receive, by an authentication service, an authentication request to authenticate to a first resource, wherein authentication to the first resource is permitted using a particular authentication technique, wherein the authentication request includes contextual information associated with a first access device of the authentication request and information identifying the first resource; based on the contextual information, determine that the authentication request is subject to an ongoing attack; determine, an alternative authentication technique that is less vulnerable to the ongoing attack than the particular authentication technique; and require a first user account to authenticate with the first resource using the alternative authentication technique that is less vulnerable to the ongoing attack than the particular authentication technique.

12 . The non-transitory computer-readable storage medium of claim 11 , wherein the instructions further configure the at least one processor to:
present a user interface for a primary authentication technique to authenticate the first user account with the first resource; after successful completion of the primary authentication technique, send the authentication request to the authentication service, wherein the contextual information associated with the first access device includes one or more of data identifying a network from which the first access device is connected, an IP address of the first access device, a browser version of a browser used to access the first resource, an identification of browser extensions installed in the browser used to access the first resource, an operating system on the first access device, and a type of device of the first access device; determine, by the authentication service, based on the contextual information and the information identifying the first resource that the particular authentication technique is permitted by a policy associated with the first resource; provide the particular authentication technique to the first user account; and determine that the first user account failed the particular authentication technique.

13 . The non-transitory computer-readable storage medium of claim 12 , wherein determining that the first user account failed the particular authentication technique occurs prior to the determination that the authentication request is subject to the ongoing attack.

14 . The non-transitory computer-readable storage medium of claim 11 , wherein the instructions further configure the at least one processor to:
set a period in which the authentication service will require the first user account to authenticate with the first resource using the alternative authentication technique before allowing the first user account to authenticate with the particular authentication technique.

15 . The non-transitory computer-readable storage medium of claim 11 , wherein the first resource is associated with an access policy configured at

Assignees

• Cisco Tech Inc

Inventors

• Miel Shayne
• Terry Joshua
• Harang Richard
• Burchfield Kevin Tyler
• Gacusan Gillian
• Mcmahon Patrick
• Small Robert
• Ingman Jake

Classifications

• G06F21/45

  Structures or tools for the administration of authentication · CPC title

• G06F21/6245

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title