System and method for providing an authentication engine in a persistent authentication framework
An authentication engine for an information handling system includes an event engine that receives authentication information from a plurality of input devices of the information handling system and classifies the authentication information from each input device into a plurality of events, and provides confidence score metadata based upon the authentication information, a confidence module that generates a confidence score based upon the events, and a threshold table that receives the confidence score and determines an authentication state of the information handling system based upon the confidence score.
1. An authentication engine for an information handling system, the authentication engine comprising:
a hardware memory; and
a hardware processor configure to instantiate:
an event engine that receives authentication information from a plurality of input devices of the information handling system and classifies the authentication information from each input device into a plurality of events, and provides confidence score metadata based upon the authentication information;
a confidence module that generates a confidence score based upon the events; and
a threshold table that receives the confidence score and determines an authentication state of the information handling system based upon the confidence score, wherein when the confidence score rises above a first threshold level the authentication state is at a first state, when the confidence score rises above a second threshold higher than the first threshold the authentication state is at a second state, and when the confidence score falls below the second threshold the authentication state returns to the first state;
wherein the events include a risk event that decreases the confidence score, an assurance event that increases the confidence score, a context event that indicates that an operating state of the information handling system has changed, and a time-based event; and
wherein in generating the confidence score the confidence module further permits a dwell time during which the confidence score remains constant without additional inputs from the input devices, linearly decreases the confidence score after the dwell time without the additional inputs from the input devices, graphs a region of passive authentication that increases the confidence score, detects a reverse authentication event indicating a loss of a network connection, retrieves a logical rule that reduces the confidence score in response to the detecting of the reverse authentication event indicating the loss of the network connection, and provides the confidence score to the threshold table.
2. The authentication engine of claim 1 , wherein the authentication engine receives an authentication request, and generating the confidence score is in response to receiving the authentication request.
3. The authentication engine of claim 2 , wherein providing the confidence score metadata is in further response to receiving the authentication request.
4. The authentication engine of claim 2 , wherein determining the authentication state is in further response to receiving the authentication request.
5. The authentication engine of claim 1 , the processor further to instantiate:
a time base, wherein the confidence score metadata is further based upon the time base.
6. The authentication engine of claim 1 , wherein the plurality of events comprises risk events, assurance events, context events, and recognition events.
7. The authentication engine of claim 1 , wherein the threshold table comprises a plurality of thresholds.
8. The authentication engine of claim 7 , wherein in determining the authentication state, the threshold table compares the confidence score to the plurality of thresholds.
9. The authentication engine of claim 7 , wherein the plurality of thresholds are selectable via a basic input output system (BIOS) of the information handling system.
10. A method, comprising:
receiving, at an event engine instantiated on a hardware processor of an authentication engine of an information handling system, authentication information from a plurality of input devices of the information handling system;
classifying the authentication information from each input device into a plurality of events;
providing confidence score metadata based upon the authentication information;
generating a confidence score based upon the events, wherein in generating the confidence score, the method further comprises:
permitting a dwell time during which the confidence score remains constant without additional inputs from the input devices;
linearly decreasing the confidence score after the dwell time without additional inputs from the input devices;
graphing a region of passive authentication that increases the confidence score;
detecting a reverse authentication event indicating a loss of a network connection; and
retrieving a logical rule that reduces the confidence score in response to the detecting of the reverse authentication event indicating the loss of the network connection;
receiving, at a threshold table instantiated on the hardware processor, the confidence score, wherein the events include a risk event that decreases the confidence score, an assurance event that increases the confidence score, a context event that indicates that an operating state of the information handling system has changed, and a time-based event; and
determining an authentication state of the information handling system based upon the confidence score, wherein when the confidence score rises above a first threshold level the authentication state is at a first state, when the confidence score rises above a second threshold higher than the first threshold the authentication state is at a second state, and when the confidence score falls below the second threshold the authentication state returns to the first state.
11. The method of claim 10 , further comprising:
receiving an authentication request, wherein generating the confidence score is in response to receiving the authentication request.
12. The method of claim 11 , wherein providing the confidence score metadata is in further response to receiving the authentication request.
13. The method of claim 11 , wherein determining the authentication state is in further response to receiving the authentication request.
14. The method of claim 10 , wherein the confidence score metadata is further based upon a time base.
15. The method of claim 10 , wherein the plurality of events comprises risk events, assurance events, context events, and recognition events.
16. The method of claim 10 , wherein the threshold table comprises a plurality of thresholds.
17. The method of claim 16 , wherein in determining the authentication state, the method further comprises:
comparing, by the threshold table, the confidence score to the plurality of thresholds.
18. The method of claim 16 , further comprising;
selecting the plurality of thresholds via a basic input output system (BIOS) of the information handling system.
19. A non-transitory computer-readable medium including code for performing a method, the method comprising:
receiving, at an event engine of an authentication engine of an information handling system, authentication information from a plurality of input devices of the information handling system;
classifying the authentication information from each input device into a plurality of events;
providing confidence score metadata based upon the authentication information;
generating a confidence score based upon the events, wherein in generating the confidence score, the method further comprises:
permitting a dwell time during which the confidence score remains constant without additional inputs from the input devices;
linearly decreasing the confidence score after the dwell time without the additional inputs from the input devices;
graphing a region of passive authentication that increases the confidence score;
detecting a reverse authentication event indicating a loss of a network connection: and
retrieving a logical rule that reduces the confidence score in response to the detecting of the reverse authentication event indicating the loss of the network connection;
receiving, at a threshold table of an authentication engine, the confidence score, wherein the events include a risk event that decreases the confidence score, an assurance event that increases the confidence score, a context event that indicates that an operating state of the information handling system has changed, and a time-based event; and
determining an authentication state of the information handling system based upon the confidence score, wherein when the confidence score rises above a first threshold level the authentication state is at a first state, when the confidence score rises above a second threshold higher than the first threshold the authentication state is at a second state, and when the confidence score falls below the second threshold the authentication state returns to the first state.
20. The computer-readable medium of claim 19 , wherein:
the threshold table comprises a plurality of thresholds; and
in determining the authentication state, the method further comprises comparing, by the threshold table, the confidence score to the plurality of thresholds.