System and methods to establish user profile using multiple channels
Embodiments of the disclosure provide a method of establishing a user profile using multiple channels. Embodiments allow compatibility of the user profile across several authentication systems. The user profile is created upon registration and is updated with attributes after authenticating and authorizing the user according to a pre-defined assurance level. The user profile contains attributes pertaining to the user and user device. The attributes can be analyzed by authentication systems to optimize data security.
1. A method for authenticating a user to access information and services protected by an authentication system, the method comprising:
receiving a request from a user device to access the information and services protected by the authentication system;
capturing device, application and user authentication attributes during the authentication;
comparing the captured device, application and user authentication attributes against previously obtained device, application and user authentication attributes stored in a database associated with the user device and stored as part of a user profile containing the previously obtained device, application and user attributes, wherein the user profile is stored in association with one or more user device profiles, one or more user application profiles, and one or more user authentication profiles, and wherein the one or more user device profiles uniquely identifies at least one device associated with the user;
calculating a risk score based on the comparison of the captured device, application and user authentication attributes against the previously obtained device, application and user authentication attributes; and
determining whether to grant the user device access to the information and services based on the risk score,
wherein the determining whether to grant access to the information and services based on the risk score comprises:
comparing the risk score to one or more of a first predetermined threshold risk level and a second predetermined threshold risk level, wherein the first predetermined threshold risk level is set such that when the risk score meets or exceeds the first predetermined threshold risk level, authentication of the user to access the information and services is achieved with high assurance, and the second predetermined threshold risk level is set such that when the risk score meets or exceeds the second predetermined threshold risk level but not the first predetermined threshold risk level, authentication of the user to access the information and services is achieved with low assurance;
granting access to the information and services in response to the risk score meeting or exceeding either the first predetermined threshold risk level or the second predetermined risk level,
wherein when the risk score meets or exceeds the first predetermined threshold risk level, the method further comprises:
updating the user profile with the captured device, application and user authentication attributes in response to the authentication of the user to access the information and services being achieved with high assurance, and
wherein when the risk score meets or exceeds the second predetermined threshold risk level but not the first predetermined risk threshold level, the method further comprises:
comparing device attributes of the captured device, application and user authentication attributes against device attributes of the previously obtained device, application and user authentication attributes;
in response to common device attributes between the captured device, application and user authentication attributes and the previously obtained device, application and user authentication attributes, upgrading from the low assurance of the authentication to an authentication with high assurance and updating the user profile with the captured device, application and user authentication attributes; and
in response to no common device attributes between the captured device, application and user authentication attributes and the previously obtained device, application and user authentication attributes, the authentication remains at low assurance and the user profile is not updated with the captured device, application and user authentication attributes.
2. The method of claim 1 , further comprising obtaining identification information of the user from the captured device, application and user authentication attributes.
3. The method of claim 2 , further comprising accessing contents of the user profile stored in a database using the identification information of the user.
4. The method of claim 2 , wherein obtaining the identification information of the user comprises obtaining a handle of the user profile based on the identification information of the user.
5. The method of claim 4 , further comprising accessing the contents of the user profile stored in a database using the handle of the user profile.
6. The method of claim 1 , wherein the user profile contains multiple channels including the one or more user device profiles, one or more user authentication profiles, and one or more user application profiles.
7. The method of claim 1 , wherein the user profile is interchangeable across different authentication systems.
8. The method of claim 7 , wherein the user authentication attributes are accessible regardless of the authentication system used.
9. The method of claim 1 , wherein the user profile is accessible by a plurality of user devices associated with the user.
10. The method of claim 1 , wherein the device, application and user authentication attributes pertaining to the user device comprise a device type, a device hardware and software configuration, an access technology used to access the information and services, and device hygiene data.
11. A method for authenticating a user to access information and services protected by an authentication system, the method comprising:
receiving a request from a user device to access the information and services protected by the authentication system;
capturing device, application and user authentication attributes during the authentication;
comparing the captured device, application and user authentication attributes against previously obtained device, application and user authentication attributes stored in a database associated with the user device and stored as part of a user profile containing the previously obtained device, application and user attributes, wherein the user profile is stored in association with one or more user device profiles, one or more user application profiles, and one or more user authentication profiles, and wherein the one or more user device profiles uniquely identifies at least one device associated with the user;
calculating a risk score based on the comparison of the captured device, application and user authentication attributes against the previously obtained device, application and user authentication attributes; and
determining whether to grant the user device access to the information and services based on the risk score,
wherein the determining whether to grant access to the information and services based on the risk score comprises:
comparing the risk score to one or more of a first predetermined threshold risk level and a second predetermined threshold risk level, wherein the first predetermined threshold risk level is set such that when the risk score meets or exceeds the first predetermined threshold risk level, authentication of the user to access the information and services is achieved with high assurance, and the second predetermined threshold risk level is set such that when the risk score meets or exceeds the second predetermined threshold risk level but not the first predetermined threshold risk level, authentication of the user to access the information and services is achieved with low assurance;
granting access to the information and services in response to the risk score meeting or exceeding the second predetermined threshold risk level and not the first predetermined threshold risk level;
comparing device attributes of the captured device, application and user authentication attributes against device attributes of the previously obtained device, application and user authentication attributes;
in response to common device attributes between the captured device, application and user authentication attributes and the previously obtained device, application and user authentication attributes, upgrading from the low assurance of the authentication to an authentication with high assurance and updating the user profile with the captured device, application and user authentication attributes; and
in response to no common device attributes between the captured device, application and user authentication attributes and the previously obtained device, application and user authentication attributes, the authentication remains at low assurance and the user profile is not updated with the captured device, application and user authentication attributes.
12. The method of claim 11 , wherein the device, application and user authentication attributes pertaining to the user device comprise a device type, a device hardware and software configuration, an access technology used to access the information and services, and device hygiene data.
13. A non-transitory computer readable storage device for authenticating a user to access information and services protected by an authentication system, the non-transitory computer readable storage device having computer executable instructions for performing the steps of:
receiving a request from a user device to access the information and services protected by the authentication system;
capturing device, application and user authentication attributes during the authentication;
comparing the captured device, application and user authentication attributes against previously obtained device, application and user authentication attributes stored in a database associated with the user device and stored as part of a user profile containing the previously obtained device, application and user attributes, wherein the user profile is stored in association with one or more user device profiles, one or more user application profiles, and one or more user authentication profiles, and wherein the one or more device profiles uniquely identifies at least one device associated with the user;
calculating a risk score based on the comparison of the captured device, application and user authentication attributes against the previously obtained device, application and user authentication attributes; and
determining whether to grant the user device access to the information and services based on the risk score,
wherein the determining whether to grant access to the information and services based on the risk score comprises:
comparing the risk score to one or more of a first predetermined threshold risk level and a second predetermined threshold risk level, wherein the first predetermined threshold risk level is set such that when the risk score meets or exceeds the first predetermined threshold risk level, authentication of the user to access the information and services is achieved with high assurance, and the second predetermined threshold risk level is set such that when the risk score meets or exceeds the second predetermined threshold risk level but not the first predetermined threshold risk level, authentication of the user to access the information and services is achieved with low assurance;
granting access to the information and services in response to the risk score meeting or exceeding either the first predetermined threshold risk level or the second predetermined risk level,
wherein when the risk score meets or exceeds the first predetermined threshold risk level, the method further comprises:
updating the user profile with the captured device, application and user authentication attributes in response to the authentication of the user to access the information and services being achieved with high assurance, and
wherein when the risk score meets or exceeds the second predetermined threshold risk level but not the first predetermined risk threshold level, the method further comprises:
comparing device attributes of the captured device, application and user authentication attributes against device attributes of the previously obtained device, application and user authentication attributes;
in response to common device attributes between the captured device, application and user authentication attributes and the previously obtained device, application and user authentication attributes, upgrading from the low assurance of the authentication to an authentication with high assurance and updating the user profile with the captured device, application and user authentication attributes; and
in response to no common device attributes between the captured device, application and user authentication attributes and the previously obtained device, application and user authentication attributes, the authentication remains at low assurance and the user profile is not updated with the captured device, application and user authentication attributes.
14. A non-transitory computer readable storage device for authenticating a user to access information and services protected by an authentication system, the non-transitory computer readable storage device having computer executable instructions for performing the steps of:
receiving a request from a user device to access the information and services protected by the authentication system;
capturing device, application and user authentication attributes during the authentication;
comparing the captured device, application and user authentication attributes against previously obtained device, application and user authentication attributes stored in a database associated with the user device and stored as part of a user profile containing the previously obtained device, application and user attributes, wherein the user profile is stored in association with one or more user device profiles, one or more user application profiles, and one or more user authentication profiles, and wherein the one or more device profiles uniquely identifies at least one device associated with the user;
calculating a risk score based on the comparison of the captured device, application and user authentication attributes against the previously obtained device, application and user authentication attributes; and
determining whether to grant the user device access to the information and services based on the risk score,
wherein the determining whether to grant access to the information and services based on the risk score comprises:
comparing the risk score to one or more of a first predetermined threshold risk level and a second predetermined threshold risk level, wherein the first predetermined threshold risk level is set such that when the risk score meets or exceeds the first predetermined threshold risk level, authentication of the user to access the information and services is achieved with high assurance, and the second predetermined threshold risk level is set such that when the risk score meets or exceeds the second predetermined threshold risk level but not the first predetermined threshold risk level, authentication of the user to access the information and services is achieved with low assurance;
granting access to the information and services in response to the risk score meeting or exceeding the second predetermined threshold risk level and not the first predetermined threshold risk level;
comparing device attributes of the captured device, application and user authentication attributes against device attributes of the previously obtained device, application and user authentication attributes;
in response to common device attributes between the captured device, application and user authentication attributes and the previously obtained device, application and user authentication attributes, upgrading from the low assurance of the authentication to an authentication with high assurance and updating the user profile with the captured device, application and user authentication attributes; and
in response to no common device attributes between the captured device, application and user authentication attributes and the previously obtained device, application and user authentication attributes, the authentication remains at low assurance and the user profile is not updated with the captured device, application and user authentication attributes.