IP Library Granted Patent US 10,469,496
Granted Patent B2
US 10,469,496 · App. 16/401,799 · Granted Nov 5, 2019

Fabric assisted identity and authentication

Inventors: James Tischart (Parker, CO); Jonathan Anderson (Alpharetta, GA)
Assignee: MCAFEE, LLC
H04L63/0876H04L63/0272H04L63/0281H04L63/08H04L63/105H04L63/1433H04L63/162H04W12/06
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,469,496
App. No.
16/401,799
Granted
Nov 5, 2019
Kind
B2
Abstract

Context-based authentication in a secure network comprised of multiple programmable devices is described. A machine readable storage device or storage disk includes instructions that, when executed, cause a machine to obtain, from a programmable device, identity data and contextual data associated with a current authentication attempt by a user attempting to access a secure network. The contextual data indicates a number of authentication factors implementable by the programmable device in connection with the current authentication attempt. The instructions further cause the machine to determine a pattern associated with authentication of the user. The instructions further cause the machine to determine, based on the identity data, the number of authentication factors, and the pattern, a risk level associated with the current authentication attempt. The instructions further cause the machine to request additional identity data in response to the risk level not satisfying a threshold. The instructions further cause the machine to determine whether to permit access to the secure network based on the current authentication attempt and the additional identity data.

Claims (37)

1. A machine readable storage device or storage disk comprising instructions that, when executed, cause a machine to at least:

obtain, from a programmable device, identity data and contextual data associated with a current authentication attempt by a user attempting to access a secure network, the contextual data indicating a number of authentication factors implementable by the programmable device in connection with the current authentication attempt;

determine, based on the identity data and the contextual data, a pattern associated with authentication of the user;

determine, based on the identity data, the number of authentication factors indicated by the contextual data, and the pattern, a risk level associated with the current authentication attempt;

request additional identity data in response to the risk level not satisfying a threshold;

determine whether to permit access to the secure network based on the current authentication attempt and the additional identity data; and

invoke an authorization entity in response to determining not to permit access to the secure network based on the current authentication attempt and the additional data.

2. The machine readable storage device or storage disk of claim 1 , wherein the instructions, when executed, further cause the machine to access the secure network in response to the risk level satisfying the threshold.

3. The machine readable storage device or storage disk of claim 1 , wherein the instructions, when executed, further cause the machine to determine whether the programmable device is an approved device for the secure network.

4. The machine readable storage device or storage disk of claim 1 , wherein the instructions, when executed, further cause the machine to determine whether the programmable device is attempting to access the secure network via a physical communication mechanism.

5. The machine readable storage device or storage disk of claim 1 , wherein one or more of the identity data, the contextual data, and the pattern is communicated via an enterprise service bus (ESB).

6. The machine readable storage device or storage disk of claim 5 , wherein the ESB includes a data exchange layer.

7. The machine readable storage device or storage disk of claim 5 , wherein the ESB is to utilize message queuing telemetry transport messages.

8. A system for context-based authentication, the system comprising:

one or more processors; and

memory including instructions that, when executed, cause the one or more processors to:

access identity data and contextual data associated with a current authentication attempt by a user attempting to access a secure network with a user device, the contextual data indicating a number of authentication factors implementable by the user device in connection with the current authentication attempt;

determine, based on the identity data and the contextual data, a pattern associated with authentication of the user;

determine, based on the identity data, the number of authentication factors indicated by the contextual data, and the pattern, a risk level associated with the current authentication attempt;

request additional identity data in response to the risk level not satisfying a threshold;

determine whether to permit access to the secure network based on the current authentication attempt and the additional identity data; and

invoke an authorization entity in response to determining not to permit access to the secure network based on the current authentication attempt and the additional data.

9. The system of claim 8 , wherein the one or more processors are to permit access to the secure network in response the risk level satisfying the threshold.

10. The system of claim 8 , wherein the one or more processors are to determine whether the user device is an approved device for the secure network.

11. The system of claim 8 , wherein the one or more processors are to determine whether the attempted access is via a physical communication mechanism.

12. The system of claim 8 , wherein the one or more processors are to communicate one or more of the identity data, the contextual data, and the pattern via an enterprise service bus (ESB).

13. The system of claim 12 , wherein the ESB includes a data exchange layer.

14. The system of claim 12 , wherein the ESB is to utilize message queuing telemetry transport messages.

15. A method for context-based authentication in a secure network, the method comprising:

obtaining, from a user device, identity data and contextual data associated with a current authentication attempt by a user attempting to access the secure network, the contextual data indicating a number of authentication factors implementable by the user device in connection with the current authentication attempt;

determining, based on the identity data and the contextual data, a pattern associated with authentication of the user;

determining, based on the identity data, the number of authentication factors indicated by the contextual data, and the pattern, a risk level associated with the current authentication attempt;

requesting additional identity data in response to one or more processors determining the risk level does not satisfy a threshold;

determining whether to permit access to the secure network based on the current authentication attempt and the additional identity data;

invoking an authorization entity in response to determining not to permit access to the secure network based on the current authentication attempt and the additional data.

16. The method of claim 15 , further including permitting access to the secure network in response to the one or more processors determining the risk level satisfies the threshold.

17. The method of claim 15 , wherein the contextual data further indicates whether the user device is an approved device for the secure network, and whether the user device is attempting to access the secure network via a physical communication mechanism.

Assignments (4)
CORRECTIVE ASSIGNMENT TO CORRECT THE THE PATENT TITLES AND REMOVE DUPLICATES IN THE SCHEDULE PREVIOUSLY RECORDED AT REEL: 059354 FRAME: 0335. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT. Recorded Jun 23, 2022
From: MCAFEE, LLC
To: JPMORGAN CHASE BANK, N.A., AS ADMINISTRATIVE AGENT
Reel/Frame 060792/0307 →
SECURITY INTEREST Recorded Mar 3, 2022
From: MCAFEE, LLC
To: JPMORGAN CHASE BANK, N.A., AS ADMINISTRATIVE AGENT AND COLLATERAL AGENT
Reel/Frame 059354/0335 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded May 2, 2019
From: TISCHART, JAMES; ANDERSON, JONATHAN
To: MCAFEE, INC.
Reel/Frame 049066/0205 →
CHANGE OF NAME Recorded May 2, 2019
From: MCAFEE, INC.
To: MCAFEE, LLC
Reel/Frame 049076/0764 →
Continuity (2)
Continuation 15392454 · Dec 28, 2016
Related Publication 20190260744A1 · Aug 22, 2019