Multi-path user authentication and threat detection system and related methods
Embodiments of systems and methods are provided to enhance network security by providing secure, multi-path user authentication, while also providing a more convenient login experience to the user. In the present disclosure, a cloud-based user authentication and threat detection system is provided with an artificial intelligence (AI) engine and a training dataset. Utilizing a cloud-based system enables the AI engine to collect data from multiple devices located within different physical locations or environments (such as, for example, the user's home and office). The collected data is stored within the training dataset and used to create a personalized user profile for each user. Each time a user initiates login to a system or network from a particular location, the AI engine collects data from multiple devices within that location and utilizes the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats.
1. A user authentication and threat detection system, comprising:
an artificial intelligence (AI) engine comprising a plurality of software modules, which are stored within a computer-readable medium and executed by a processing device of a first cloud-based information handling system (IHS) to:
collect data from multiple devices located within different locations, wherein the collected data comprises system and user-related data, which is:
first collected from a first set of devices located at a first location when a user initiates login to a protected network from the first location; and
then collected from a second set of devices located at a second location, which differs from the first location, when the user initiates log-in to the protected network from the second location;
store the collected data within a training dataset as user profile data; and
securely authenticate the user initiating login to the protected network from the second location or detect potential security threats to the protected network from the user initiating login to the protected network from the second location based, at least in part, on the user profile data comprising system and user-related data previously collected from the first location that is stored within the training dataset; and
the training dataset, wherein the training dataset is stored within the first cloud-based IHS or a second cloud-based IHS communicatively coupled to the first cloud-based IHS;
where the system and user-related data collected at each of the first and second locations comprises:
system data collected from a respective IHS from which the user initiates login at each of the first and second locations,
data collected from one or more respective trusted peripheral devices at each of the first and second locations, and
data collected from one or more devices linked to the trusted peripheral devices at each of the first and second locations.
2. The user authentication and threat detection system as recited in claim 1 , wherein the plurality of software modules comprise a data collection module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the data collection module is executed by the processing device to:
collect data from the IHS and one or more trusted devices located within the particular location, wherein the one or more trusted devices comprise at least one of the trusted peripheral devices and the one or more devices linked to the at least one trusted peripheral device; and
add the collected data to the user profile data stored within the training dataset.
3. The user authentication and threat detection system as recited in claim 2 , wherein the at least one trusted peripheral device is selected from a group comprising a laptop computer, a tablet computer, a security camera, and a smart device.
4. The user authentication and threat detection system as recited in claim 2 , wherein the one or more devices linked to the at least one trusted peripheral device is a smart device.
5. The user authentication and threat detection system as recited in claim 1 , where the system data collected from the respective IHS from which the user initiates login at each of the first and second locations comprises at least one of calendar data, voice commands, or a list comprising one or more of the user's most frequently used applications.
6. The user authentication and threat detection system as recited in claim 1 , where the data collected from each of the one or more respective trusted peripheral devices at each of the first and second locations comprises at least one of a signal strength of a cellular signal emitted from each of the one or more respective trusted peripheral devices, audio signals obtained by each of the one or more respective trusted peripheral devices, or video signals obtained by each of the one or more respective trusted peripheral devices.
7. The user authentication and threat detection system as recited in claim 1 , where the data collected from each of the one or more devices linked to the trusted peripheral devices at each of the first and second locations comprises at least one of a signal strength of a cellular signal emitted from each of the one or more devices linked to the trusted peripheral devices, audio signals obtained by each of the one or more devices linked to the trusted peripheral devices, or video signals obtained by each of the one or more devices linked to the trusted peripheral devices.
8. A user authentication and threat detection system, comprising:
an artificial intelligence (AI) engine comprising a plurality of software modules, which are stored within a computer-readable medium and executed by a processing device of a first cloud-based information handling system (IHS) to:
collect data from multiple devices located within different locations, wherein the collected data comprises system and user-related data, which is collected from:
a first set of devices located at a first location when a user initiates login to a protected network from the first location; and
a second set of devices located at a second location, which differs from the first location, when the user initiates login to the protected network from the second location;
store the collected data within a training dataset as user profile data; and
securely authenticate the user or detect potential security threats to the protected network based, at least in part, on the user profile data stored within the training dataset; and
the training dataset, wherein the training dataset is stored within the first cloud-based IHS or a second cloud-based IHS communicatively coupled to the first cloud-based IHS;
wherein the plurality of software modules comprise a data collection module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the data collection module is executed by the processing device to:
collect data from the IHS and one or more trusted devices located within the particular location, wherein the one or more trusted devices comprise at least one trusted peripheral device and/or one or more devices linked to the at least one trusted peripheral device, and
add the collected data to the user profile data stored within the training dataset; and
wherein the plurality of software modules comprise a new device detection module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the new device detection module is executed by the processing device to:
detect a new device located within the particular location,
establish trust between the IHS and the new device by exchanging a token between the IHS and the new device, and
add the new device as a trusted device, if the token exchange is successful, so that the data collection module can begin collecting data from the new device and adding the collected data to the user profile data.
9. A user authentication and threat detection system, comprising:
an artificial intelligence (AI) engine comprising a plurality of software modules, which are stored within a computer-readable medium and executed by a processing device of a first cloud-based information handling system (IHS) to:
collect data from multiple devices located within different locations, wherein the collected data comprises system and user-related data, which is collected from:
a first set of devices located at a first location when a user initiates login to a protected network from the first location; and
a second set of devices located at a second location, which differs from the first location, when the user initiates login to the protected network from the second location;
store the collected data within a training dataset as user profile data; and
securely authenticate the user or detect potential security threats to the protected network based, at least in part, on the user profile data stored within the training dataset; and
the training dataset, wherein the training dataset is stored within the first cloud-based IHS or a second cloud-based IHS communicatively coupled to the first cloud-based IHS;
wherein the plurality of software modules comprise a data collection module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the data collection module is executed by the processing device to:
collect data from the IHS and one or more trusted devices located within the particular location, wherein the one or more trusted devices comprise at least one trusted peripheral device and/or one or more devices linked to the at least one trusted peripheral device, and
add the collected data to the user profile data stored within the training dataset; and
wherein the plurality of software modules comprise a user authentication and threat detection module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the user authentication and threat detection module is executed by the processing device to:
attempt to detect an identity or presence of the user at the particular location based on the user profile data stored within the training dataset and the data, which was collected from the IHS and the one or more trusted devices located within the particular location when the user initiated log-in,
authenticate the user and grant access to the protected network, if the identity or presence of the user is detected at the particular location, and
deny the user access to the protected network, if the identity or presence of the user is not detected at the particular location.
10. The user authentication and threat detection system as recited in claim 9 , wherein if the identity or presence of the user is not detected at the particular location, the user authentication and threat detection module is further executed by the processing device to:
attempt to authenticate the user via one or more additional authentication methods or factors before granting or denying user access to the protected network;
grant the user access to the protected network, if the one or more additional authentication methods or factors successfully authenticate the user; and
deny the user access to the protected network, if the one or more additional authentication methods or factors fail to authenticate the user.
11. The user authentication and threat detection system as recited in claim 9 , wherein the plurality of software modules further comprise an accuracy module, wherein each time the user initiates login to the protected network from an IHS located at a particular location, the accuracy module is executed by the processing device to:
determine a prediction accuracy or probability that the user is physically present at the particular location.
12. The user authentication and threat detection system as recited in claim 11 , wherein the user authentication and threat detection module is further executed by the processing device to:
authenticate the user and grant access to the protected network, if the prediction accuracy is greater than a predetermined prediction threshold;
attempt to authenticate the user via one or more additional authentication methods or factors, if the prediction accuracy is less than the predetermined accuracy threshold; and
deny the user access to the protected network, if the prediction accuracy is less than the predetermined accuracy threshold and the one or more additional authentication methods or factors fail to authenticate the user.
13. The user authentication and threat detection system as recited in claim 11 , wherein the user authentication and threat detection module is further executed by the processing device to:
detect a security threat to the protected network, if the prediction accuracy is less than the predetermined accuracy threshold and the one or more additional authentication methods or factors fail to authenticate the user.
14. A computer implemented method, comprising:
first receiving a notification of user login from an information handling system (IHS) located at a first location when a user initiates login to a protected network from the IHS;
then collecting data from the IHS and one or more trusted devices located within the first location, wherein the collected data comprises system and user-related data;
then adding the collected data from the IHS and one or more trusted devices located within the first location to user profile data previously stored within a training dataset; and
then using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network on the information handling system (IHS) located at the first location;
wherein the user profile data previously stored within the training dataset comprises system and user-related data previously collected from an IHS and one or more trusted devices located within a second location when the user previously initiated login to the protected network from the second location; and
where the system and user-related data collected at each of the first and second locations comprises:
system data collected from a respective IHS from which the user initiates login at each of the first and second locations,
data collected from one or more respective trusted peripheral devices at each of the first and second locations, and
data collected from one or more devices linked to the trusted peripheral devices at each of the first and second locations.
15. The computer implemented method as recited in claim 14 , where the system data collected from the respective IHS from which the user initiates login at each of the first and second locations comprises at least one of calendar data, voice commands, or a list comprising one or more of the user's most frequently used applications.
16. The computer implemented method as recited in claim 14 , where the data collected from each of the one or more respective trusted peripheral devices at each of the first and second locations comprises at least one of a signal strength of a cellular signal emitted from each of the one or more respective trusted peripheral devices, audio signals obtained by each of the one or more respective trusted peripheral devices, or video signals obtained by each of the one or more respective trusted peripheral devices.
17. The computer implemented method as recited in claim 14 , where the data collected from each of the one or more devices linked to the trusted peripheral devices at each of the first and second locations comprises at least one of a signal strength of a cellular signal emitted from each of the one or more devices linked to the trusted peripheral devices, audio signals obtained by each of the one or more devices linked to the trusted peripheral devices, or video signals obtained by each of the one or more devices linked to the trusted peripheral devices.
18. A computer implemented method, comprising:
receiving a notification of user login from an information handling system (IHS) located at a first location when a user initiates login to a protected network from the IHS;
collecting data from the IHS and one or more trusted devices located within the first location, wherein the collected data comprises system and user-related data;
adding the collected data to user profile data previously stored within a training dataset; and
using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network;
where after receiving the notification of user login, the computer implemented method further comprises:
detecting a new device located within the first location, and
establishing trust between the IHS located at the first location and the new device located at the first location by exchanging a token between the IHS located at the first location and the new device located at the first location to ensure physical proximity of the new linked device to the IHS; and
wherein if the token exchange is successful, the computer-implemented method further comprises:
adding the new device as a new trusted device,
collecting data from the new trusted device, and
adding the data collected from the new trusted device to the user profile data.
19. A computer implemented method, comprising:
receiving a notification of user login from an information handling system (IHS) located at a first location when a user initiates login to a protected network from the IHS;
collecting data from the IHS and one or more trusted devices located within the first location, wherein the collected data comprises system and user-related data;
adding the collected data to user profile data previously stored within a training dataset; and
using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network;
wherein said using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network comprises using the collected data and the user profile data to:
determine if the user's login behavior is normal, and
detect if at least one trusted device of the one or more trusted devices is in range of the IHS located at the first location; and
where the user's login behavior is determined to be normal if the user initiates the log-in from the IHS located at a first location during normal work hours of the user and/or during a previously scheduled meeting time, and where the user's log-in behavior is determined to be abnormal if the user initiates the login from the IHS located at a first location not during normal work hours of the user and/or not during a previously scheduled meeting time.
20. The computer implemented method as recited in claim 19 , wherein if the user's login behavior is normal and the at least one trusted device is in range of the IHS, the computer implemented method further comprises:
authenticating the user; and
logging the user into the protected network.
21. The computer implemented method as recited in claim 19 , wherein if the user's login behavior is abnormal, or the at least trusted device is not in range of the IHS, the computer implemented method further comprises:
determining if the collected data and the user profile data can be used to detect user presence at the location of the IHS located at the first location with an accuracy greater than a predetermined accuracy threshold.
22. The computer implemented method as recited in claim 21 , wherein if user presence is detected at the location of the IHS located at the first location with an accuracy greater than the predetermined accuracy threshold, the computer implemented method further comprises:
authenticating the user; and
logging the user into the protected network.
23. The computer implemented method as recited in claim 21 , wherein if user presence is detected at the location of the IHS located at the first location with an accuracy less than the predetermined accuracy threshold, the computer implemented method further comprises:
determining user authentication via one or more additional authentication methods or factors;
granting the user access to the protected network, if the one or more additional authentication methods or factors successfully authenticate the user; and
denying the user access to the protected network, if the one or more additional authentication methods or factors fail to authenticate the user.
24. The computer implemented method as recited in claim 21 , if the one or more additional authentication methods or factors successfully authenticate the user, the computer implemented method further comprises:
logging the user into the protected network; and
opening one or more of the user's frequently used applications.
25. A computer implemented method, comprising:
receiving a notification of user login from an information handling system (IHS) located at a first location when a user initiates login to a protected network from the IHS;
collecting data from the IHS and one or more trusted devices located within the first location, wherein the collected data comprises system and user-related data;
adding the collected data to user profile data previously stored within a training dataset; and
using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network;
wherein said using the collected data and the user profile data previously stored within the training dataset to securely authenticate the user or detect potential security threats to the protected network comprises using the collected data and the user profile data to:
determine if the user's login behavior is normal, and
detect if at least one trusted device of the one or more trusted devices is in range of the IHS;
wherein if the user's login behavior is normal and the at least one trusted device is in range of the IHS, the computer implemented method further comprises:
authenticating the user, and
logging the user into the protected network; and
wherein if the user's login behavior is normal and the at least one trusted device is in range of the IHS, the computer implemented method further comprises:
opening one or more of the user's frequently used applications.