Contextual and risk-based multi-factor authentication
A system for contextual and risk-based multi-factor authentication having a multi-dimensional time series data server configured to monitor and record a network's traffic data and to serve the traffic data to other modules and a directed computation graph module configured to receive network traffic data from the multi-dimensional time series data server, determine a network traffic baseline from the network traffic data, and determine a verification score needed before granting access based at least in part by the network traffic baseline. A plurality of verification methods build up a user's verification score to required level to gain access.
1. A computer system configured to execute software instructions stored on nontransitory machine-readable storage media, wherein the software instructions comprise instructions that:
receive a request to authenticate a client, wherein the request comprises a first identifier and a password,
store, in a multidimensional time-series database, information about the request,
determine whether the password corresponds to a first user account identified by the first identifier,
determine whether an additional verification is required to grant access,
wherein determining whether the additional verification is required to grant access comprises:
retrieving, from the multidimensional time-series database, historical information about previous access requests associated with the first user account, and
determining, based at least on the historical information, whether the first user account is associated with a previous request to authenticate, wherein the previous request to authenticate comprised a second identifier not associated with the first user account; and,
based on the additional verification being required to grant access:
select an additional verification method from a plurality of verification methods,
cause the client to be prompted to complete the additional verification method, and
determine whether the additional verification method has been completed correctly.
2. The computer system of claim 1 , wherein determining whether the additional verification is required to grant access further comprises processing endpoint data from entities connected to the network.
3. The computer system of claim 1 , wherein determining whether the additional verification is required to grant access further comprises processing an external threat intelligence feed.
4. The computer system of claim 1 , wherein the second identifier is associated with a second user account, and wherein the second user account is different from the first user account.
5. The computer system of claim 1 , wherein the software instructions further comprise instructions that:
based on the additional verification being required to grant access;
determine that a probable cyberattack is detected, and
provide an alert,
wherein the alert includes the first identifier and an indicator that a probable cyberattack is detected, and
wherein the alert is designated to be provided to an administrator of the network.
6. The computer system of claim 5 , wherein the alert further includes an indication of where the probable cyberattack may have originated.
7. The computer system of claim 5 , wherein the alert further includes an indication of what enterprise information may be at risk in the probable cyberattack.
8. The computer system of claim 5 , wherein the alert further includes predictive information.
9. A method implemented on a computer system connected to a network, the method comprising:
receiving a request to authenticate a client, wherein the request comprises a first identifier and a password,
storing, in a multidimensional time-series database, information about the request,
determining whether the password corresponds to a first user account identified by the first identifier,
determining whether an additional verification is required to grant access,
wherein determining whether the additional verification is required to grant access comprises:
retrieving, from the multidimensional time-series database, historical information about previous access requests associated with the first user account,
determining, based at least on the historical information, whether the first user account is associated with a previous request to authenticate, wherein the previous request to authenticate comprised a second identifier not associated with the first user account; and,
based on the additional verification being required to grant access:
selecting an additional verification method from a plurality of verification methods,
causing the client to be prompted to complete the additional verification method, and
determining whether the additional verification method has been completed correctly.
10. The method of claim 9 , wherein determining whether the additional verification is required to grant access further comprises processing endpoint data from entities connected to the network.
11. The method of claim 9 , wherein determining whether the additional verification is required to grant access further comprises processing an external threat intelligence feed.
12. The method of claim 9 , wherein the second identifier is associated with a second user account, and wherein the second user account is different from the first user account.
13. The method of claim 9 , further comprising:
based on the additional verification being required to grant access:
determining that a probable cyberattack is detected, and
delivering an alert,
wherein the alert includes the first identifier and an indicator that a probable cyberattack is detected, and
wherein the alert is designated to be delivered to an administrator of the network.
14. The method of claim 13 , wherein the alert further includes an indication of where the probable cyberattack may have originated.
15. The method of claim 13 , wherein the alert further includes an indication of what enterprise information may be at risk in the probable cyberattack.
16. The method of claim 13 , wherein the alert further includes predictive information.
17. The method of claim 12 , further comprising:
based on the additional verification being required to grant access:
determining that a probable cyberattack is detected, and
delivering an alert,
wherein the alert includes the first identifier and an indicator that a probable cyberattack is detected, and
wherein the alert is designated to be delivered to an administrator of the network.
18. The method of claim 17 , wherein the alert further includes predictive information.
19. A computer system configured to execute software instructions stored on nontransitory machine-readable storage media, wherein the software instructions comprise instructions that:
receive a request to authenticate a client, wherein the request comprises a first identifier and a password,
store, in a multidimensional time-series database, information about the request,
determine whether the password corresponds to a user account identified by the first identifier,
determine whether an additional verification is required to grant access,
wherein determining whether the additional verification is required to grant access comprises:
retrieving, from the multidimensional time-series database, historical information about previous access requests associated with the user account,
determining, based at least on the historical information, whether the user account is associated with a plurality of previous requests to authenticate, wherein the plurality of previous requests to authenticate comprises at least one second identifier not associated with any user account; and,
based on the additional verification being required to grant access:
select an additional verification method from a plurality of verification methods,
cause the client to be prompted to complete the additional verification method, and
determine whether the additional verification method has been completed correctly.
20. The computer system of claim 19 , wherein determining whether the additional verification is required to grant access further comprises processing endpoint data from entities connected to the network.
21. The computer system of claim 19 wherein determining whether the additional verification is required to grant access further comprises processing an external threat intelligence feed.
22. The computer system of claim 19 , wherein selecting an additional verification method from a plurality of verification methods comprises processing at least a portion of the plurality of previous requests to authenticate.
23. The computer system of claim 19 , wherein the software instructions further comprise instructions that:
based on the additional verification being required to grant access:
determine that a probable cyberattack is detected, and
provide an alert,
wherein the alert includes the first identifier and an indicator that a probable cyberattack is detected, and
wherein the alert is designated to be provided to an administrator of the network.
24. The computer system of claim 23 , wherein the alert further includes an indication of where the probable cyberattack may have originated.
25. The computer system of claim 23 , wherein the alert further includes an indication of what enterprise information may be at risk in the probable cyberattack.
26. A method implemented on a computer system connected to a network, the method comprising:
receiving a request to authenticate a client, wherein the request comprises a first identifier and a password,
storing, in a multidimensional time-series database, information about the request,
determining whether the password corresponds to a user account identified by the first identifier,
determining whether an additional verification is required to grant access,
wherein determining whether the additional verification is required to grant access comprises:
retrieving, from the multidimensional time-series database, historical information about previous access requests associated with the user account,
determining, based at least on the historical information, whether the user account is associated with a plurality of previous requests to authenticate, wherein the plurality of previous requests to authenticate comprises at least one second identifier not associated with any user account; and
based on the additional verification being required to grant access:
selecting an additional verification method from a plurality of verification methods,
causing the client to be prompted to complete the additional verification method, and
determining whether the additional verification method has been completed correctly.
27. The method of claim 26 , wherein determining whether the additional verification is required to grant access further comprises processing endpoint data from entities connected to the network.
28. The method of claim 26 , wherein determining whether the additional verification is required to grant access further comprises processing an external threat intelligence feed.
29. The method of claim 26 , wherein selecting an additional verification method from a plurality of verification methods comprises processing at least a portion of the plurality of previous requests to authenticate.
30. The method of claim 29 , further comprising:
based on the additional verification being required to grant access:
determining that a probable cyberattack is detected, and
delivering an alert,
wherein the alert includes the first identifier and an indicator that a probable cyberattack is detected, and
wherein the alert is designated to be delivered to an administrator of the network.