Adaptive multi-factor authentication system with multi-user permission strategy to access sensitive information
Systems and related methods for providing greater security and control over access to protected or classified resources, files and documents and other forms of sensitive information based upon an initial adaptive selection of multiple modalities for authentication in different operating environments, with subsequent multi-user permission strategy centering on organizational structure. The system calculates trustworthiness values of different authentication factors under various environmental settings, and combines a trust-based adaptive, robust and scalable software-hardware framework for the selection of authentication factors for continuous and triggered authentication with optimal algorithms to determine the security parameters of each of the authentication factors. A subset of authentication factors thus are determined for application at triggering events on-the-fly, thereby leaving no exploitable a priori pattern or clue for hackers to exploit. Upon authentication of an access request, based on the sensitivity or classification of the information being requested by a user, approvers are selected dynamically based on the work environment (e.g., mobility, use of the computing device seeking access, access policy, and the like). The selected sets of approvers are non-repetitive in nature.
1. A method for accessing classified documents or resources on a computer network, comprising the steps of:
receiving from a first user an electronically-communicated request to access at least one classified document or resource of an organization stored on a computer network, wherein said at least one classified document has a classification level;
ranking one or more authentication modalities to use for authentication of the access request from the first user;
applying said one or more authentication modalities in order of ranking to the access request from the first user;
after authenticating the access request from the first user, generating a set of possible approvers for the access request from the first user, wherein the set of possible approvers is determined using an access control graph providing relative roles and rankings of employees in the organization, and is based on a possible approvers' rank with respect to the first user, and the current availability of the possible approvers;
determining the number of separate approvals required for access to the at least one classified document or resource,
generating a set of permission grantors from the set of possible approvers, wherein the size of the set of permission grantors equals the number of separate approvals required;
transmitting requests for permission for the first user's access request to the set of permission grantors;
receiving approvals in real time or near real-time from the set of permission grantors; and
providing the first user access to the requested at least one classified document or resource.
2. The method of claim 1 , wherein the number of separate approvals required for access is based on the classification level of the at least one classified document.
3. The method of claim 1 , wherein the set of possible approvers is based on the key result area (KRA) of the first user.
4. The method of claim 1 , where communication with the permission grantors is through high-bandwidth mobile devices operated by the permission grantors.
5. The method of claim 1 , further comprising the steps of:
maintaining a user access log; and
maintaining an approval log.
6. The method of claim 5 , wherein the user access log and approval logs are stored at a geographically remote and separate location from the computer network of the organization.
7. The method of claim 5 , further comprising identifying high-risk events or activities.
8. The method of claim 7 , wherein the high-risk events or activities include unexpected or anomalous incidents, discrepancies in access and approval logs, and instances where the first user also is an approver.
9. The method of claim 1 , wherein generating a set of possible approvers further comprises automatic implementation of an organizational security policy for classified document or resource access.
10. The method of claim 1 , wherein the set of permission grantors for the first user's access request is non-repetitive.
11. The method of claim 1 , wherein the set of permission grantors for the first user's access request is not known to the first user.
12. The method of claim 1 , wherein the step of ranking one or more authentication modalities comprises the steps of:
determining the objective trustworthiness value for each modality based on user access device trustworthiness factors and user connection media trustworthiness factors for said modality;
determining a penalty value for each modality based on the computation complexity cost factor for said modality and the previous selection history of said modality for previous authentication verification events; and
ranking the authentication modalities based on the objective trustworthiness value and the penalty value.
13. The method of claim 12 , wherein the user input devices comprise fixed devices, mobile devices, hand-held devices, or combinations thereof.
14. The method of claim 12 , wherein the user connection media comprise wired, wireless, cellular, or combinations thereof.
15. The method of claim 1 , wherein said authentication modalities comprise one or more of the following modalities: facial recognition, fingerprint recognition, password, CAPTCHA, voice recognition, and keystroke analysis.