Granted Patent B2

US 12,730,874 · App. 18/218,452 · Granted Sep 8, 2026

Inventors: Ewa Karweta (Chesapeake, VA); Jill S. Dhillon (Jupiter, FL); John Jacob Mutter (Mount Pleasant, SC); Tiberiu Suto (Franklin, NY); Neil Delima (Scarborough, CA)

Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION

G06F21/40G06F21/32

Abstract

Claims (65)

1 . A computer-implemented method, comprising:

in response to receiving a request from a user and determining that a recently verified token group exists, determining whether a supplemental authorization requirement associated with the user has been met;

in response to determining the supplemental authorization requirement has been met and that the user is authorized to issue the request, generating a multi-factor authentication challenge for the user, the multi-factor authentication challenge including a dynamic combination of available authentication factors corresponding to the user, wherein the dynamic combination of authentication factors includes (i) at least one user defined authentication factor, (ii) at least one biometric authentication factor, and (iii) at least one activity-based authentication factor;

using a digital twin of the user to satisfy at least one of the authentication factors in the multi-factor authentication challenge;

receiving inputs for remaining unsatisfied ones of the authentication factors in the multi-factor authentication challenge; and

determining whether the inputs received satisfy the remaining unsatisfied ones of the authentication factors in the multi-factor authentication challenge.

2 . The computer-implemented method of claim 1 , wherein the inputs received include (i) user defined information, (ii) biometric information, and (iii) activity-based information collected from the user, wherein the user defined information, biometric information, and activity-based information collected from the user is hashed and randomized before being stored in memory, wherein one or more of the inputs received correspond to the at least one user defined authentication factor, wherein the one or more received inputs that correspond to the at least one user defined authentication factor are received directly from the user.

3 . The computer-implemented method of claim 1 , wherein one or more of the inputs received correspond to the at least one biometric authentication factor and/or the at least one activity-based authentication factor, wherein the one or more received inputs that correspond to the at least one biometric authentication factor and/or the at least one activity-based authentication factor are received from one or more sensors configured to collect biometric and/or activity-based information associated with the user.

4 . The computer-implemented method of claim 1 , comprising:

in response to determining that the inputs received satisfy the remaining unsatisfied ones of the authentication factors in the multi-factor authentication challenge, causing the request to be satisfied.

5 . The computer-implemented method of claim 1 , comprising:

in response to determining that the inputs received do not satisfy one or more of the remaining unsatisfied ones of the authentication factors in the multi-factor authentication challenge, causing the request to be denied.

6 . The computer-implemented method of claim 1 , comprising:

in response to determining the inputs received do not satisfy the multi-factor authentication challenge, generating an updated multi-factor authentication challenge having a second dynamic combination of the available authentication factors;

using the digital twin of the user to satisfy at least one of the authentication factors in the updated multi-factor authentication challenge; and

issuing requests to the user for inputs for remaining unsatisfied ones of the authentication factors in the updated multi-factor authentication challenge.

7 . The computer-implemented method of claim 1 , wherein generating the multi-factor authentication challenge includes using a machine learning model to create the dynamic combination of authentication factors in the multi-factor authentication challenge, wherein a number of authentication factors in the multi-factor authentication challenge is based at least in part on a type of request that is received.

8 . The computer-implemented method of claim 7 , wherein generating the multi-factor authentication challenge for the user includes:

evaluating the type of request that is received and determining: a first number of user defined authentication factors, a second number of biometric authentication factors, and a third number of activity-based authentication factors, to use to generate the multi-factor authentication challenge;

selecting the first number of user defined authentication factors randomly from a list of known user defined authentication factors;

selecting the second number of biometric authentication factors randomly from a list of known biometric authentication factors;

selecting the third number of activity-based authentication factors randomly from a list of known activity-based authentication factors; and

forming the multi-factor authentication challenge by combining the randomly selected first number of user defined authentication factors with the randomly selected second number of biometric authentication factors and the randomly selected third number of activity-based authentication factors to.

9 . The computer-implemented method of claim 1 , comprising:

in response to determining that: a recently verified token group does not exist and/or the supplemental authorization requirement associated with the user has not been met, determining whether compromised and/or altered credentials are present;

in response to determining compromised and/or altered credentials are present, determining whether there is sufficient information about the user available to create an alternate multi-factor authentication challenge; and

in response to determining that there is sufficient information about the user available to create an alternate multi-factor authentication challenge, generating the alternate multi-factor authentication challenge for the user.

10 . The computer-implemented method of claim 1 , comprising:

in response to determining compromised and/or altered credentials are not present, determining one or more groups of information to use while generating the multi-factor authentication challenge for the user.

11 . A computer program product, comprising a computer readable storage medium having program instructions embodied therewith, the program instructions readable by a processor, executable by the processor, or readable and executable by the processor, to cause the processor to:

in response to receiving a request from a user and determining that a recently verified token group exists, determine whether a supplemental authorization requirement associated with the user has been met;

in response to determining the supplemental authorization requirement has been met and that the user is authorized to issue the request, generate a multi-factor authentication challenge for the user, the multi-factor authentication challenge including a dynamic combination of available authentication factors corresponding to the user, wherein the dynamic combination of authentication factors includes (i) at least one user defined authentication factor, (ii) at least one biometric authentication factor, and (iii) at least one activity-based authentication factor,

use a digital twin of the user to satisfy at least one of the authentication factors in the multi-factor authentication challenge;

receive inputs for remaining unsatisfied ones of the authentication factors in the multi-factor authentication challenge; and

determine whether the inputs received satisfy the remaining unsatisfied ones of the authentication factors in the multi-factor authentication challenge.

12 . The computer program product of claim 11 , wherein one or more of the inputs received correspond to the at least one user defined authentication factor, wherein the one or more received inputs that correspond to the at least one user defined authentication factor are received directly from the user.

13 . The computer program product of claim 11 , wherein one or more of the inputs received correspond to the at least one biometric authentication factor and/or the at least one activity-based authentication factor, wherein the one or more received inputs that correspond to the at least one biometric authentication factor and/or the at least one activity-based authentication factor, are received from one or more sensors configured to collect biometric and/or activity-based information associated with the user.

14 . The computer program product of claim 11 , wherein the program instructions are readable and/or executable by the processor to cause the processor to:

in response to determining that the inputs received satisfy the remaining unsatisfied ones of the authentication factors in the multi-factor authentication challenge, cause the request to be satisfied.

15 . The computer program product of claim 11 , wherein the program instructions are readable and/or executable by the processor to cause the processor to:

in response to determining that the inputs received do not satisfy one or more of the remaining unsatisfied ones of the authentication factors in the multi-factor authentication challenge, cause the request to be denied.

16 . The computer program product of claim 11 , wherein the program instructions are readable and/or executable by the processor to cause the processor to:

in response to determining the inputs received do not satisfy the multi-factor authentication challenge, generate an updated multi-factor authentication challenge having a second dynamic combination of the available authentication factors;

using the digital twin of the user to satisfy at least one of the authentication factors in the updated multi-factor authentication challenge; and

issuing requests to the user for inputs for remaining unsatisfied ones of the authentication factors in the updated multi-factor authentication challenge.

17 . The computer program product of claim 11 , wherein generating the multi-factor authentication challenge includes using a machine learning model to create the dynamic combination of authentication factors in the multi-factor authentication challenge, wherein a number of authentication factors in the multi-factor authentication challenge is based at least in part on a type of request that is received.

18 . The computer program product of claim 11 , wherein generating the multi-factor authentication challenge for the user includes:

evaluating a type of request that is received and determining: a first number of user defined authentication factors, a second number of biometric authentication factors, and a third number of activity-based authentication factors, to use to generate the multi-factor authentication challenge;

selecting the first number of user defined authentication factors randomly from a list of known user defined authentication factors;

selecting the second number of biometric authentication factors randomly from a list of known biometric authentication factors;

selecting the third number of activity-based authentication factors randomly from a list of known activity-based authentication factors; and

forming the multi-factor authentication challenge by combining the randomly selected first number of user defined authentication factors with the randomly selected second number of biometric authentication factors and the randomly selected third number of activity-based authentication factors to.

19 . A system, comprising:

a processor; and

logic integrated with the processor, executable by the processor, or integrated with and executable by the processor, the logic being configured to:

in response to receiving a request from a user and determining that a recently verified token group exists, determine whether a supplemental authorization requirement associated with the user has been met;

in response to determining the supplemental authorization requirement has been met and that the user is authorized to issue the request, generate a multi-factor authentication challenge for the user, the multi-factor authentication challenge including a dynamic combination of available authentication factors corresponding to the user, wherein the dynamic combination of authentication factors includes (i) at least one user defined authentication factor, (ii) at least one biometric authentication factor, and (iii) at least one activity-based authentication factor;

use a digital twin of the user to satisfy at least one of the authentication factors in the multi-factor authentication challenge;

receive inputs for remaining unsatisfied ones of the authentication factors in the multi-factor authentication challenge; and

determine whether the inputs received satisfy the remaining unsatisfied ones of the authentication factors in the multi-factor authentication challenge.

20 . The system of claim 19 , wherein the logic is configured to:

in response to determining the inputs received do not satisfy the multi-factor authentication challenge, generate an updated multi-factor authentication challenge having a second dynamic combination of the available authentication factors,

using the digital twin of the user to satisfy at least one of the authentication factors in the updated multi-factor authentication challenge; and

issuing requests to the user for inputs for remaining unsatisfied ones of the authentication factors in the updated multi-factor authentication challenge,

wherein generating the multi-factor authentication challenge and the updated multi-factor authentication challenge includes using a machine learning model to create the dynamic combination of authentication factors and the second dynamic combination of authentication factors.

Assignments (1)

Continuity (1)

References Cited (20)