Emc Corporation

Emc IP Holding Company LLC

John Watts

Yedidya Dotan

Lakshmi Suresh

Marcelo Blatt

Paul Dennis

A technique performs authentication. The technique involves performing, by processing circuitry, a set of authentication operations in response to a set of authentication requests, and updating a set of velocity metrics which identifies authentication performance for a set of authentication request sources that originated the set of authentication requests. The technique further involves, after updating the set of velocity metrics, receiving, by the processing circuitry, an authentication request from an authentication request source. The technique further involves providing, by the processing circuitry, an authentication result in response to the authentication request from the authentication request source. The authentication result (i) is based on the set of velocity metrics and (ii) indicates whether the authentication request is considered to be legitimate. Such a technique can detect malicious activity even if a person tries to authenticate just a few times to several accounts in a 'touch the fence' style of attack.

Security using velocity metrics identifying authentication performance for a set of devices

A technique performs user authentication. The technique involves receiving, by processing circuitry, an authentication request which includes a set of authentication factors and which identifies a particular user. The technique further involves performing, by the processing circuitry, an authentication operation to generate an authentication result in response to the authentication request, the authentication result being based on (i) the set of authentication factors of the authentication request, (ii) a user authentication profile which profiles the particular user, and (iii) a lockout state identifying a lockout condition of the particular user which existed at the time of receiving the authentication request. The technique further involves providing, by the processing circuitry and as a response to the authentication request, an authentication action based on the authentication result.

Risk-based authentication using lockout states

Authentication employs a classification that monitors content of authentication requests and results and assigns and records risk values identifying low-risk sources making normal authentication requests and high-risk sources making abnormal authentication requests indicative of fraud activity. Then for low-risk sources, a normal authentication process is employed having differential success/fail behavior exposing information about an enumerable system resource, such as a user account. Example differential behavior includes (a) granting access when a request identifies a valid user account, and (b) otherwise denying access, enabling an attacker to learn whether a guessed value identifies an existing account. For high-risk sources, a false authentication process is employed having non-differential success/fail response behavior that does not expose the information, such as consistent presentation of a service denial message irrespective of whether the request identifies a valid existing user account, preventing an enumeration attack.

Growing community of inventors

Medford, MA, United States of America

John Watts