Cisco Technology, Inc.

Laura Kristen Cole

Shayne Miel

David William Matteson

Glenn J Stempeck

Stefano Meschiari

Brian Lindauer

Bronwyn Lewisia Woods

Josh Matz

Ian Edward Beals

Kwan Lok Ernest Chan

Edgar Calderon

Jillian Haller

The present disclosure provides protection to communications after establishing a secured connection to a secured website or application. An authentication service, after establishing a secured session, can calculate a trust score for a user. Based on the trust score, the security agent can encrypt access tokens used to authenticate a secure connection. The system can interrupt the secure connection based on the trust score of the user or the user device. The interruption takes place by ignoring requests to decrypt the access token. Without the decrypted access token, the browser is unable to authenticate the session, preventing further communications. After the user improves the security posture of the device or user, the security agent can recalculate the trust score. When the trust score is above a threshold, the security agent can being decrypting the access token, thereby authenticating communications from the browser.

Client-based enforcement for mid-session reauthentication

Techniques for training and using models to analyze multiple attributes of an authentication, and detect anomalous authentications that may include security threats. An authentication platform may use historical authentication data to train models to identify common attributes for authentications of users, and the training may be performed without the use of labels. For instance, models may be trained for each attribute of the historical authentications (e.g., geographic location, type of authentication method, type of device, time of day, etc.) to 'learn' common behaviors of users across attributes of historical authentications. The models can then be applied to new authentications to determine, on an attribute-by-attribute level, whether or not new authentications are anomalous as compared to historical authentications by the user. In this way, the models can learn common authentication behaviors of users without needing labels, and the models can then be applied to identify anomalous (and potentially malicious) authentications.

Detection of anomalous authentications

Growing community of inventors

Austin, TX, United States of America

Laura Kristen Cole