Ping Identity International, Inc.

Sudhakar Peddibhotla

Peter Barker

Darryl Jones

Raminder Deep Singh Kaler

Sandesh More

Benjamin Goodman

A process, system and medium for detecting anomalous authentication requests to a protected resource during an authentication journey, in order to regulate step-up authentication are described. The process includes obtaining request features from the authentication request that triggered the authentication journey. The process includes processing, by an ensemble of Machine Learning (ML) models and a set of rule-based heuristics, a set of features based on the request features, the set of features associated with a userID. The process includes deriving risk sub-scores for each ML model and each heuristic. The process includes deriving a risk score based on the risk sub-scores. The process includes determining that the risk score exceeds an explanation-triggering threshold. The process includes providing, to a node in the authentication journey, the risk score with an explanation of the risk score. The system and medium are configured to execute the process, and configured to provide the explanation.

Access prediction service serving explainable risk scores

A process, system and medium for building a training set and performing supervised training of a Machine Learning (ML) model that determines a risk score used to decide whether to impose stepped up authentication during an authentication journey are described. The process includes selecting examples of completed authentication journeys, including failed and successful authentication outcomes after step-up requirements during the example journeys. The process includes pairing ground truth outcomes from the example journeys with authentication request features initially available prior to imposition of the step-up requirements to produce request feature-outcome pairs. The process includes using at least the request feature-outcome pairs to perform the supervised training of the ML model to determine a risk score that can be used to decide whether to impose the stepped up authentication during an authentication journey. The system and medium are configured to execute the process.

Access prediction service receiving authentication journey characteristics for supervised learning

The disclosed technology teaches a computer-implemented method of enabling identity governance administration to examine the state of identity management objects at an arbitrary prior time. The method includes maintaining a data store of identity management objects used for identity governance administration, including specification of user roles from which permissions or authorizations derive and recording in the data store copies of identity management objects with an as-of time stamp at each creation, change and deletion of each identity management object. Also included is retaining time-stamped versions of the objects for a queryable time window. The method also includes receiving a query with an as-of time criteria for at least some of the identity management objects and returning responsive objects from which the permissions or authorizations were derived at the as-of-time. Responding to the query with the responsive objects that correspond to the as-of time criteria in the query is also disclosed.

Identity time machine

The disclosed technology teaches aggregating 3rd-party risk measures during an authentication journey, including providing a risk measure aggregation node, a JSON transform, and a configuration for 3rd-party risk measures to request. Responsive to invocation of the risk measure aggregation node during the authentication journey, the method includes setting a timer for receipt of a configured 3rd-party risk measure, wherein expiration of the timer causes the risk measure aggregation node to stop waiting for a timed-out 3rd party risk measure provider and requesting the configured 3rd-party risk measures. Upon receiving at least some of the requested 3rd-party risk measures, included is applying the JSON transform to aggregate the returned 3rd-party risk measures into an aggregate score, and the risk measure aggregation node providing to another node in the authentication journey an aggregated score taking into account the configured 3rd-party risk measures received prior to expiration of the timer.

Growing community of inventors

Seattle, WA, United States of America

Sudhakar Peddibhotla