RU2723679C1 - Method and system for dynamic authentication and user risk assessment - Google Patents

Abstract

FIELD: computer equipment.SUBSTANCE: present technical solution relates to computer engineering. Method for dynamic authentication and user risk assessment on a web resource and/or in a mobile application, in which a threshold value of trust rating is established for user authentication, user devices are registered, during which non-personal data of user devices are collected, at the moment of connection, collecting non-personal data on the user device, processing the collected information by means of its comparison with data stored in the authentication system, forming a reference set of trust parameters for authentication, value of confidence rating is determined and decision is made to grant user access to said web resource and/or mobile application.EFFECT: high security of user data when performing an authentication process by calculating a rating of user confidence solely by descriptors of their non-personal data and data of user devices, which are used to request access.9 cl, 4 dwg

Description

FIELD OF TECHNOLOGY

This technical solution relates to the field of computer technology, in particular to a method and system for performing dynamic authentication and risk assessment of a user to ensure his access to web resources and / or mobile applications.

BACKGROUND

The rapid development of computer technology in the last decade, as well as the widespread dissemination of a variety of computing devices (personal computers, laptops, smartphones, etc.) have become a powerful incentive for using these devices in various fields of activity and for a huge number of tasks (from Internet surfing to electronic document management and banking). In parallel with the increase in user activity using the aforementioned computing devices through computer networks, the requirements for this type of activity also increased - an increase in the number of services provided, an increase in the speed of their work, and an increase in the level of security. For example, a user’s work with his finances through a bank account requires the security and confidentiality of data available from his account, quick user authorization in his account, as well as a quick reaction to user actions.

In the modern world, the use of insufficiently secure means of exchanging data between clients and remote services can lead to huge material and financial losses. In the financial sector, the very use of personal data creates great difficulties in protecting them - for example, replacing users' personal data can result in a loss of money from bank customers; in the financial sector, incorrect information can lead to multibillion-dollar losses and paralysis of stock exchanges; in the insurance sector, fake information can cause illegal payments and, as a result, losses of insurance companies. Therefore, at present, the assessment of the level of risk from the actions performed by the user or the data provided by the user comes first. For example, to resolve some financial transactions of users (for example, issuing loans), a preliminary assessment is made of the probability that the provided user data corresponds to this particular user and that the said loan will be paid by the user.

To solve the described problems, various scoring models are used (English credit score), each of which has its own pros and cons - some are able to calculate very accurate estimates, but they work for a very long time or require a large amount of resources, others require personal user data, which can be compromised or to which unauthorized access can be made (often such data is simply forbidden to transmit and store under the laws of the countries in which users work). Moreover, a frequently encountered problem is the inaccessibility of data for the effective operation of the mentioned scoring models, for example, the availability of informative credit history for users requesting a loan online is on average 70-85%, and the availability of informative data on social networks is 60-80%.

US Pat. No. 8,560,436 describes a computerized technology for assessing a borrower's credit risk in online lending. To this end, the said service collects data about the borrower in social networks and generates, based on the collected data, an assessment of the profile of the borrower based on predefined rules and established cross-links determined by the collected data.

Another US patent US 9684905 describes a technology for verifying user data. To this end, upon request, they verify the consumer’s asset, for which they analyze the consumer’s confidential data and related indirect data. Based on the parameters of the asset (type, value, etc.) and the analyzed consumer data, it is decided that the user data has successfully passed verification.

The technologies described above cope well with the tasks of verifying users, data provided by users, etc., but at the same time require confidential or personal user data for their work, and can also take considerable time.

An important aspect of the development of computer technology is the ability to use not only data provided directly by the user, but also information that is non-personal (depersonalized) and allows you to assess access based on the calculation of device trust parameters without the possibility of losing or intercepting user personal data.

The rapid growth of Internet business is determined by the competitive advantages of Internet similarity - the ability to communicate with a huge number of customers without significant capital costs and the ability to conduct business with lower operating costs. At the same time, entrepreneurs who start an online business or transfer their offline activities to the Internet face significant risks associated with the development of a business in the information and communication network, such as fraudulent applications and payments, identity theft and reputation risks. As the Internet grows in popularity, fraud prevention and customer identification capabilities are becoming important aspects of the business sphere in areas such as online banking, insurance, e-commerce, e-commerce, online games, social networks. There are currently several key ways to prevent fraud and authenticate users:

1) Passwords. Logins and passwords are the basis of the current authentication system.

Unfortunately, a significant part of our logins and passwords consists of personal data, in particular, names, surnames and dates of birth. Thus, this approach is the most vulnerable in order to circumvent it. In addition, the widespread use of phishing and fraud technologies allows you to bypass or steal even complex and unusual logins and passwords.

2) Two-step verification or two-factor authentication (2FA). Secondary user authentication removes the requirements for one type of authentication information in the form of login and password. Currently, 2FA is widely used by companies for online payments (e.g. Visa 3D Secure) and authentication (e.g. Google Mail 2-step verification). Despite improving payment security and authentication, this approach reduces the number of conversions in final purchases for mass online stores and chains. In the case of identity theft, this method did not reveal significant results in protecting against fraud. One of the biggest problems with 2FA is the account recovery mechanism, which is regularly used to hijack an account.

3) Hardware key or “key” protection. The hardware key, which is usually connected to the computer via the USB port, can be used to identify end users. Compared to conventional (software) approaches, this principle provides a significant improvement in security, however, this method has several drawbacks - it creates significant barriers for large public networks and online stores and can be copied or modeled.

4) Digital certificate. Using certificates can significantly improve the security of your web connection. Unfortunately, certificates can be copied and even stolen remotely. In addition, digital certificates create usage barriers for mass online sites and networks.

5) Stop lists. Lists of compromised credit cards, stolen email accounts, and social profiles have proven effective. And at the same time, this approach has a number of disadvantages. First of all, this approach has time limitations, and its effectiveness is limited by recent account thefts, which implies that the overall effect of stop lists deteriorates significantly over time. Thus, this approach depends on regular updates / purchases of stop lists, which may be cost-inefficient.

6) Device fingerprint (DFP). This is a relatively new approach that has become popular over the past 10 years. This approach allows you to identify fraudulent or suspicious logins / loan applications based on unique device identifiers that may be associated with the corresponding user or group of users. Moreover, this approach helps in authenticating the device, thus avoiding additional barriers to the use of the network / site by the user. However, this approach has several disadvantages. First, all major browser developers strive to standardize their browsers and minimize the number of unique identifiers, since this approach can be used to covertly track users; secondly, this approach should be strengthened with regularly updated lists of anonymizing IP addresses (for example, Proxy, VPN, TOR) in order to provide valuable protection against identity theft and fraudulent connections.

7) Biometrics. This set of approaches includes: fingerprints, voice recognition, retina scanning, face recognition, DNA and other methods of biometric identification. Biometrics is becoming increasingly popular these days. The main reason for their popularity is the reduced cost of use and the high efficiency of identification and protection against fraud. However, the massive use of this approach leads to a significant reduction in the conversion of payments or subscriptions on public / commercial networks or sites.

Thus, at the moment there is no single highly effective tool that could be used to authenticate clients and prevent fraud - all authentication methods have their pros and cons. And all of the above approaches can be used, being effective for business.

Using a set of approaches for authentication, coupled with application technologies for assessing the access of non-personalized (non-personal) user information, will create a new highly effective method for modern business systems.

ESSENCE

This technical solution is aimed at creating a new highly effective way to ensure user authentication with the calculation of the confidence rating based on their non-personal information.

The technical result is to provide authentication of users based on their non-personal data.

An additional result is an increase in the security of user data during the authentication process by calculating a user confidence rating solely on descriptors of their non-personal data and user device data, by which an access request is made.

In one of the preferred embodiments, a method for dynamically authenticating and assessing a user's risk on a web resource and / or in a mobile application, performed using a processor of a computer device, is claimed, comprising the steps of:

- set for at least one web resource and / or mobile application the threshold value of the trust rating for user authentication using the authentication system;

- carry out registration of user devices using the authentication system, during which collect non-personal data of user devices;

- fix the connection to the said web resource and / or mobile application of at least one user device;

- at the time of the mentioned connection, non-personal data is collected about the user device, and data is collected in a seamless mode and / or when the user is notified at the time of access to the web resource and / or mobile application, depending on the selected settings of the authentication system and risk assessment;

- process the collected information about the user device by comparing it with data stored in the authentication system, forming a reference set of trust parameters for authentication;

- determine the value of the confidence rating of said device initiating the connection based on the processed non-personal information;

- decide on providing the user with access to said web resource and / or mobile application based on comparing the user confidence rating value with the threshold value set for the web resource and / or mobile application based on processing non-personal data of the user's device, the decision being granting access may include the following: granting access, requesting additional information, or refusing to grant access.

In one of the private embodiments of the method, the collected non-personal data about the user's device includes at least one of: device descriptors, Internet connection characteristics, connection point parameters, device physical characteristics data, online behavior data or device software.

In another particular embodiment of the method, if additional information is requested, non-personal user information is collected, which includes user biometric information descriptors representing the non-personal part of the user's biometric data.

In another particular embodiment of the method, the user’s biometric information is selected from the group: face image, iris image, palm vein pattern, fingerprint.

In another particular embodiment of the method, the threshold value of the trust rating for user authentication is generated based on the predictors of trust.

In another particular embodiment of the method, when requesting additional information, the non-personal part of the biometric information is extracted directly on the user's device, and said biometric information does not leave the user device.

In another particular embodiment of the method, based on additional information, the user confidence rating is recalculated.

Also in a preferred embodiment, the claimed solution is implemented using a system for dynamic authentication of a user on a web resource or in a mobile application that contains

at least one processor

at least one memory device that contains instructions executed by the processor, which, when executed, implement the steps in which:

- set for at least one web resource and / or mobile application the threshold value of the trust rating for user authentication using the authentication system;

- carry out registration of user devices using the authentication system, during which collect non-personal data of user devices;

- fix the connection to the said web resource and / or mobile application of at least one user device;

- at the time of the mentioned connection, non-personal data is collected about the user device, and data is collected in a seamless mode and / or when the user is notified at the time of access to the web resource and / or mobile application, depending on the selected settings of the authentication system and risk assessment;

- process the collected information about the user device by comparing it with data stored in the authentication system, forming a reference set of trust parameters for authentication;

- determine the value of the confidence rating of said device initiating the connection based on the processed non-personal information;

- decide on providing the user with access to said web resource and / or mobile application based on comparing the user confidence rating value with the threshold value set for the web resource and / or mobile application based on processing non-personal data of the user’s device, and the decision to provide Access may include the following: granting access, requesting additional information, or refusing access.

In one example of the implementation of the claimed system, the user's device is: a smartphone, tablet, personal computer, laptop, smart wearable device, game console, smart TV or car multimedia device.

Other particular examples and embodiments of the claimed invention will be disclosed further in the present application materials.

DESCRIPTION OF DRAWINGS

FIG. 1 illustrates a general implementation of a system for implementing a dynamic authentication process.

FIG. 2 illustrates a flowchart of steps for performing a dynamic authentication method.

FIG. 3 illustrates a flow chart of a method for requesting additional biometric information for dynamic authentication if necessary.

FIG. 4 illustrates a diagram of a computing computer device.

DETAILED DESCRIPTION

Fraud (eng. Fraud [1] "fraud") - a type of fraud in the field of information technology, in particular, unauthorized actions and misuse of resources and services

Gradient descent is a method of finding a local extremum (minimum or maximum) of a function by moving along the gradient. To minimize the function in the direction of the gradient, one-dimensional optimization methods are used, for example, the golden ratio method. You can also search not the best point in the direction of the gradient, but some better than the current one.

Hereinafter, under personal data we mean direct identifiers of an individual or a set of data that uniquely identifies an individual, or a set of data that allows direct communication with an individual. Non-personal data means data that does not fall into the category of personal data and does not allow an unambiguous identification of the individual.

For example, personal data may include:

- Full Name;

- Year, month, date and place of birth

- Passport data or data of any other certifying document;

- E-mail, account name in social. Networks, including Skype, WhatsApp, Telegram;

- Telephone number;

- TIN, pension certificate, SNILS, birth certificate;

- Address of permanent, temporary registration and residence;

- Marital, social, property status;

- Information about education, profession, income, employment data;

- Full bank card details; full bank card number, bank account details;

- Detailed payment receipts including itinerary receipts, order lists, notes, purchases, comments

- Information that characterizes the physiological and biological characteristics of a person, on the basis of which it is possible to establish his personality (biometric personal data). For example, a medical record, data from medical tests.

- Photo of man

- And any other direct human identifiers or linear / reversible hash functions from these identifiers.

As shown in FIG. 1, a general view of the system (100) for implementing the present solution includes a user device (110), a web resource or a mobile application (120) (hereinafter referred to as an access resource), to which a user device (110) makes a request for access, the system authentication (130), which includes: application program interface (API, 131), user account (132) and database (133).

For each access resource (120), an authentication system (130) sets a predetermined trust rating for each user device (110). This process is ensured by registering users in an authentication system (130) and storing information about them and their accounts (132) in a database (133). Using the API (131) of the authentication system (130), interaction and processing of requests between access resources (120) and user devices (110) is provided.

An access resource (120) can be understood as a website and / or a mobile application, for example, a banking services site, an application for financial transactions, an access control application, activation of external devices, etc.

Information about users (110) is stored in the authentication system (130) in the form of descriptors that are calculated during the initial registration of users (110) in the authentication system (130). Each access resource (120) is also registered in the authentication system (130), and the set value of the trust rating for accessing the users (110) to the said resource (120) is stored for it.

The user device (110) may be a different format of computing devices, for example, a smartphone, tablet, personal computer, laptop, game console, smart TV, wearable smart device (watch, bracelet), etc.

Initial registration for the collection of user descriptors (110) is carried out by establishing a connection between the device (110) and the authentication system (130), for example, by installing a specialized software application for communication via API (131). User descriptors are stored for the user account (132) and transferred to the database (133) for their subsequent use for the purpose of gaining access to resources (120).

The authentication system (130) can be implemented using a server and corresponding software applications installed on user devices (110) and access resources (120) to provide a confidence rating for devices (110) that make an access request.

The mentioned application of the authentication system (130) is also intended for collecting non-personal data from user devices (110) to calculate a confidence rating for such a device (110) for the corresponding access resource (120) when requesting access to it.

Such data may be, for example:

· Data of the online user session (110) on the access resource (120);

· Data about the user device (110), from which the request for access to the resource (120) is carried out;

· Data on user activity on said user device (110).

The following can be used as user online session data:

· Marker (identifier) of the online session,

· Characteristics of online connections, including, for example:

· Source and receiver of the connection (address) (including IPV4 and IPV6),

· Browser mask and title of the online request, as well as other parameters without which a standard online connection cannot take place;

· Connection speed determined by IP address;

· The geolocation location of the access point from which the online session is carried out.

In some implementations, user device (110) data may include:

Device descriptors (110), for example, fonts, screen geometry, plugins, etc .;

· Changeable device tokens, for example, MAC, etc.

· The parameters of the physical elements of the device (110) (processor, screen resolution, screen matrix density, etc.),

· Parameters of the operating system of the device (110);

· Applications installed and running on the device (110) that are available in the selected security mode (names, versions, operating modes, etc.);

· Geolocation data of the user's device that does not allow to determine the individual, for example, with an accuracy of 1 quarter (110).

In some embodiments, at least:

· Name of the operating system,

· Version and revision of the operating system,

· Bit rate of the operating system,

For example, Microsoft Windows 7, 64bit; Android OS 7.0, etc.

In some embodiments, the following may be used as user activity data:

· Graphic elements of the operating system or applications with which the user interacts (for example, the characteristics of the color palette used on the device, screen geometry, rendering of the graphical interface, type of video card, method of displaying fonts, colors, special characters, etc.),

· Data entry characteristics, for example:

· Special keys and special characters entered by the user (for example, by collecting statistics on interruptions of keystrokes),

· Time intervals between data entry (more broadly, the frequency response of data entry)

· The application from which the user enters data (including the parameters described above for applications),

· Print speed, etc.

· Characteristics of user activity in applications, for example:

· A set of specific applications installed (for example, rarely / frequently used applications, the type of such applications),

· The user’s time (the beginning and completion of work in a particular application, the execution time of predefined actions),

· Statistics on the user's work with applications (for example, the frequency of performing predetermined actions in applications, etc.). Under these characteristics, the number of openings of this or that application, the average session time of the work in the application, etc. are used.

The components of the system (100) are interconnected via a data network, for example, the Internet. The principle of networking between elements of the system (100) can be selected from various examples of such organization, based on the achievements of the current technical level, for example, LAN, Wi-Fi, WAN, PAN, WLAN, etc.

The authentication system (130) can also be a widget or plug-in that can be installed on user devices (110) and function in a seamless mode, collecting the required information when requesting access to the resource (120). Seamless mode is understood as the principle of operation by the authentication system (130) without the need to request additional permissions to perform actions with the user's device (110).

In FIG. 2 shows a process for implementing a method (200) for authenticating users (110). As indicated above, the primary step in implementing method (201) includes setting the required security parameters on the access resource (120). This process is performed using the authentication system (130) for each resource registered in it (120). For each resource (120), a set of metrics is established, based on which a subsequent calculation of the trust rating for users requesting access is performed (110).

Upon receipt of a request from the user device (110) for access to the resource (120), it is processed using the authentication system (130) in step (202). Processing is carried out by collecting user device data (110) at the time of requesting access to the access resource (120), for example, when downloading a mobile application. The program logic and / or special libraries (as an integral software part of the resource (120)) installed on the user's device (110) collects non-personal information about the device (110) and transfers it to the database (133) for subsequent calculation of the trust rating. The mentioned program logic is transmitted to the device (110) and stored in its memory, the transmission is carried out together with the content of the access resource (120) at the time of its loading on the device (110).

Consider an example:

The device descriptors described above are collected on the device (110), after which they are transferred to the authentication system (130), where, based on the convolution of the descriptors, for example, using the MD5 method or gradient descent (one of the probabilistic methods for determining the device based on the device descriptors), the result is compared with the stored image of the device in the system (130).

Moreover, if, when analyzing the received data, it is established that in addition to the matching device images, there are risk factors in the authentication system (130), for example, an Internet request was initiated from another country or an Internet request was generated with anomalies in the header (header) / request header ( for example, http request), then in the system of calculating trust (133), a high risk and a low confidence rating for a given Internet connection are set in spite of matching or not matching sets of device descriptors in the system (130).

In this case, due to the low trust rating, access is either denied or additional authentication of the device or virtual user is proposed to increase the trust rating. Factors affecting the confidence rating and their contribution to the confidence rating are taken from the collected array of non-personal related data and checked in advance on a practical sample (for example, at the stage of setting up the system using historical data accumulated earlier). At the same time, both the level of risk, provided that the authentication system is passed at the first step (130), and the level of a possible error to determine the threshold (rating) of trust and the next steps for these related factors are checked and evaluated. Let us consider a simplified example of rating / scoring of confidence / risk.

An ordinary linear regression can be used as a system for assessing a rating of confidence. Imagine the confidence rating function Y = A1 * X1 + A2 * X2 + A3 * X3. Where the confidence rating value ranges from 0 to up to some maximum positive value. Rating values reflect the presence of risk - the higher the value, the greater the risk. The variables X1, X2, X3 can be individual risk markers based on non-personal data.

For example:

- X1 is the marker corresponding to the following event: = 0 if the device descriptors match the pattern; 1 - if the descriptors did not match. Thus, the marker reflects the risk event when the device descriptors did not match the reference image or value;

- X2 - reflects the presence of previous fraudulent (fraud) actions on the device. For example, X2 = 0 means that for this device there were no fraudy actions for the last 12 months, and the value X2 = 7 means that for this device 7 fraudile values were observed for a certain period of time;

- X3 - reflects the number of detected anomalies in the Internet connection. For example, X3 = 0 means that no anomalies were detected within the Internet connection, and a value of X3 = 5 means that 5 anomalies were detected within the Internet connection;

- The constants or weights A1, A2, A3 can be determined based on historical observations or expert opinion. For example, you can take a sample of loan applications and mark it as 0 and 1 (0 will mean the absence of fraudy behavior, 1 - on the contrary, the presence of fraudy behavior). Further, having these values and using methods of mathematical statistics (and, for example, methods of machine learning, big data analysis), you can find the optimal values of these weights / coefficients based on various optimization conditions.

In the above example, Y can take positive values. Moreover, a value of 0 reflects the absence of anomalies (the level of maximum confidence), values> 0 - reflect the presence of risks, the greater the value, the greater the risk. As a confidence threshold for the Y function, you can set the value to 0 or a small positive value based on historically verified observations (which can be determined independently for each system).

As a rule, in practice, the number of variables used can be significantly greater than 100 (this number does not affect the essence of the technical solution), logistic regression, GLM regression, decision trees, neural networks and / or combinations thereof can be used as functions. At the same time, great importance is attached to the use of rare events (large deviations) and their use in the system of assessing the level of confidence. Rare events allow you to identify users with specific intentions or patterns / patterns of behavior. An example of such a rare event may be that the user uses a TOP connection, the use of randomizers, or the user has a foreign non-standard keyboard layout for a specific market / country. Rare events affect the scoring and user confidence rating as part of the rating function (rating calculation). Rare events used within the framework of the described solution can be configured, added at the stage of setting up the system / solution, and in the process, after the accumulation of historical data.

Next, at step (203), non-personal information of the user device (110) is collected using the installed program logic from the access resource (120). Non-personal information is collected exclusively on device (110). Moreover, all sensitive information does not leave the device, which eliminates the possibility of leakage or interception of personal information of the user.

Using program logic on the device (110), non-personal data is collected, which is anonymized non-personal information that excludes the possibility of back recovery of any personal user information from it. The mentioned information is transmitted to the authentication system (130), where it is subsequently processed at step (204). A list of collected parameters and non-personal descriptors is provided in advance to the resource owner (120). Anonymized personal information can be obtained by converting personal data (information) by such processing methods that make it impossible to reverse restore them. So, for example, instead of hashing the entire phone number (for example, 10 digits, it depends on the country), only some part, for example, 6 digits can be used, which will not allow us to restore the used phone number from this hash.

As mentioned above, such information can be: device descriptors, Internet connection characteristics, geolocation data (not exceeding geolocation accuracy more (more precisely) than 1 residential quarter), connection point parameters, device physical characteristics data, online behavior or software data providing the device, etc.

At step (204), based on the received non-personal information from the user device (110) in the authentication system (130), it is compared with the data stored in the database (133) for the corresponding resource account (132), and such data form a reference set of parameters trust for authentication on the specified access resource (120). The comparison method can be performed, for example, by comparing the hash sums from the array of collected information from the device (110) with the hash sum in the base (133) of the reference set of parameters. In another example, gradient descent can be used to implement the comparison procedure, which allows you to flexibly work with a different set of data and various metrics of proximity of this data.

Based on the processing of non-personal data of the device (110), the authentication system (130) calculates, at step (205), a confidence rating for the specified device (110) requesting access to the resource (120). A confidence rating can be calculated using one or more machine learning algorithms, for example, decision trees, a combination of GLM and decision trees, K-nearest neighbors, Support Vector Machine (SVM), neural networks (deep neural networks), etc. (see. e.g. https://docs.opencv.org/3.4.6/dc/dd6/ml_intro.html). Variables such as: the number of access requests from this device, the last time a user made a request, the coincidence of descriptors of the current device with the reference one, the presence of anomalies on the device, the presence of anomalies in the Internet connection, the presence of high-risk user behavior in the past, etc.

Based on the results of calculating the trust rating (205) for the user device (110) at step (206), it is compared with the threshold rating value set for the access resource (120) to perform further authentication process procedures. If the calculated rating corresponds to the confidence range, then the user (110) at step (207) is granted access to the resource (120), otherwise, denied access (208).

For access to the resource (120), the trust rating value is also set for the “border zone”, in which, the initially calculated trust rating is less than the required value for providing access, but not small enough to form a denial of access.

In FIG. 3 is a flowchart of a process for requesting additional information in step (300). Such information is the biometric information of the user of the device (110).

The collection and processing of biometric information (301) is carried out using program logic installed on the device (110) at the time of the request for access to the resource (120) at step (202). The collected biometric information is processed (302) to obtain descriptors of the user's biometric information, which represent a non-personal part of the user's biometric data, eliminating the likelihood of its subsequent processing to recover information that uniquely identifies the user. Initial biometric information can be, for example, the image of the user's face, the image of the iris of the eye, the pattern of the veins of the palm, a fingerprint.

The collection of biometric information at step (301) is carried out using the hardware and software of the device (110), for example, a camera, an iris scanner, a fingerprint scanner, etc. The collection and processing of descriptors is carried out exclusively on the user's device (110) and the obtained biometric information does not leave the limits of the device (110). Only anonymous, non-personalized descriptors (303) are transmitted to the authentication system (130), for example, calculating the location of the reference points calculated from the received user's image. As well-known examples of this kind of method and technological approaches, methods for calculating descriptors — SIFT, ORB, SURF, HOG, etc., can be applied, at which key points are selected, which are then applied to the impression. Further, according to the obtained additional biometric non-personal information in the authentication system (130).

For example, information about an online session is collected from a user’s device (110) (online session marker, device connection parameters (110), etc.). After calculating the confidence rating of such a device at step (205), its value falls into a range of values that cannot uniquely characterize the risk level of such a device (110). For example, the calculated risk level is 0.75, when the formation of unique access rights to the access resource (120) requires a risk level in the range [0.0, 0.2] (access is allowed) or the range [0.8, 1.0] (access to resources is prohibited). As a result, a request for additional biometric information is performed (300), and after performing new calculations of the confidence rating for such a user accessing using the aforementioned device (110), for which a confidence rating was previously calculated, the risk level becomes 0.2 and the final final decision is made on providing access to the resource (120).

The trust rating is calculated using the authentication system (130) based on requests received from the access resource (120) through the API (131). These requests can be standardized curl / wget. In response to the processing of the request, the authentication system transmits to the access resource (120) a calculated trust rating, information on dynamic authorization, and calculated descriptor values.

In FIG. 4 shows a general example of a computing computer device (400) that can be used to implement the inventive method and / or system. In the General case, the device (400) contains components such as one or more processors (401), at least one random access memory (402), a means of permanent data storage (403), input / output interfaces (404), I / O (405), networking tools (406). The components of the device (400) are typically interfaced via a common data bus.

The processor (401) of the device performs the basic computing operations necessary for the operation of the device (400) or the functionality of one or more of its components. The processor (401) executes the necessary computer-readable instructions contained in the random access memory (402). Under the processor (401) should also be understood as a graphics processor suitable for performing specialized processing within the framework of the claimed solution, which may be an additional means of calculation.

Memory (402), as a rule, is made in the form of RAM and contains the necessary software logic that provides the required functionality. The data storage means (403) can be implemented as HDD, SSD disks, RAID raid, network storage, flash memory, optical information storage devices (CD, DVD, MD, Blue-Ray disks), etc. The tool (403) allows long-term storage of various types of information, for example, the history of processing requests (logs), user IDs, camera data, images, etc.

Interfaces (404) are standard tools for connecting and working with cameras (110, 120, 130) or other computing devices, for example, USB, RS232, RJ45, LPT, COM, HDMI, PS / 2, Lightning, FireWire, etc. P. The choice of interfaces (404) depends on the specific design of the device (400), which can be a personal computer, mainframe, server cluster, thin client, smartphone, laptop, etc.

As input / output data (405), a keyboard, joystick, display (touch screen), projector, touchpad, mouse, trackball, light pen, speakers, microphone, etc. can be used.

Network communication tools (406) are selected from devices that provide network reception and data transfer, for example, Ethernet cards, WLAN / Wi-Fi module, Bluetooth module, BLE module, NFC module, IrDa, RFID module, GSM modem, etc. Using means (406), the organization of data exchange via a wired or wireless data channel is provided, for example, WAN, PAN, LAN (LAN), Intranet, Internet, WLAN, WMAN or GSM.

In the present application materials, a preferred disclosure of the implementation of the claimed technical solution was presented, which should not be used as limiting other, private embodiments of its implementation, which do not go beyond the requested scope of legal protection and are obvious to specialists in the relevant field of technology.

Claims (25)

1. Performed using a processor of a computer device, a method of dynamic authentication and risk assessment of a user on a web resource and / or in a mobile application, comprising stages in which: - set for at least one web resource and / or mobile application the threshold value of the trust rating for user authentication using the authentication system; - carry out registration of user devices using the authentication system, during which collect non-personal data of user devices; - fix the connection to the said web resource and / or mobile application of at least one user device; - at the time of the mentioned connection, non-personal data is collected about the user device, and data is collected in a seamless mode and / or when the user is notified at the time of access to the web resource and / or mobile application, depending on the selected settings of the authentication system and risk assessment; - process the collected information about the user device by comparing it with data stored in the authentication system, forming a reference set of trust parameters for authentication; - determine the value of the confidence rating of said device initiating the connection based on the processed non-personal information; - decide on providing the user with access to said web resource and / or mobile application based on comparing the user confidence rating value with the threshold value set for the web resource and / or mobile application based on processing non-personal data of the user's device, the decision being granting access may include the following: granting access, requesting additional information, or refusing to grant access. 2. The method according to claim 1, characterized in that the collected non-personal data about the user's device includes at least one of: device descriptors, Internet connection characteristics, geolocation data, connection point parameters, device physical characteristics data, online data behavior or device software. 3. The method according to claim 2, characterized in that, if necessary, request additional information, collect non-personal information about the user, which includes descriptors of biometric information of the user, representing the non-personal part of the biometric data of the user. 4. The method according to claim 3, characterized in that the biometric information of the user is selected from the group: face image, image of the iris of the eye, drawing veins of the palm, fingerprint. 5. The method according to claim 1, characterized in that the threshold value of the trust rating for user authentication is generated based on the predictors of trust. 6. The method according to claim 4, characterized in that when requesting additional information, the non-personal part of the biometric information is allocated directly to the user's device, and said biometric information does not leave the user device. 7. The method according to claim 6, characterized in that, based on additional information, the user confidence rating is re-calculated. 8. A system for dynamic user authentication on a web resource or in a mobile application, containing at least one processor at least one memory device that contains instructions executed by the processor, which, when executed, implement the steps in which: - set for at least one web resource and / or mobile application the threshold value of the trust rating for user authentication using the authentication system; - carry out registration of user devices using the authentication system, during which collect non-personal data of user devices; - fix the connection to the said web resource and / or mobile application of at least one user device; - at the time of the mentioned connection, non-personal data is collected about the user device, and data is collected in a seamless mode and / or when the user is notified at the time of access to the web resource and / or mobile application, depending on the selected settings of the authentication system and risk assessment; - process the collected information about the user device by comparing it with data stored in the authentication system, forming a reference set of trust parameters for authentication; - determine the value of the confidence rating of said device initiating the connection based on the processed non-personal information; - decide on providing the user with access to said web resource and / or mobile application based on comparing the user confidence rating value with the threshold value set for the web resource and / or mobile application based on processing non-personal data of the user's device, the decision being granting access may include the following: granting access, requesting additional information, or refusing to grant access. 9. The system of claim 8, characterized in that the user's device is: a smartphone, tablet, personal computer, laptop, smart wearable device, game console, smart TV or car multimedia device.

Images