Patent ID: 11882158
Assignee: AT&T MOBILITY II LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 18:
19. A method, comprising:
receiving, by a processing system including a processor, over a communication network, an authentication request from a user device for performing a function utilizing a first authentication method, wherein the authentication request identifies the function and the first authentication method;
obtaining, by the processing system, network intelligence data, the network intelligence data including: historical data of other network devices accessing services via a wide-area network of the communication network, an identification of events occurring in a mobile communication network of the communication network, time of day data associated with a plurality of user devices accessing the services, and trending data associated with the plurality of user devices accessing the services on the mobile communication network;
analyzing, by the processing system, a security behavior of the processing system;
identifying, by the processing system, a risk level for each of a plurality of authentication methods resulting in a plurality of risk levels using a machine learning application, wherein the first authentication method is one of the plurality of authentication methods;
identifying, by the processing system, a first risk level of the plurality of risk levels associated with the first authentication method and identifying a second risk level of the plurality of risk levels associated with the function, based on the security behavior of the processing system and the network intelligence data, wherein the identifying of the first risk level and the identifying of the second risk level are based on an analysis of network element security behaviors for the other network devices, the network element security behaviors being identified based on user plane messages and control plane messages in the mobile communication network that indicate a security breach, a security risk, or a combination thereof;
identifying, by the processing system, a second authentication method from the plurality of authentication methods that is associated with the second risk level;
identifying, by the processing system, a risk threshold; and
determining, by the processing system, the first risk level is above the risk threshold and the second risk level is below the risk threshold and in response thereto:
notifying, by the processing system, the user device of the second risk level for the function;
providing, by the processing system, over the communication network, a recommendation to the user device to utilize the second authentication method to perform the function;
determining, by the processing system, the first risk level has decreased below the risk threshold, wherein the first authentication method is associated with a first service;
receiving, by the processing system, over the communication network, a first notification that another processing system has terminated an access point device for the first service; and
providing, by the processing system, over the communication network, a second notification to each of a group of user devices associated with the another processing system, wherein each of the group of user devices are using the first service, wherein the second notification indicates that the processing system offers the first service to each of the group of user devices as the another processing system, wherein the group of user devices is included in the plurality of user devices.