Client authentication management based upon modeling

Techniques are described with regard to client authentication management. An associated method includes constructing an authentication resolution model specific to a client based upon error patterns respectively included in a plurality of erroneous authentication submissions inconsistent with a proper authentication submission. The method further includes receiving, via an authentication interface, a new erroneous authentication submission inconsistent with the proper authentication submission. Responsive to determining that the new erroneous authentication submission corresponds to an authentication exception defined in the authentication resolution model, the method further includes completing authentication. Responsive to determining that the new erroneous authentication submission corresponds to an authentication warning defined in the authentication resolution model, the method further includes performing at least one client account warning protection activity. Responsive to determining that the new erroneous authentication submission corresponds to an authentication attack defined in the authentication resolution model, performing at least one client account attack protection activity.

BACKGROUND

The various embodiments described herein generally relate to managing client authentication. More specifically, the various embodiments relate to managing authentication with respect to a client account based upon an authentication resolution model.

Conventional client account authentication and lockout policies may present undue burden with respect to client authentication, particularly in instances where a client inadvertently submits multiple erroneous authentication submissions. Specifically, when a client submits multiple erroneous authentication submissions, a conventional account lockout policy may require such client to consult a relevant help desk or to take other substantive action in order to restore account functionality, thus requiring time and/or expense on the part of both the client and the relevant organization(s) providing authentication services to the client.

SUMMARY

The various embodiments described herein provide techniques of managing client authentication based upon modeling. An associated computer-implemented method includes constructing an authentication resolution model specific to a client based upon error patterns respectively included in a plurality of erroneous authentication submissions inconsistent with a proper authentication submission required for an account associated with the client. The method further includes receiving, via an authentication interface, a new erroneous authentication submission inconsistent with the proper authentication submission. Responsive to determining that the new erroneous authentication submission corresponds to an authentication exception defined in the authentication resolution model, the method further includes completing authentication. In an embodiment, responsive to determining that the new erroneous authentication submission corresponds to an authentication warning defined in the authentication resolution model, the method further includes performing at least one client account warning protection activity. In another embodiment, responsive to determining that the new erroneous authentication submission corresponds to an authentication attack defined in the authentication resolution model, the method further includes performing at least one client account attack protection activity. In a further embodiment, the method includes updating the authentication resolution model based upon the new erroneous authentication submission.

In an embodiment, the step of constructing the authentication resolution model includes identifying correlations among the plurality of erroneous authentication submissions based upon application of at least one artificial intelligence algorithm and determining distinctions between the plurality of erroneous authentication submissions and the proper authentication submission based upon application of the at least one artificial intelligence algorithm. The step of constructing the authentication resolution model further includes defining at least one authentication exception, wherein each of the at least one authentication exception includes an error pattern that has a level of similarity to a pattern included in the proper authentication submission exceeding a predefined level of confidence threshold and that occurs a number of times exceeding a predefined error occurrence threshold over a duration of time exceeding a predefined learning threshold. In another embodiment, the step of constructing the authentication resolution model further includes defining at least one authentication warning, wherein each of the at least one authentication warning includes an error pattern that occurs a number of times exceeding the predefined error occurrence threshold over a duration of time less than or equal to the predefined learning threshold. In a further embodiment, the step of constructing the authentication resolution model also includes defining at least one authentication attack, wherein each of the at least one authentication attack includes a plurality of error patterns that occur an equal number of times and that collectively occur a number of times exceeding the predefined error occurrence threshold.

In an embodiment, each authentication exception defined in the authentication resolution model is encrypted to create a respective hashed exception by applying a hash function. According to such embodiment, identifying a correspondence between the new erroneous authentication submission and an authentication exception defined in the authentication resolution model includes applying the hash function to the new erroneous authentication submission to create a hashed result, comparing the hashed result to each respective hashed exception, and, responsive to identifying a match between the hashed result and a respective hashed exception, identifying the matching hashed exception as the corresponding authentication exception.

In an embodiment, the step of completing authentication includes confirming authentication of the client based upon the corresponding authentication exception defined in the authentication resolution model and facilitating access to the account associated with the client based upon a correlation identified between the corresponding authentication exception and the proper authentication submission. In another embodiment, the step of performing the at least one client account warning protection activity includes sending at least one notification to the client regarding the new erroneous authentication submission. In a further embodiment, the step of performing the at least one client account warning protection activity includes transmitting a secondary authentication request. In a further embodiment, the step of performing the at least one client account attack protection activity comprises facilitating client account lockout.

One or more additional embodiments pertain to a computer program product including a computer readable storage medium having program instructions embodied therewith. According to such embodiment(s), the program instructions may be executable by a computing device to cause the computing device to perform one or more steps of and/or to implement one or more embodiments associated with the above recited computer-implemented method. One or more further embodiments pertain to a system having a processor and a memory storing an application program, which, when executed on the processor, performs one or more steps of and/or implements one or more embodiments associated with the above recited computer-implemented method.

DETAILED DESCRIPTION

The various embodiments described herein are directed to managing client authentication based upon modeling. An authentication application configured to implement techniques associated with the various embodiments constructs an authentication resolution model based upon error patterns in a plurality of erroneous authentication submissions. The authentication application may address a new erroneous submission based upon correspondence to any authentication exception, authentication warning, or authentication attack defined in the authentication resolution model.

The various embodiments described herein may have advantages over conventional techniques. Specifically, based upon an authentication resolution model specific to a relevant client, the various embodiments may improve computer technology by permitting recognition of an authentication exception such that it may be determined beyond a level of confidence that the certain erroneous authentication submission was made by the relevant client rather than by another entity. Accordingly, the relevant client may be granted account access based upon the authentication exception without an account lockout or any other account protection activity, thus minimizing client and/or organizational inefficiency. In certain cases, the relevant client optionally is granted account access based upon the authentication exception without requiring further authentication, thus minimizing risk of third party attacks from shouldering or direct exposure. Additionally, permitting recognition of an authentication exception may encourage more complex authentication schemes, e.g., more complex passwords. Moreover, based upon the authentication resolution model, the various embodiments may improve computer technology by permitting recognition of an authentication warning in response to a certain erroneous authentication submission such that one or more client account warning protection activities may be performed. Furthermore, based upon the authentication resolution model, the various embodiments may improve computer technology by permitting recognition of an authentication attack in response to a certain erroneous authentication submission such that one or more client account attack protection activities may be performed. Some of the various embodiments may not include all such advantages, and such advantages are not necessarily required of all embodiments.

Particular embodiments describe techniques relating to managing client authentication. However, it is to be understood that the techniques described herein may be adapted to a variety of purposes in addition to those specifically described herein. Accordingly, references to specific embodiments are included to be illustrative and not limiting.

FIG. 1illustrates a computing infrastructure100, according to an embodiment. As shown, computing infrastructure100includes a client computing system105and a server system135, each connected to a communications network185.

Illustratively, client computing system105includes, or is otherwise operatively coupled to, a memory107, storage109, an input/output (I/O) device interface111, a central processing unit (CPU)113, and a client network interface115, all of which are interconnected via interconnect117(e.g., a bus). One or more aspects of client computing system105are accessed or controlled by one or more clients. Although shown as a single computing system, client computing system105is included to be representative of a single client or multiple clients. The one or more clients associated with the client computing system105(or multiple respective client computing systems105) may include at least one entity (a group or an individual) seeking access to and/or having ownership of an account requiring authentication management. In an embodiment, client computing system105is a thin client. Memory107includes a client application119. In an embodiment, client application119is an online application configured for interfacing with server system135and other computing systems. Client application119includes a client application interface121. In the event of multiple clients, multiple instances of client computing system105may be present, each having a respective client application119including at least one respective client application interface121. Client application interface121includes a graphical user interface (GUI), a command line interface, and/or a sensory interface (e.g., capable of discerning and processing client sound/voice commands and/or client gestures). Client application interface121optionally is or includes an authentication interface for facilitating client authentication with respect to a client account accessible via server system135. Storage109includes client application data123associated with client application119. One or more components of a GUI, a command line interface, and/or a sensory interface included in client application interface121may facilitate client input and/or may facilitate display of client application data123. Client application data123optionally includes data associated with a client authentication profile. I/O device interface111is communicatively coupled to client I/O device(s)125(e.g., touchscreen console, trackpad, joystick, microphone, speaker, etc.). The client(s) may interact with client application interface121via the client I/O device(s)125. CPU113is included to be representative of a single CPU, multiple CPUs, a single CPU having multiple processing cores, and the like. Client network interface115is configured to receive data from and transmit data to server system135via network185.

Although shown as a single computing system, server system135is included to be representative of a single server system or multiple server systems. In an embodiment, server system135includes a single hardware server configured to provide hosting capabilities. In an alternative embodiment, server system135includes, or is otherwise operatively coupled to, a plurality of hardware and/or virtualized servers configured to provide hosting capabilities. In a further alternative embodiment, server system135is a cloud server system configured to provide distributed hosting capabilities via a plurality of nodes in a cloud computing environment. According to such further alternative embodiment, the cloud computing nodes are configured to communicate with one another. Additionally, according to such further alternative embodiment, the cloud computing environment optionally offers infrastructure, platforms, and/or software as a service for which client computing system105or other systems associated with computing infrastructure100need not maintain resources locally.

Illustratively, server system135includes, or is otherwise operatively coupled to, memory137, storage139, an I/O device interface141, a CPU143, and a server network interface145, all of which may be interconnected via interconnect147(e.g., a bus). Memory137includes an authentication application149. Authentication application149includes or is otherwise operatively coupled to an authentication resolution model representation151. In an embodiment, authentication application149is configured to execute one or more artificial intelligence algorithms, e.g., utilizing one or more machine learning techniques, via authentication resolution model representation151. According to such embodiment, authentication resolution model representation151includes or is otherwise operatively coupled to an authentication resolution model and at least one knowledge base associated therewith. According to such embodiment, some or all aspects of the authentication resolution model may run within server system135. Additionally or alternatively, some or all aspects of the authentication resolution model may run externally to server system135, e.g., via a cloud-based implementation, in which case server system135communicates with or accesses such aspects of the authentication resolution model via authentication resolution model representation151. Some or all aspects of the at least one knowledge base optionally are incorporated into server system135. Alternatively, some or all aspects of the at least one knowledge base are externally located and communicatively coupled to server system135. Memory137further includes or is otherwise operatively coupled to database management system (DBMS)153. DBMS153is included to be representative of a single database system or multiple database systems. Authentication application149is configured to manage client authentication according to the various embodiments described herein. In an embodiment, authentication application149is configured to authenticate, or is configured to facilitate authentication of, one or more clients associated with client computing system105and/or other client systems in computing infrastructure100. In an alternative embodiment, authentication application149serves as an intermediary between client computing system105and an external authentication server175(e.g., a directory-based authentication server). According to such alternative embodiment, authentication application149sends authentication information associated with client computing system105and/or other client systems, either in original form or modified in a form to facilitate authentication, to external authentication server175, which may in turn perform any necessary authentication processing. According to such alternative embodiment, external authentication server175optionally is cloud-based and is communicatively coupled to elements of computing infrastructure100via network185.

Storage139includes authentication application data155. Authentication application149generates and processes authentication application data155based on interaction with other components of computing infrastructure100. Authentication application data155includes knowledge base data157generated by, used by, or otherwise associated with the authentication resolution model. Knowledge base data157includes datapoints pertaining to authentication submissions as well as authentication exception(s), authentication warning(s), and/or authentication attack(s) defined in the authentication resolution model. Knowledge base data157further includes data associated with the at least one knowledge base. Storage139further includes server databases159. DBMS153includes or interfaces with at least one software application configured to manage server databases159. In an embodiment, authentication application149sends database requests to DBMS153and processes results returned by DBMS153. In a further embodiment, server databases159include one or more relational databases. In an additional embodiment, server databases159include one or more ontology trees or other ontological structures. WhileFIG. 1illustrates three server databases159in an example context, server system135(and more generally computing infrastructure100) may include any number of databases. According to a further embodiment, DBMS153sends requests to remote databases (not shown) via network185.

I/O device interface141is communicatively coupled to server I/O device(s)161. CPU143is included to be representative of a single CPU, multiple CPUs, a single CPU having multiple processing cores, and the like. Server network interface145is configured to receive data from and transmit data to client computing system105or other client system(s) via network185. Specifically, authentication application149is configured to accept requests sent by client computing system105or other client system(s) to server system135and is configured to transmit data to client computing system105or other client system(s) via server network interface145. Furthermore, in accordance with certain embodiments, server network interface145is configured to receive data from and/or transmit data to external authentication server175.

FIG. 2illustrates a method200of managing client authentication. The method addresses authentication of an entity attempting to log in to or otherwise access a client account. One or more steps associated with the method200and the other methods described herein may be carried out in a client-server computing environment (e.g., computing infrastructure100) including a network (e.g., network185). An authentication application in a server system of the client-server computing environment (e.g., authentication application149in server system135of computing infrastructure100) facilitates processing according to the method200and the other methods described herein. The authentication application interacts with a client (or multiple clients) via a client interface associated with at least one client application of a client computing system (e.g., client application interface121associated with client application119of client computing system105). A client in the context of the method200and the other methods described herein is an individual or group associated with an account for which authorization is required. Additionally or alternatively to the client-server computing environment, one or more steps associated with the method200and the other methods described herein may be carried out within one or more workloads of a cloud computing environment. Additionally or alternatively, one or more steps associated with the method200and the other methods described herein may be carried out in a peer-to-peer network environment, in which case one or more of the method steps described herein may be carried out via a peer application of a peer computing system.

In the context of the method200and the other methods described herein, the authentication application provides, or is capable of providing, a client (or legal representative(s) of the client) as well as any other authorized entity associated with authentication advance notice of any personal data collection. The authentication application further provides any affected entity an option to opt in or opt out of any such personal data collection at any time. Optionally, the authentication application further transmits at least one notification to any affected entity each time any such personal data collection occurs and/or at designated time intervals.

The method200begins at step205, where the authentication application constructs an authentication resolution model specific to a client based upon error patterns respectively included in a plurality of erroneous authentication submissions that are inconsistent with a proper authentication submission required for an account associated with the client. The account associated with the client, i.e., the client account, is an account owned by the client and/or to which the client has authorized access. In an embodiment, the client account is associated with an operating system account, a web service account, a software application suite account (e.g., an account associated with a word processing/spreadsheet software suite), and/or a DBMS account. The proper authentication submission in the context of the various embodiments described herein is a submission required for proper authentication with respect to the client account, e.g., a designated password, a designated selection of authentication images, and/or a designated selection of authentication text. The authentication resolution model is a type of machine learning knowledge model. In an embodiment, the authentication application constructs the authentication resolution model during at least one course of authentication evaluation. The at least one course of authentication evaluation optionally includes one or more evaluation periods during which the authentication application analyzes each authentication submission with respect to the client account (and optionally other client account(s) for which the same proper authentication submission is required). The authentication application optionally receives one or more of the plurality of erroneous authentication submissions via one or more respective authentication interfaces, e.g., associated with the client interface. The one or more respective authentication interfaces include GUI, command line interface, and/or sensory aspects.

In the context of the various embodiments described herein, an erroneous authentication submission includes an authentication submission (e.g., a user log-in attempt) that is inconsistent with the proper authentication submission. In an embodiment, an erroneous authentication submission is inconsistent with the proper authentication submission such that an error pattern in such erroneous authentication submission does not match or otherwise correspond to a pattern in the proper authentication submission. According to such embodiment, an error pattern included in an erroneous authentication submission constitutes a mistyped password (e.g., a mistyped password string), an erroneous selection of authentication images (e.g., a selection of authentication images in an improper order and/or a selection of an incorrect set of authentication images), an erroneous selection of authentication text (e.g., a selection of authentication characters in an improper order and/or a selection of an incorrect set of authentication characters), and/or any other form of erroneous submission that fails to authenticate the client. In a further embodiment, the authentication application creates a client authentication profile associated with the client and links the authentication resolution model to the newly created client authentication profile. Alternatively, in the event that a client authentication profile associated with the client already exists, the authentication application links the authentication resolution model to the already existing client authentication profile. The authentication resolution model optionally is connected to only a single account associated with the client or alternatively is connected to multiple accounts associated with the client.

In an embodiment, the authentication resolution model records datapoints associated with respective authentication submissions. The model datapoints optionally include metrics for one or more respective authentication submissions, including submission date/time and submission origin (e.g., computing device and/or computing interface from which a submission is received). Additionally or alternatively, the model datapoints include metadata with regard to any error pattern included in an erroneous authentication submission and/or metadata with regard to pattern(s) included in the proper authentication submission. The model datapoints optionally pertain to both respective erroneous authentication submissions (e.g., among the plurality of erroneous authentication submissions) and respective proper authentication submissions. In the context of constructing the authentication resolution model, the authentication application optionally compares model datapoints pertaining to respective erroneous authentication submissions with model datapoints pertaining to respective proper authentication submissions. Additionally or alternatively, the authentication application compares model datapoints among respective erroneous authentication submissions. In a further embodiment, the authentication application stores the model datapoints in at least one client knowledge base associated with the authentication resolution model. According to such further embodiment, the authentication application logs the model datapoints among knowledge base data (e.g., knowledge base data157) accessible via the server system and/or accessible via another server cloud-based server. The authentication application interfaces with the authentication resolution model via a model representation (e.g., authentication resolution model representation151). A method of constructing the authentication resolution model specific to the client in accordance with step205is described with respect toFIG. 3.

Upon construction of the authentication resolution model at step205, the authentication application proceeds to dynamically manage client authentication in subsequent steps. Optionally, such dynamic client authentication management occurs during a predefined authentication session. Parameters of any predefined authentication session, such as session length and applicable authentication method(s), optionally are designated by the authentication application or alternatively are designated by the client. A predefined authentication session optionally is a predefined period of time, or alternatively the authentication application or the client may end a predefined authentication session dynamically. Additionally or alternatively, dynamic client authentication management as reflected in the steps of the method200may occur within other durations as designated by the authentication application and/or the client.

At step210, the authentication application receives, via an authentication interface, a new erroneous authentication submission that is inconsistent with the proper authentication submission. The authentication interface is included in or otherwise related to the client interface associated with the at least one client application of the client computing system. The authentication interface includes GUI, command line interface, and/or sensory aspects. The authentication interface optionally is among the one or more respective authentication interfaces via which the authentication application optionally receives one or more of the plurality of erroneous authentication submissions at step205. The at least one client application optionally includes an operating system application, a web service application, a software application suite (e.g., a word processing/spreadsheet software suite), and/or a DBMS application. In an embodiment, the new erroneous authentication submission is inconsistent with the proper authentication submission such that an error pattern in the new erroneous authentication submission does not match or otherwise correspond to a pattern in the proper authentication submission. An error pattern within the new erroneous authentication submission constitutes a mistyped password (e.g., a mistyped password string), an erroneous selection of authentication images (e.g., a selection of authentication images in an improper order and/or a selection of an incorrect set of authentication images), an erroneous selection of authentication text (e.g., a selection of authentication characters in an improper order and/or a selection of an incorrect set of authentication characters), and/or any other form of erroneous submission that fails to authenticate the client.

At step215, the authentication application determines whether the new erroneous authentication submission corresponds to an authentication exception defined in the authentication resolution model. Responsive to determining that the new erroneous authentication submission does not correspond to an authentication exception defined in the authentication resolution model, the authentication application proceeds directly to step225. Conversely, responsive to determining that the new erroneous authentication submission corresponds to an authentication exception defined in the authentication resolution model, at step220the authentication application completes authentication with respect to the client account. According to steps215and220, the authentication application completes authentication responsive to receiving any new erroneous authentication submission corresponding to an authentication exception defined in the authentication resolution model. In an embodiment, the authentication application determines that the new erroneous authentication submission corresponds to an authentication exception defined in the authentication resolution model by identifying a match between an error pattern included in the new erroneous authentication submission and an error pattern included in the authentication exception having a level of similarity to a pattern included in the proper authentication submission exceeding a predefined level of confidence threshold and that occurs a number of times exceeding a predefined error occurrence threshold over a duration of time exceeding a predefined learning threshold. In the context of the various embodiments described herein, an occurrence of an error pattern included in an authentication exception refers to inclusion of the error pattern in a given erroneous authentication submission received by the authentication application.

In the context of the method200and the other methods described herein, the predefined level of confidence threshold reflects a threshold beyond which the authentication application may confirm that an error pattern included in an erroneous authentication submission has a level of similarity to a pattern included in the proper authentication submission sufficient to conclude that the erroneous authentication submission is made by the client rather than another entity (e.g., another user or group attempting to illicitly gain access to the client account). The predefined error occurrence threshold reflects a number of error occurrences beyond which the authentication application has sufficient data to confirm that the error pattern is made by the client rather than another entity. The learning threshold reflects a duration beyond which the authentication application has sufficient time to analyze characteristics of the error pattern included in an erroneous authentication submission and to confirm based upon such analysis that the error pattern is made by the client rather than another entity. The authentication application creates an authentication exception including an error pattern due to a rationale that an entity other than the client to be authenticated is unlikely to submit an error pattern that meets each of the authentication exception criteria. The authentication application optionally establishes and/or applies one or more of the authentication exception criteria in view of aspects of the authentication resolution model. In an embodiment, the authentication application identifies a match between an erroneous typed password in the new erroneous authentication submission and typed password information recorded in the authentication exception defined in the authentication resolution model. Additionally or alternatively, the authentication application identifies a match between an erroneous selection of authentication images in the new erroneous authentication submission and a selection of authentication images recorded in the authentication exception. Additionally or alternatively, the authentication application identifies a match between an erroneous selection of authentication text in the new erroneous authentication submission and a selection of authentication text recorded in the authentication exception. A method of completing authentication with respect to the client account in accordance with step220is described with respect toFIG. 5. Upon completion of step220, the authentication application proceeds directly to step245.

At step225, the authentication application determines whether the new erroneous authentication submission corresponds to an authentication warning defined in the authentication resolution model. Responsive to determining that the new erroneous authentication submission does not correspond to an authentication warning defined in the authentication resolution model, the authentication application proceeds directly to step235. Responsive to determining that the new erroneous authentication submission corresponds to an authentication warning defined in the authentication resolution model, at step230the authentication application performs at least one client account warning protection activity. According to steps225and230, the authentication application performs at least one client account warning protection activity responsive to receiving any new erroneous authentication submission corresponding to an authentication warning defined in the authentication resolution model. The authentication application determines that the new erroneous authentication submission corresponds to an authentication warning defined in the authentication resolution model by identifying a match between an error pattern included in the new erroneous authentication submission and an error pattern included in the authentication warning that occurs a number of times exceeding the predefined error occurrence threshold over a duration of time less than or equal to the predefined learning threshold. In the context of the various embodiments, an occurrence of an error pattern included in an authentication warning refers to inclusion of the error pattern in a given erroneous authentication submission received by the authentication application. In an embodiment, the authentication application identifies a match between an erroneous typed password in the new erroneous authentication submission and typed password information recorded in the authentication warning defined in the authentication resolution model. Additionally or alternatively, the authentication application identifies a match between an erroneous selection of authentication images in the new erroneous authentication submission and a selection of authentication images recorded in the authentication warning. Additionally or alternatively, the authentication application identifies a match between an erroneous selection of authentication text in the new erroneous authentication submission and a selection of authentication text recorded in the authentication warning.

In an embodiment, responsive to determining that the new erroneous authentication submission corresponds to an authentication warning defined in the authentication resolution model, the authentication application notifies the client of the authentication warning via a predetermined client communication channel, i.e., a client communication channel separate from the authentication interface via which the client may receive notifications and/or may transmit requests with regard to client account authentication. The predetermined client communication channel may include a client email application and/or another designated client application. Additionally or alternatively, responsive to determining that the new erroneous authentication submission corresponds to an authentication warning defined in the authentication resolution model, the authentication application provides to the client via the predetermined client communication channel an option to designate the authentication warning as an authentication exception. In an embodiment, in the event that the new erroneous authentication submission is submitted by the client but does not meet the authentication exception criteria and instead corresponds to an authentication warning, the authentication application provides the client an option to request via the predetermined client communication channel that the authentication warning be reclassified as an authentication exception. In the context of such reclassification embodiment, the authentication application optionally requires the client to provide a confirmatory authentication submission via the predefined client communication channel, e.g., a secondary password or a secondary sequence of authentication images, speech recognition, biometric verification via fingerprinting or facial recognition, etc. Responsive to accepting the client request to reclassify the authentication warning as an authentication exception, the authentication application updates the authentication resolution model by redefining the authentication warning as an authentication exception.

In the context of performing the at least one client account warning protection activity, the authentication application optionally sends at least one notification to the client regarding the new erroneous authentication submission. In an embodiment, the notification optionally includes details regarding the new erroneous authentication submission, including any available submission time information, any available submission location information, and/or any submission origin information, e.g., source device, owner(s) of such source device, type of such source device, any IP address associated therewith, etc. In another embodiment, the authentication application sends, or facilitates sending of, the notification to the client via the predetermined client communication channel. In a further embodiment, the at least one client account warning protection activity is client-configurable. According to such further embodiment, one or more of the at least one notification to the client regarding the new erroneous authentication submission are client-configurable. For instance, the authentication application may provide to the client an option to determine the communication channel(s), frequency, and urgency levels associated with the at least one notification.

In the context of performing the at least one client account warning protection activity, the authentication application optionally transmits a secondary authentication request. In an embodiment, the authentication application sends a request for entry of a secondary password, a request for selection of a secondary sequence of authentication images, and/or a request for selection of a secondary sequence of authentication text. In a further embodiment, the authentication application sends a speech verification request, e.g., to confirm the voice of the client via speech recognition. In a further embodiment, the authentication application sends a request for biometric verification, e.g., fingerprinting and/or facial recognition. The authentication application optionally displays the secondary authentication request via the authentication interface, or the authentication application alternatively displays the secondary authentication request via the predetermined client communication channel. Upon completion of step230, the authentication application proceeds directly to step245.

At step235, the authentication application determines whether the new erroneous authentication submission corresponds to an authentication attack defined in the authentication resolution model. Responsive to determining that the new erroneous authentication submission does not correspond to an authentication attack defined in the authentication resolution model, the authentication application proceeds directly to step245. Conversely, responsive to determining that the new erroneous authentication submission corresponds to an authentication attack defined in the authentication resolution model, at step240the authentication application performs at least one client account attack protection activity. According to steps235and240, the authentication application performs at least one client account attack protection activity responsive to receiving any new erroneous authentication submission corresponding to an authentication attack defined in the authentication resolution model. The authentication application determines that the new erroneous authentication submission corresponds to an authentication attack defined in the authentication resolution model by identifying a match between an error pattern included in the new erroneous authentication submission and an error pattern included in the authentication attack among a plurality of error patterns that occur an equal number of times and that collectively occur a number of times exceeding the predefined error occurrence threshold (i.e., the sum of occurrences of the plurality of error patterns in aggregate exceeds the predefined error occurrence threshold). In the context of the various embodiments, an occurrence of an error pattern included in an authentication attack refers to inclusion of the error pattern in a given erroneous authentication submission received by the authentication application. In an embodiment, the authentication application identifies a match between an erroneous typed password in the new erroneous authentication submission and typed password information recorded in the authentication attack defined in the authentication resolution model. Additionally or alternatively, the authentication application identifies a match between an erroneous selection of authentication images in the new erroneous authentication submission and a selection of authentication images recorded in the authentication attack. Additionally or alternatively, the authentication application identifies a match between an erroneous selection of authentication text in the new erroneous authentication submission and a selection of authentication text recorded in the authentication attack.

In the context of performing the at least one client account attack protection activity, the authentication application optionally facilitates client account lockout. In an embodiment, the at least one client account attack protection activity is client-configurable. According to such embodiment, one or more aspects facilitating the client account lockout are client-configurable, e.g., length of lockout, requirements for resolving the lockout, etc. In another embodiment, in a context in which the authentication application controls authentication system access, the authentication application performs the client account lockout. Alternatively, in a context in which the authentication application serves as an intermediary between a user and an authentication server, such as a directory-based authentication server (e.g., external authentication server175), the authentication application transmits a client account lockout request to such authentication server. In a further embodiment, the at least one client account attack protection activity includes each of, or a subset of, the at least one client account warning protection activity. According to such further embodiment, responsive to determining that the new erroneous authentication submission corresponds to an authentication attack defined in the authentication resolution model, the authentication application optionally notifies the client of the authentication attack via the predetermined client communication channel. The at least one client account attack protection activity optionally includes relatively more active and/or relatively more urgent activities for account protection compared to the at least one client warning protection activity. For instance, in a scenario in which both performing the at least one client account warning protection activity and performing the at least one client account attack protection activity include facilitating client account lockout, a client lockout associated with the at least one client account attack protection activity may include relatively more stringent lockout resolution requirements in terms of required activity and/or timeframe compared to a client lockout associated with the at least one client account warning protection activity.

At step245, the authentication application updates the authentication resolution model specific to the client based upon the new erroneous authentication submission. In an embodiment, the authentication application updates the authentication resolution model by recording details with respect to the new erroneous authentication submission, including date/time of submission, any error pattern within submission, location of submission, device source of submission, etc. The authentication application optionally updates the authentication resolution model by recording the details of the new erroneous authentication submission, as well as any other erroneous authentication submission, in an authentication submission log associated with the client. Such details optionally include level of similarity between an error pattern included in the new erroneous authentication submission and a pattern included in the proper authentication submission, number of occurrences of the error pattern, and/or date/time of occurrence of the error pattern. Optionally, the authentication application additionally records details with regard to successful client authentication submissions in the authentication submission log. Optionally, the authentication submission log is included in or is otherwise associated with the at least one client knowledge base, in which case log data is included among the knowledge base data.

In an embodiment, the authentication application updates the authentication resolution model at step245by processing the error pattern of the new erroneous authentication submission in order to define a new authentication exception responsive to determining that the error pattern included in the new erroneous authentication submission newly meets authentication exception requirements as defined in the authentication resolution model consequent to the new erroneous authentication submission. In a further embodiment, the authentication application updates metadata related to an existing authentication exception defined in the authentication resolution model responsive to determining that the new erroneous authentication submission corresponds to the existing authentication exception, e.g., responsive to determining that the error pattern included in the new erroneous authentication submission matches an error pattern included in the existing authentication exception. In a further embodiment, the authentication application defines a new authentication warning in the authentication resolution model responsive to determining that the error pattern in the new erroneous authentication submission newly meets authentication warning requirements as defined in the authentication resolution model consequent to the new erroneous authentication submission. In a further embodiment, the authentication application updates metadata related to an existing authentication warning defined in the authentication resolution model responsive to determining that the new erroneous authentication submission corresponds to the existing authentication warning, e.g., responsive to determining that the error pattern included in the new erroneous authentication submission matches an error pattern included in the existing authentication warning. In a further embodiment, the authentication application defines a new authentication attack in the authentication resolution model responsive to determining that the error pattern included in the new erroneous authentication submission occurs among a plurality of error patterns consistent with an authentication attack that is not already defined in the authentication resolution model. In a further embodiment, the authentication application updates metadata related to an existing authentication attack defined in the authentication resolution model responsive to determining that the new erroneous authentication submission corresponds to the existing authentication attack, e.g., responsive to determining that the error pattern included in the new erroneous authentication submission matches an error pattern among a plurality of error patterns included in the existing authentication attack. In a further embodiment, in the event that the new erroneous authentication submission does not correspond to an authentication exception, an authentication warning, or an authentication attack, the authentication application optionally stores metadata, including error pattern information, for the new erroneous authentication submission among a set of unclassified error patterns. The authentication application optionally stores the set of unclassified error patterns in the authentication submission log. By updating the authentication resolution model based upon the new erroneous authentication submission and other erroneous authentication submissions, the authentication application is configured to dynamically adapt the authentication resolution model over time, e.g., beyond the at least one course of authentication evaluation during which the authentication application constructs the model per step205.

Optionally, at step250the authentication application determines whether any established predefined authentication session has expired. Responsive to determining that any such predefined authentication session has expired, the method200ends. Responsive to determining that any such predefined authentication session has not expired, the authentication application optionally returns to step210in order to continue dynamically managing client authentication, e.g., by addressing any additional received erroneous authentication submission(s).

FIG. 3illustrates a method300of constructing the authentication resolution model specific to the client. The method300provides one or more example embodiments with respect to step205of the method200. The method300begins at step305, where the authentication application identifies correlations among the plurality of erroneous authentication submissions based upon application of at least one artificial intelligence algorithm. In an embodiment, the at least one artificial intelligence algorithm includes at least one machine learning algorithm. In an embodiment, the authentication application applies a clustering algorithm based upon the model datapoints (e.g., recorded error patterns) to identify correlations, both in terms of similarities and distinctions, among the plurality of erroneous authentication submissions. As further described herein, the authentication application in turn defines aspects of the model based upon a plurality of rules (specifically, a plurality of threshold criteria) in view of the identified correlations. Furthermore, the authentication application optionally populates the at least one client knowledge base with the defined aspects. By identifying correlations at step305, the authentication application determines a number of occurrences of respective error patterns within received erroneous authentication submissions.

At step310, the authentication application determines distinctions between the plurality of erroneous authentication submissions and the proper authentication submission based upon application of the at least one artificial intelligence algorithm. The artificial intelligence algorithm(s) applied at step310optionally are the same as applied at step305or alternatively differ. In an embodiment, the authentication application applies at least one machine learning algorithm by comparing one or more of the plurality of erroneous authentication submissions with the proper authentication submission to determine distinctions. According to such embodiment, the authentication application compares respective error patterns included in one or more of the plurality of erroneous authentication submissions with pattern(s) included in the proper authentication submission and trains the authentication resolution model based upon the pattern comparison. By determining distinctions at step310, the authentication application determines level of similarity between respective error patterns within received erroneous authentication submissions and pattern(s) in the proper authentication submission.

At step315, the authentication application defines at least one authentication exception. Each of the at least one authentication exception includes an error pattern that has a level of similarity to a pattern included in the proper authentication submission exceeding a predefined level of confidence threshold and that occurs a number of times exceeding a predefined error occurrence threshold over a duration of time exceeding a predefined learning threshold. In an embodiment, the authentication application determines the level of similarity at least in part based upon a quantity of distinctions and/or relative significance of distinctions between respective error patterns respectively included in one or more of the plurality of erroneous authentication submissions and pattern(s) included in the proper authentication submission. According to such embodiment, the authentication application provides a system administrator associated with the authentication application an option to designate the predefined level of confidence threshold. Additionally or alternatively, the authentication application provides the client an option to designate the predefined level of confidence threshold, e.g., in accordance with client preferences and/or client security requirements. In another embodiment, the authentication application provides a system administrator of the authentication application an option to designate the predefined error occurrence threshold, e.g., in accordance with server system security policies and/or in accordance with available system resources. Additionally or alternatively, the authentication application provides the client an option to designate the predefined error occurrence threshold, e.g., in accordance with client preferences and/or client security requirements. Alternatively, the authentication application determines the predefined error occurrence threshold based upon application of the at least one artificial intelligence algorithm to the model datapoints (e.g., a clustering algorithm configured to group respective error occurrences). In a further embodiment, the authentication application provides a system administrator of the authentication application an option to designate the predefined learning threshold, e.g., in accordance with server system security policies and/or in accordance with server system capabilities such that the server system has sufficient data to conduct any relevant machine learning required to process respective error patterns. Additionally or alternatively, the authentication application provides the client an option to designate the predefined learning threshold, e.g., in accordance with client preferences and/or client security requirements. Alternatively, the authentication application determines the predefined learning threshold based upon application of the at least one artificial intelligence algorithm to the model datapoints (e.g., a machine learning algorithm configured to determine level of required model training).

In an embodiment, the authentication application stores the at least authentication exception defined at step315in the at least one client knowledge base. In a further embodiment, the authentication application encrypts each of the at least one authentication exception. According to such further embodiment, in the event that a single authentication exception is defined in the authentication resolution model, the authentication application encrypts the single authentication exception. In the event that multiple authentication exceptions are defined in the authentication resolution model, the authentication application encrypts the multiple authentication exceptions. Moreover, according to such further embodiment, the authentication application optionally encrypts each of the at least one authentication exception by applying a hash function. A method of identifying a correspondence between the new erroneous authentication submission and an authentication exception defined in an authentication resolution model in a context in which each authentication exception defined in the authentication resolution model is encrypted is described with respect toFIG. 4.

At step320, the authentication application defines at least one authentication warning. Each of the at least one authentication warning includes an error pattern that occurs a number of times exceeding the predefined error occurrence threshold over a duration of time less than or equal to the predefined learning threshold. An authentication warning reflects a unique error pattern submitted in excess of the threshold number of error occurrences over a duration of time that does not exceed (i.e., is less than or equal to) the predefined learning threshold. While it is possible that an error pattern associated with an authentication warning is submitted by the client, such error pattern is not submitted over a duration of time that exceeds the predefined learning threshold such that the authentication application may define such error pattern as associated with an authentication exception (though, as discussed in accordance with an aforementioned embodiment, the client optionally may request reclassification of an authentication warning to an authentication exception). In an embodiment, the authentication application stores the at least one authentication warning in the at least one client knowledge base.

At step325, the authentication application defines at least one authentication attack. Each of the at least one authentication attack includes a plurality of error patterns that occur an equal number of times and that collectively occur a number of times exceeding the predefined error occurrence threshold. A plurality of error patterns occurring an equal number of times and that occur in aggregate a number of times exceeding the predefined error occurrence threshold may be indicative of a brute force attack, e.g., a dictionary attack. In an embodiment, the authentication application stores the at least one authentication attack in the at least one client knowledge base.

In an embodiment, the authentication application executes only a subset of the steps of the method200and/or the method300. For instance, the authentication application optionally constructs an authentication resolution model by defining at least one authentication exception, without defining at least one authentication warning and/or without defining at least one authentication attack. In such instance, the authentication application optionally executes steps pertaining to authentication exception(s) defined by the model while omitting steps pertaining to authentication warning(s) and/or authentication attack(s).

FIG. 4illustrates a method400of identifying a correspondence between the new erroneous authentication submission and an authentication exception defined in the authentication resolution model in a context in which each authentication exception defined in the authentication resolution model is encrypted to create a respective hashed exception by applying a hash function. Accordingly, the method400includes steps relevant to determining that the new erroneous authentication submission corresponds to an authentication exception defined in the authentication resolution model per step215in an encryption context. The method400begins at step405, where the authentication application applies the hash function to the new erroneous authentication submission to create a hashed result. At step410, the authentication application compares the hashed result corresponding to the new erroneous authentication submission to each respective hashed exception corresponding to each authentication exception defined in the authentication resolution model. In an embodiment, the authentication application iteratively compares the hashed result to each respective hashed exception. At step415, the authentication application determines whether there is a match between the hashed result corresponding to the new erroneous authentication submission and a respective hashed exception corresponding to an authentication exception defined in the authentication resolution model. Responsive to identifying no match between the hashed result and a respective hashed exception, the authentication application proceeds to the end of the method400. Responsive to identifying a match between the hashed result and a respective hashed exception, at step420the authentication application identifies the matching hashed exception (i.e., the respective hashed exception matching the hashed result) as the corresponding authentication exception. Subsequently, the authentication application optionally executes steps for completing authentication based upon the corresponding authentication exception. For instance, when applicable, the authentication application optionally facilitates entry of a proper authentication submission required for proper authentication, e.g., an expected password or an expected sequence of authentication images.

FIG. 5illustrates a method500of completing authentication with respect to the client account based upon the corresponding authentication exception defined in the authentication resolution model. The method500provides one or more example embodiments with respect to step220of the method200. The method500begins at step505, where the authentication application confirms authentication of the client based upon the corresponding authentication exception. At step510, the authentication application facilitates access to the client account based upon a correlation identified between the corresponding authentication exception and the proper authentication submission. In an embodiment, metadata within the corresponding authentication exception may identify the correlation between an error pattern included in the new erroneous authentication submission and a pattern included in the proper authentication submission such that any difference between the respective patterns is determined and reconciled.

As for facilitating access to the client account per step510, in a context in which the authentication application controls authentication system access, the authentication application optionally grants client access immediately, i.e., dynamically in real time. In such context, identifying the correlation would be sufficient for the authentication application to grant access, and thus no proper authentication submission need be entered via the authentication interface. Alternatively, in a context in which the authentication application serves as an intermediary between a user and an authentication server, the authentication application optionally facilitates entry of the proper authentication submission into the authentication interface and/or any other interface associated with the authentication server. In such context, the authentication application optionally serves as middleware between the server system and the authentication server. In an embodiment, the authentication application facilitates entry of the proper authentication submission by entering the proper authentication submission directly via the authentication interface. In a further embodiment, the authentication application facilitates entry of the proper authentication submission by modifying the new erroneous authentication submission received via the authentication interface to coincide with the proper authentication submission. According to such further embodiment, in the event that the new erroneous authentication submission includes a mistyped password, and text of the mistyped password matches text included in an authentication exception defined in the authentication resolution model, the authentication application modifies the mistyped password to coincide with a proper password and subsequently facilitates client account access based upon the proper password. In the event that the new erroneous authentication submission includes an erroneous selection of authentication images, and the erroneous selection of authentication images matches an erroneous selection included in an authentication exception defined in the authentication resolution model, the authentication application modifies the erroneous selection of authentication images to coincide with a proper selection of authentication images and subsequently facilitates client account access based upon the proper selection.

In the context of an example scenario in accordance with the various embodiments, per step205the authentication application constructs an authentication resolution model specific to a Client A based upon a plurality of erroneous authentication submissions inconsistent with a proper authentication submission. For purposes of this example scenario, the proper authentication submission is assumed to include the password text string “ClientASuperUser@ @ @ @”. The authentication application prompts for a password text string consistent with the proper authentication submission in order to access a Client A account. Per step210, the authentication submission receives a new erroneous authentication submission from a user attempting to access the Client A account. Assuming that the new erroneous authentication submission includes the error pattern (i.e., erroneous password text string) “ClientASuperUser@ @ @$”, per step215the authentication application determines whether the new erroneous authentication submission corresponds to an authentication exception defined in the authentication resolution model specific to Client A. For purposes of this example scenario, it is assumed that there is a match between the erroneous password text string “ClientASuperUser@ @ @$” included in the new erroneous authentication submission and an error pattern “ClientASuperUser@ @ @$” included in an authentication exception defined in the authentication resolution model, and thus the authentication application determines a correspondence between the new erroneous authentication submission and the authentication exception according to step215. The authentication exception is defined as such in the authentication resolution model because the error pattern included in the authentication exception meets the relevant authentication exception criteria. Specifically, the error pattern included in the authentication exception has a level of similarity to the proper authentication submission of 95%, which exceeds a predefined level of confidence threshold, which in this case is assumed to be designated by a system administrator as 90% (the level of similarity between the error pattern “ClientASuperUser@ @ @$” included in the authentication exception and the pattern “ClientASuperUser@ @ @ @” included in the proper authentication submission is 19 characters out of 20, or 95%). Additionally, the error pattern included in the authentication exception is assumed to occur a number of times exceeding a predefined error occurrence threshold over a duration of time exceeding a predefined learning threshold. For instance, it is assumed that the erroneous password text string included in the authentication exception occurs 15 times (i.e., is included in 15 erroneous authentication submissions), greater than a predefined error occurrence threshold assumed for purposes of this example scenario and other example scenarios further described herein to be designated by the system administrator at 10, and it is further assumed that the 15 occurrences of the error pattern included in the authentication exception occurs over a period of 72 hours, greater than a predefined learning threshold assumed for purposes of this example scenario and other example scenarios further described herein to be designated by the system administrator at 48 hours.

Responsive to determining that the new erroneous authentication submission corresponds to the authentication exception per step215, per step220the authentication application completes authentication with respect to the Client A account. Per step505, the authentication application confirms authentication of Client A based upon the corresponding authentication exception defined in the authentication resolution model. Therefore, the authentication application ascertains that the user attempting to access the Client A account via the new erroneous authentication submission is Client A. Per step510, the authentication application facilitates Client A account access based upon a correlation identified between the corresponding authentication exception and the proper authentication submission. Assuming that the authentication application serves as an intermediary between the computing system through which Client A requests authentication and an external authentication server, in this scenario the authentication application may modify the new erroneous authentication submission to coincide with the proper authentication submission, i.e., the authentication application may modify the erroneous password text string “ClientASuperUser@ @ @$” included in the new erroneous authentication submission to coincide with the password text string “ClientASuperUser@ @ @ @” included in the proper authentication submission. Subsequent to completing authentication per step220and more specifically per the steps of the method500, the authentication application proceeds to step245, where the authentication application updates the authentication resolution model based upon the new erroneous authentication submission. More specifically, the authentication application updates metadata related to the corresponding authentication exception based upon characteristics of the new erroneous authentication submission. Thus, per this scenario, the authentication application authenticates Client A despite the new erroneous authentication submission and facilitates access to the Client A account based upon the corresponding authentication exception defined in the authentication resolution model.

In the context of a further example scenario in accordance with the various embodiments, per step205the authentication application constructs an authentication resolution model specific to a Client B based upon a plurality of erroneous authentication submissions inconsistent with a proper authentication submission. For purposes of this further example scenario, the proper authentication submission is assumed to include the password text string “$$ClientBCoolUser$$”. The authentication application prompts for a password text string consistent with the proper authentication submission in order to access a Client B account. Per step210, the authentication submission receives a new erroneous authentication submission from a user attempting to access the Client B account. Assuming that the new erroneous authentication submission includes the error pattern (i.e., erroneous password text string) “ClientBUser$”, per step215the authentication application determines whether the new erroneous authentication submission corresponds to an authentication exception defined in the authentication resolution model specific to Client B. For purposes of this further example scenario, it is assumed that there is no match between the erroneous password text string “ClientBUser$” and an error pattern included in an authentication exception defined in the authentication resolution model. Thus, the new erroneous authentication submission does not correspond to an authentication exception.

Accordingly, the authentication application proceeds directly to step225, where the authentication application determines whether the new erroneous authentication submission corresponds to an authentication warning defined in the authentication resolution model. For purposes of this further example scenario, it is assumed that there is a match between the erroneous password text string “ClientBUser$” included in the new erroneous authentication submission and an error pattern “ClientBUser$” included in an authentication warning defined in the authentication resolution model, and thus the authentication application determines a correspondence between the new erroneous authentication submission and the authentication warning according to step225. The authentication warning is defined as such in the authentication resolution model because the error pattern included in the authentication warning meets the relevant authentication warning criteria. Specifically, the error pattern included in the authentication warning is assumed to occur a number of times exceeding a predefined error occurrence threshold over a duration of time less than or equal to a predefined learning threshold. For instance, for this scenario it is assumed that the error pattern included in the authentication warning occurs 12 times (i.e., is included in 12 erroneous authentication submissions), greater than the predefined error occurrence threshold assumed to be designated at 10, and it is further assumed that the 12 occurrences of error pattern included the authentication exception occurs over a period of 6 hours, less than the predefined learning threshold assumed to be designated at 48 hours. Responsive to determining per step225that the new erroneous authentication submission corresponds to an authentication warning defined in the authentication resolution model, per step230the authentication application performs at least one client account warning protection activity. Specifically, performing the at least one client account warning protection activity is assumed to include sending at least one notification to Client B regarding the new erroneous authentication submission via a predetermined client communication channel, e.g., an email application designated by Client B. Subsequent to performing the at least one client account warning protection activity per step230, the authentication application proceeds to step245, where the authentication application updates the authentication resolution model based upon the new erroneous authentication submission. More specifically, the authentication application updates metadata related to the corresponding authentication warning based upon characteristics of the new erroneous authentication submission.

In the context of an additional example scenario in accordance with the various embodiments, per step205the authentication application constructs an authentication resolution model specific to a Client C based upon a plurality of erroneous authentication submissions inconsistent with a proper authentication submission. For purposes of this additional example scenario, the proper authentication submission is assumed to include the password text string “ClientCUser246”. The authentication application prompts for a password text string consistent with the proper authentication submission in order to access a Client C account. Per step210, the authentication submission receives a new erroneous authentication submission from a user attempting to access the Client C account. Assuming that the new erroneous authentication submission includes the error pattern (i.e., erroneous password text string) “ClientCUser123”, per step215the authentication application determines whether the new erroneous authentication submission corresponds to an authentication exception defined in the authentication resolution model specific to Client C. For purposes of this additional example scenario, it is assumed that there is no match between the erroneous password text string “ClientCUser123” and an error pattern included in an authentication exception defined in the authentication resolution model. Thus, the new erroneous authentication submission does not correspond to an authentication exception. Accordingly, the authentication application proceeds directly to step225, where the authentication application determines whether the new erroneous authentication submission corresponds to an authentication warning defined in the authentication resolution model. For purposes of this additional example scenario, it is further assumed that there is no match between the erroneous password text string “ClientCUser123” and an error pattern included in an authentication warning defined in the authentication resolution model. Hence, the new erroneous authentication submission does not correspond to an authentication warning.

Accordingly, the authentication application proceeds directly to step235, where the authentication application determines whether the new erroneous authentication submission corresponds to an authentication attack defined in the authentication resolution model. For purposes of this further example scenario, it is assumed that there is a match between the erroneous password text string “ClientCUser123” included in the new erroneous authentication submission and an error pattern “ClientCUser123” included in an authentication attack defined in the authentication resolution model, and thus the authentication application determines a correspondence between the new erroneous authentication submission and the authentication attack according to step235. The authentication attack is defined as such in the authentication resolution model because the error pattern included in the authentication attack meets the relevant authentication attack criteria. Specifically, the error pattern included in the authentication attack is among a plurality of error patterns that occur an equal number of times and that collectively occur a number of times exceeding the predefined error occurrence threshold. For instance, for this scenario it is assumed that error pattern included in the authentication attack is among a plurality of error patterns that occur an equal number of times and that collectively occur 17 times (i.e., are included in 17 erroneous authentication submissions in aggregate), greater than the predefined error occurrence threshold assumed to be designated at 10. Responsive to determining per step235that the new erroneous authentication submission corresponds to an authentication attack defined in the authentication resolution model, per step240the authentication application performs at least one client account attack protection activity. Specifically, performing the at least one client account attack protection activity may include locking the Client C account. Subsequent to performing the at least one client account attack protection activity per step240, the authentication application proceeds to step245, where the authentication application updates the authentication resolution model based upon the new erroneous authentication submission. More specifically, the authentication application updates metadata related to the corresponding authentication attack based upon characteristics of the new erroneous authentication submission.

The descriptions of the various embodiments of the present invention have been presented for purposes of illustration but are not intended to be exhaustive or limited to the embodiments disclosed. All kinds of modifications made to the described embodiments and equivalent arrangements should fall within the protected scope of the invention. Hence, the scope of the invention should be explained most widely according to the claims that follow in connection with the detailed description and should cover all possibly equivalent variations and equivalent arrangements. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments described herein.