In authentication, risk-based authentication is a non-static authentication system which takes into account the profile (IP address, User-Agent HTTP header, time of access, and so on[1]) of the agent requesting access to the system to determine the risk profile associated with that transaction. The risk profile is then used to determine the complexity of the challenge. Higher risk profiles leads to stronger challenges, whereas a static username/password may suffice for lower-risk profiles. Risk-based implementation allows the application to challenge the user for additional credentials only when the risk level is appropriate.[2][3][4]
Machine authentication is often used in a risk based authentication set up. The machine authentication will run in the background and only ask the customer for additional authentication if the computer is not recognized. In a risk based authentication system, the institution decides if additional authentication is necessary. If the risk is deemed appropriate, enhanced authentication will be triggered, such as a one time password delivered via an out of band communication. Risk based authentication can also be used during the session to prompt for additional authentication when the customer performs a certain high risk transaction, such as a money transfer or an address change. Risk based authentication is very beneficial to the customer because additional steps are only required if something is out of the ordinary, such as the login attempt is from a new machine.
The point is that user validation accuracy is improved without inconveniencing a user,[2][6] and risk-based authentication is used by major companies.[7] RBA is an adaptive method of authenticating users based on a variety of contextual factors. Instead of relying solely on static information, like passwords, RBA evaluates the risk associated with a user's access attempt and adjusts the authentication process accordingly.[8]
Criticismedit
The system that computes the risk profile has to be diligently maintained and updated as new threats emerge. Improper configuration may lead to unauthorized access.[9]
The user's connection profile (e.g. IP Geolocation, connection type, keystroke dynamics, user behaviour) has to be detected and used to compute the risk profile. Lack of proper detection may lead to unauthorized access.
^Wiefling, Stephan; Dürmuth, Markus; Lo Iacono, Luigi (2021-01-26). "What's in Score for Website Users: A Data-Driven Long-Term Study on Risk-Based Authentication Characteristics" (PDF). Financial Cryptography and Data Security. FC '21. Vol. 12675. pp. 361–381. arXiv:2101.10681. doi:10.1007/978-3-662-64331-0_19. ISBN978-3-662-64330-3. S2CID 231709486.
^Wiefling, Stephan; Lo Iacono, Luigi; Dürmuth, Markus. "Information website on Risk-based Authentication". Risk-based Authentication. Retrieved 2019-04-29.
^Wiefling, Stephan; Lo Iacono, Luigi; Dürmuth, Markus (2019). "Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild". In Dhillon, Gurpreet; Karlsson, Fredrik; Hedström, Karin; Zúquete, André (eds.). ICT Systems Security and Privacy Protection. IFIP Advances in Information and Communication Technology. Vol. 562. Springer International Publishing. pp. 134–148. arXiv:2003.07622. doi:10.1007/978-3-030-22312-0_10. ISBN9783030223120. S2CID 189926752.
^Williamson, G. (2006). "Enhanced Authentication In Online Banking" (PDF). Journal of Economic Crime Management. 4 (2): 18–19.
^Wiefling, Stephan; Dürmuth, Markus; Lo Iacono, Luigi (2020-12-07). "More Than Just Good Passwords? A Study on Usability and Security Perceptions of Risk-based Authentication". Annual Computer Security Applications Conference. ACSAC '20. Austin, USA: Association for Computing Machinery. pp. 203–218. arXiv:2010.00339. doi:10.1145/3427228.3427243. ISBN978-1-4503-8858-0.
^Wiefling, Stephan; Lo Iacono, Luigi; Dürmuth, Markus. "Who uses RBA? We found evidence that Google, Facebook, LinkedIn, Amazon and GOG.com are using it". Risk-based Authentication. Retrieved 2019-04-29.
^"What is Adaptive Authentication?". onelogin.com. Retrieved 2023-08-28.
^Borky, John M.; Bradley, Thomas H. (2019). "Protecting Information with Cybersecurity". In Borky, John M.; Bradley, Thomas H. (eds.). Effective Model-Based Systems Engineering. Cham: Springer International Publishing. pp. 345–404. doi:10.1007/978-3-319-95669-5_10. ISBN978-3-319-95669-5. PMC7122347. Retrieved 2023-08-28.
U.S. Patent 20,050,097,320
This cryptography-related article is a stub. You can help Wikipedia by expanding it.
risk, based, authentication, this, article, needs, additional, citations, verification, please, help, improve, this, article, adding, citations, reliable, sources, unsourced, material, challenged, removed, find, sources, news, newspapers, books, scholar, jstor. This article needs additional citations for verification Please help improve this article by adding citations to reliable sources Unsourced material may be challenged and removed Find sources Risk based authentication news newspapers books scholar JSTOR March 2011 Learn how and when to remove this template message In authentication risk based authentication is a non static authentication system which takes into account the profile IP address User Agent HTTP header time of access and so on 1 of the agent requesting access to the system to determine the risk profile associated with that transaction The risk profile is then used to determine the complexity of the challenge Higher risk profiles leads to stronger challenges whereas a static username password may suffice for lower risk profiles Risk based implementation allows the application to challenge the user for additional credentials only when the risk level is appropriate 2 3 4 Machine authentication is often used in a risk based authentication set up The machine authentication will run in the background and only ask the customer for additional authentication if the computer is not recognized In a risk based authentication system the institution decides if additional authentication is necessary If the risk is deemed appropriate enhanced authentication will be triggered such as a one time password delivered via an out of band communication Risk based authentication can also be used during the session to prompt for additional authentication when the customer performs a certain high risk transaction such as a money transfer or an address change Risk based authentication is very beneficial to the customer because additional steps are only required if something is out of the ordinary such as the login attempt is from a new machine 5 The point is that user validation accuracy is improved without inconveniencing a user 2 6 and risk based authentication is used by major companies 7 RBA is an adaptive method of authenticating users based on a variety of contextual factors Instead of relying solely on static information like passwords RBA evaluates the risk associated with a user s access attempt and adjusts the authentication process accordingly 8 Criticism editThe system that computes the risk profile has to be diligently maintained and updated as new threats emerge Improper configuration may lead to unauthorized access 9 The user s connection profile e g IP Geolocation connection type keystroke dynamics user behaviour has to be detected and used to compute the risk profile Lack of proper detection may lead to unauthorized access See also editAccess control list Attribute based access control ABAC Capability based security Context based access control CBAC Discretionary access control DAC Graph based access control GBAC Lattice based access control LBAC Location based authentication Mandatory access control MAC Organisation based access control OrBAC Role based access control RBAC Rule set based access control RSBAC References edit Wiefling Stephan Durmuth Markus Lo Iacono Luigi 2021 01 26 What s in Score for Website Users A Data Driven Long Term Study on Risk Based Authentication Characteristics PDF Financial Cryptography and Data Security FC 21 Vol 12675 pp 361 381 arXiv 2101 10681 doi 10 1007 978 3 662 64331 0 19 ISBN 978 3 662 64330 3 S2CID 231709486 a b US patent 9021555 Takaya Kato Risk based authentication patent issued March 29 2006 Wiefling Stephan Lo Iacono Luigi Durmuth Markus Information website on Risk based Authentication Risk based Authentication Retrieved 2019 04 29 Wiefling Stephan Lo Iacono Luigi Durmuth Markus 2019 Is This Really You An Empirical Study on Risk Based Authentication Applied in the Wild In Dhillon Gurpreet Karlsson Fredrik Hedstrom Karin Zuquete Andre eds ICT Systems Security and Privacy Protection IFIP Advances in Information and Communication Technology Vol 562 Springer International Publishing pp 134 148 arXiv 2003 07622 doi 10 1007 978 3 030 22312 0 10 ISBN 9783030223120 S2CID 189926752 Williamson G 2006 Enhanced Authentication In Online Banking PDF Journal of Economic Crime Management 4 2 18 19 Wiefling Stephan Durmuth Markus Lo Iacono Luigi 2020 12 07 More Than Just Good Passwords A Study on Usability and Security Perceptions of Risk based Authentication Annual Computer Security Applications Conference ACSAC 20 Austin USA Association for Computing Machinery pp 203 218 arXiv 2010 00339 doi 10 1145 3427228 3427243 ISBN 978 1 4503 8858 0 Wiefling Stephan Lo Iacono Luigi Durmuth Markus Who uses RBA We found evidence that Google Facebook LinkedIn Amazon and GOG com are using it Risk based Authentication Retrieved 2019 04 29 What is Adaptive Authentication onelogin com Retrieved 2023 08 28 Borky John M Bradley Thomas H 2019 Protecting Information with Cybersecurity In Borky John M Bradley Thomas H eds Effective Model Based Systems Engineering Cham Springer International Publishing pp 345 404 doi 10 1007 978 3 319 95669 5 10 ISBN 978 3 319 95669 5 PMC 7122347 Retrieved 2023 08 28 U S Patent 20 050 097 320 nbsp This cryptography related article is a stub You can help Wikipedia by expanding it vte Retrieved from https en wikipedia org w index php title Risk based authentication amp oldid 1182205107, wikipedia, wiki, book, books, library,
