User Behavior-Based Dynamic Authentication Design for Enhanced Identity Security

Multi-factor authentication (MFA) has become an essential method for enhancing security in authentication procedures by leveraging multi-dimensional authentication anchors, such as Biometrics-Based Authentication and One-time Password (OTP). However, MFA usually triggers for each login attempt and significantly impacts user usability. To this end, Risk-Based Authentication (RBA) is developed to achieve a better balance between user usability and security by dynamically checking the user authentication information. Opposite to the previous RBA designs that leverage static rules, this paper introduces Dynamic User Behavior Authentication (DUBA), an enhanced RBA design proposed to further improve both security and user experience. Our design uses probabilistic statistical methods to evaluate and score user behaviors. In this, authentication procedures can be dynamically adjusted in response to real-time user patterns and potential threats. Besides, DUBA introduces the weight adjust scheme that can efficiently defend against malicious behavior while improving usability, utilizing multi-dimensional behavioral data, such as login frequency, device information, and geographic location. We implement DUBA and evaluate its effectiveness by integrating it into the actual Single Sign-On (SSO) system in use on our campus. The results show that DUBA significantly reduces false positives and strengthens defenses against identity impersonation attacks.