Abstract: An authentication system identifies and mitigates the effectiveness of a Multi-factor Authentication (MFA) Fatigue attack. The attack may be detected based on the number of requests for authentication received for a user within a predetermined time window, or through user or administrator input. Once detected, the authentication system is placed in a safe mode to mitigate the MFA Fatigue attack. In safe mode, all pending requests for authentication are automatically rejected. Subsequent requests for mitigation may be automatically rejected or the authentication process may be modified to accurately differentiate authentication attempts from a legitimate user from authentication attempts that are part of the MFA Fatigue attack. To further mitigate the effectiveness of MFA Fatigue attacks, the authentication system may use simulated authentication attempts to identify and train users who are susceptible to MFA Fatigue attacks.

Abstract: An authentication server verifies the initiating device of a request for authentication is a trusted endpoint prior to proceeding with the authentication process to prevent an Adversary in the Middle (AiTM) attack on a deployed Multi-Factor Authentication (MFA) system. The server may verify that the initiating device is a trusted endpoint based on matching Internet Protocol (IP) addresses for the initiating device and a confirming device associated with an authorized user or by verifying the identity of the user based on video of the user captured by the initiating device. Verification that the initiating device is a trusted endpoint may be performed prior to sending a request for confirmation of the requestion for authentication to the confirming device or may be used to establish trust before issuing or updating a certificate to the initiating device for a certificate based authentication procedure.

Abstract: An authentication system identifies and mitigates the effectiveness of a Multi-factor Authentication (MFA) Fatigue attack. The attack may be detected based on the number of requests for authentication received for a user within a predetermined time window, or through user or administrator input. Once detected, the authentication system is placed in a safe mode to mitigate the MFA Fatigue attack. In safe mode, all pending requests for authentication are automatically rejected. Subsequent requests for mitigation may be automatically rejected or the authentication process may be modified to accurately differentiate authentication attempts from a legitimate user from authentication attempts that are part of the MFA Fatigue attack. To further mitigate the effectiveness of MFA Fatigue attacks, the authentication system may use simulated authentication attempts to identify and train users who are susceptible to MFA Fatigue attacks.

Abstract: A process of confirming an originator of an electronic mail (email) includes receiving a request for verification of the identity of an alleged originator of the email, which may be sent from the actual originator of the email or a recipient of the email. The alleged originator of the email may be determined, e.g., by parsing the email to determine the name of the sender in the email. Verification is obtained from a biometric-enabled client that is associated with the send whether the email was in fact sent by the sender as well as confirmation of the identity of the sender based on a previously stored identity-proofed biometric.

Abstract: A process of confirming an originator of an electronic mail (email) includes receiving a request for verification of the identity of an alleged originator of the email, which may be sent from the actual originator of the email or a recipient of the email. The alleged originator of the email may be determined, e.g., by parsing the email to determine the name of the sender in the email. Verification is obtained from a biometric-enabled client that is associated with the send whether the email was in fact sent by the sender as well as confirmation of the identity of the sender based on a previously stored identity-proofed biometric.

Abstract: An automated process is disclosed for improving the functionality of computer systems and electronic commerce in user identity-proofing. Steps include verifying that a user who is electronically seeking identity proofing is on an electronic directory of persons eligible for such identity proofing; creating an attest list for the user that includes associates who can vouch for his or her identity; collecting a video or other data from the user; sending the video or data to the associates and asking them for a confirmation or a disavowal of the identity of the user; deriving a biometric from the video or data upon receiving the confirmation; and saving the biometric as an identity-proofed biometric.

Abstract: An automated process is disclosed for improving the functionality of computer systems and electronic commerce in user identity-proofing. Steps include verifying that a user who is electronically seeking identity proofing is on an electronic directory of persons eligible for such identity proofing; creating an attest list for the user that includes associates who can vouch for his or her identity; collecting a video or other data from the user; sending the video or data to the associates and asking them for a confirmation or a disavowal of the identity of the user; deriving a biometric from the video or data upon receiving the confirmation; and saving the biometric as an identify-proofed biometric.