RU2762527C1 - System and method for controlling operations during user's interaction with remote services - Google Patents

Abstract

FIELD: information security.

SUBSTANCE: invention relates to a method for controlling an operation during user’s interaction with a remote server. The method contains stages, at which: a) using a collection means, at least one user’s action requiring the operation control is detected during the user’s interaction with the remote server; b) using a task formation means, a trained model is used that, based on data on the user’s action and on user equipment, forms a task vector to be performed, and the formed task vector is transmitted to an operation control means; c) using the operation control means, a value of the information security level of the mentioned user’s action requiring the operation control is calculated, a task list to be performed is formed for the mentioned user’s action based on the mentioned formed task vector, depending on the calculated value of the information security level, and the formed task list to be performed is provided to the user; d) using the remote server, in the case of successful performance of tasks from the formed list by the user, the mentioned user’s action is performed.

EFFECT: increase in the reliability of user’s verification.

13 cl, 5 dwg

Description

Technology area

The invention relates to solutions for ensuring secure user interaction with remote services, and more specifically to systems and methods for monitoring operations when a user interacts with remote services, in particular through authentication and authorization, based on the results of performing the generated tasks by the user.

State of the art

Currently, the banking sector has expanded significantly. The user (client of the bank) is provided with new opportunities for interacting with the bank, methods of payment and transfer of funds. The variety of payment systems, plastic cards and banking services (bank services are often called remote banking services) allows the user to perform a variety of transactions through computing devices. Online banking and mobile banking make it possible to carry out monetary transactions without using a plastic card or bank account details.

In addition, there are various mechanisms to protect user funds from access to them by third parties. When a user is working with Internet banking, a method such as two-factor authentication is often used. After entering such authentication data as login and password on the online banking page, the bank sends a message to the user's mobile phone containing, for example, an additional verification code that must be entered in a special field on the page. In addition, many transactions within the Internet banking of a particular user must also be monitored to ensure security. This control is implemented through authorization. In the simplest implementation options, authorization to perform certain operations can include a one-step check, for example, by entering a code received from a bank into a special field. However, there are options where the authorization of transactions can be carried out using multi-stage verification.

However, it should be noted that there are many attacks that exploit vulnerabilities when a user interacts with banking services, which are carried out by cybercriminals in order to gain access to the user's funds. These attacks are often referred to as fraudulent attacks. For example, using phishing sites, a login and password can be obtained to access online banking. In turn, malicious software for mobile devices can allow attackers to conduct verified transactions without the user's knowledge.

Systems and methods are known that use the so-called fingerprint of the user's device to protect users from fraudulent activity. The user generally uses the same devices, each device contains a certain set of software and features that are known to the bank. In the event that a set of software changes on a device, or the device itself changes, there is a high probability that fraudulent activity is observed. When committing fraudulent activity on a device, the latter is considered dangerous.

Thus, publication US 20150324802 describes a system and method for evaluating and confirming user transactions. For this, browser fingerprints are used, as well as vectors of various combinations of parameters, including device characteristics, geolocation, information about the transaction itself.

However, excessive "paranoid" in the issue of information security and a lot of checks (for example, two- or three-factor authentication) cause inconvenience to users. For example, when buying with a mobile device in a store, you must first log in to the store application (for example, to receive a barcode or QR code), then log in to a payment application (for example, Apple Pay) to complete the payment. Passing multiple checks when performing any action often annoys users, as a result of which they refuse to actively use remote banking services, online services, and online purchases.

The present invention simplifies the authentication and authorization processes by using the control of operations when the user interacts with remote services based on the results of the user generated tasks.

The essence of the invention

The present invention is intended to monitor operations in the interaction of a user with a remote server based on the results of the execution of the user generated tasks.

The technical result of the present invention is to implement the declared purpose.

According to one embodiment, there is provided a method for monitoring an operation when a user interacts with a remote server, comprising the steps of: using the collection means, at least one user action is detected during a user's interaction with a remote server, requiring control of the operation; using the operation control means calculating the value of the information security level of said user action requiring control of the operation; generating for said user action a list of tasks to be performed depending on the calculated value of the information security level and providing the generated list of tasks to be performed by the user; with the help of the remote server, if the user successfully completes the tasks from the generated list, the said user action is performed.

According to another embodiment, a method is provided in which the control of the operation is at least a user authentication procedure.

According to one particular implementation, a method is provided in which the control of the operation is at least the procedure for authorizing the operation.

According to one particular implementation, a method is provided in which the collecting means detects at least one user action based on user manipulations performed by the user's device for interacting with a remote server.

According to one of the private embodiments, a method is provided in which data about a user's device is identified using the collection means.

According to one of the private embodiments, a method is provided, in which the information security level value is calculated using the operation control means based on the information associated with the user's account on the remote server.

According to one of the private embodiments, a method is provided, in which the information associated with a user account on a remote server is at least information about: verification of a user account; on the amount of funds in the user's accounts; about the citizenship of the user; about the duration of user registration; about the user's rating.

According to one particular implementation, a method is provided in which the list of tasks to be performed includes at least one task, including in particular: pressing a button; input of SARTSNA; password entry; Turing test; entering an authentication code; request for a code in a message; following a link in a message; providing a QR code; provision of biometric data; providing voice confirmation.

According to one particular implementation, a method is provided, in which a model is created and trained with the help of a task generating tool, which, based on data on the user's action and on the user's device, generates a task vector including the values of the weights of each task.

According to one of the particular embodiments, a method is provided in which a list of tasks to be performed is formed using the operation control means based on the rules and the results of the comparison of the information security level value with the task weights from the task vector.

According to one particular implementation, a method is provided in which a list of tasks to be performed is generated using a retrained model based on tasks performed earlier.

According to one of the particular embodiments, a method is provided in which, if the user successfully completes the tasks from the generated list, the model is retrained so that the task vector generated by the retrained model contains a smaller number of tasks.

According to one of the particular embodiments, a method is provided in which, if the user successfully completes the tasks from the generated list, the model is retrained so that the values of the task weights are higher than the values of the task weights generated by the model before the retraining.

Brief Description of Drawings

Additional objects, features and advantages of the present invention will be apparent from a reading of the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

FIG. 1 shows the structure of the control system for operations in the interaction of the user with remote services.

FIG. 2 displays an example of a neural network.

FIG. 2.1 displays examples of task vectors generated by the neural network.

FIG. 3 shows a diagram of a method for controlling operations when a user interacts with remote services.

FIG. 4 illustrates an example of a general purpose computer system on which the present invention may be implemented.

Description of embodiments of the invention

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, but may be embodied in various forms. The essence recited in the description is nothing more than specific details provided to assist a person skilled in the art in a comprehensive understanding of the invention, and the present invention is defined only within the scope of the appended claims.

The system means in the present invention means real devices, systems, components, groups of components implemented using hardware, such as application-specific integrated circuits (ASICs) or field-programmable gate arrays , FPGA) or, for example, in the form of a combination of software and hardware, such as a microprocessor system and a set of software instructions, as well as neurosynaptic chips. The functionality of these system means can be implemented exclusively by hardware means, as well as in the form of a combination, where part of the functionality of the system means is implemented by software means, and part by hardware. In some implementations, some or all of the tools may be executed on a processor of a general purpose computer (eg, as shown in FIG. 4). In this case, the components (each of the means) of the system can be implemented within the framework of both one computing device and spaced between several interconnected computing devices.

FIG. 1 shows the structure of the control system for operations in the interaction of the user with remote services.

The system for monitoring operations when a user interacts with remote services generally consists of a collection facility 110 running on the user's device 190, a task generation facility 120, and an operation control facility 130.

In one implementation, the operation control is a procedure for authenticating a user of a service provided by the remote server 199.

In yet another implementation, the operation control is a procedure for authorizing a user action when interacting with a service provided by a remote server 199.

Thus, the system for controlling operations in the interaction of a user with remote services is designed to authenticate the user and / or authorize his actions based on the performance of the generated tasks by the user during the online interaction of the user using a device 190 with a remote server 199 providing the user with various remote services.

A device 190 within the scope of the present invention is a software runtime running on a computing device (eg, a browser running on a computer, a bank application running on a mobile device).

The remote server 199 can be, for example:

- a bank server providing, in particular, such services as payments, loans, opening and servicing of banking products and other services;

- a server of a microfinance organization, providing, in particular, such services as payments, loans and other services;

- the server of the online store, which provides, in particular, such services as payments, loyalty programs and other services;

- a server of a telecommunications service provider, providing, in particular, such services as payments, loyalty programs and other services;

- a server of a logistics (for example, transport) company, which provides, in particular, such services as payments, loyalty programs and other services.

In the general case, the collection tool 110 is designed to identify information about the device 190, in particular its digital fingerprint (English fingerprint, hereinafter referred to as fingerprint). In general, a fingerprint contains information about the characteristics of the device 190. The characteristics of the device 190 are:

• device identifier 190;

• the identifier of the operating system under which the device 190 operates;

• location (geolocation) of device 190;

• regional characteristics of device firmware 190 (for example, continent / country / city);

• account ID (for example, Microsoft, Google, or Apple account ID);

• data on the use of the virtual machine or emulator for the operation of the software runtime environment on the device 190;

• the name and version of the browser of the device 190;

• plugins installed in the browser of the device 190;

• vulnerable applications installed on device 190;

• hardware authentication methods available on device 190 (eg, fingerprint reader, iris scanner, face scanner);

• software authentication methods available on device 190 (for example, password, pin code, screen unlock pattern);

• availability of available communication channels on the device 190 (whether it has access via wireless data transmission interfaces, for example, Wi-Fi, whether data transmission via mobile networks and how many mobile networks is enabled on the device, whether data transmission via wireless interfaces is enabled);

• others.

In one embodiment, fingerprint detection occurs by executing a JavaScript script in a browser on device 190, said script being a collector 110, may be stored on a remote server 199, and executed when a user from a device 190 accesses a remote server 199.

In yet another implementation, the collection is performed by an application running on device 190, the application may be an anti-virus application (eg, Kaspersky Anti-Virus for Mobile). In yet another embodiment, the application running on the device 190 and through which the collection is carried out is designed to access remote services (for example, the Sberbank-online banking application) and is created using a software development kit , SDK) supplied, for example, by the manufacturer of the anti-virus application (for example, Kaspersky Mobile Security SDK).

Information about device 190 detected by collector 110 may also include data on potentially dangerous states of device 190. Potentially dangerous states are states of device 190, when safe interaction between the user via device 190 and remote server 199 cannot be guaranteed. states.

In one of the implementation options, a potentially dangerous state is the presence of root (English root) access on the device 190 (hereinafter referred to as root access), while the collector 110 detects the presence of root access on the device 190. It should be noted that from the level It is known in the art that on a rooted device 190, an antivirus application cannot detect malicious software activity. Therefore, this state of device 190 cannot guarantee secure user interaction by device 190 with remote server 199.

In yet another embodiment, a potentially dangerous condition is an infection of device 190, and the collector 110 obtains information about the presence of infection (for example, detects malware activity on the device 190). Data on device 190 infection can be obtained both at the moment the user accesses the remote server 199, and can be detected by the collector 110 during the period of time until the user interacts with the remote server 199 (for example, the data collected by the collector running in the background) 110).

In another embodiment, the collector 110 can receive information about the device 190 from the security server 140. Such information can be information about the compromise of the device 190 performed by any other method known from the prior art (for example, information about the compromise can be obtained from the Kaspersky Security Network , KSN).

In addition, the collector 110 also determines the user manipulations performed by the device 190 for the purpose of online interaction with the remote server 199. In a preferred embodiment, the collector 110 determines at least the following user manipulations when working with the web page received from the remote server 199, or in an application running on device 190 for accessing services provided by remote server 199:

- navigation (for example, interaction with interface elements, sequential transition between pages, page elements by application elements using clicks, taps on the screen, scrolling the page or other actions);

- focusing on an element of a page or application (for example, hovering over a given element with the mouse cursor or setting focus on a given element of an application using a keyboard, touch screen or other input device);

- entering data on a page or in an application, including using such specialized interface elements as forms, input fields, navigation bar, and others.

- transferring data to the clipboard;

- changes in the state of the page or application (for example, by changing the cookie, after the expiration of time);

- management of modules and applets built into a page or application (for example, a video player);

- the above actions with auxiliary elements of a page or application, such as pop-ups (English popups), embedded pages (English iframes), and so on.

In general, the collection means 110, based on certain manipulations, detects at least one user action requiring control of the operation.

In another implementation, information about certain manipulations of the user can be transmitted by the collection means 110 to the remote server 199 or the security server 140. Thus, the specified at least one user action requiring control of the operation can be detected on the side of the remote server 199 or the server security 140 taking into account the information received.

The data revealed by the collection means 110 about the device 190 and the user's action requiring control of the operation when interacting online with the remote server 199 (for example, the user, by his action, attempts to login, for which an authentication procedure is required, or a payment for which an authorization procedure is required), transferred to the operation control 130 and the task generator 120.

In a preferred embodiment, the task generator 120 creates and trains a task generation model for each user in a manner known in the art. In the general case, the task formation model uses in its work a neural network 200 (shown in Fig. 2). Based on the received data on the actions of the user 210 and on the device of the user 220, said neural network 200 generates at the output a vector of tasks 290 that must be performed by the user to control the operation, and the vector contains at least one task. In general, the resulting vector contains weights for each task. A task is available for adding to the generated list if its weight is more than zero. The higher the task weight, the safer the task.

The tasks to be performed by the user can be at least:

- clicking a button on a web page / application;

- input of SARTSNA;

- entering a password;

- Turing test;

- entering an authentication code (for example, generated by the Google Authenticator app);

- code request via SMS / EMAIL-message;

- request to follow a link in an SMS / EMAIL message;

- activation of a mobile token;

- a request to provide a QR code;

- request for the provision of biometric data (for example, fingerprint, retina, face);

- request for voice confirmation (for example, automatically or through an operator);

- others.

Each task in the resulting vector has a numerical weight. An example of the resulting vector is shown in FIG. 2. In more detail, the operation of the system and the use of vectors will be discussed in the examples below.

In a preferred embodiment, the transaction monitor 130 calculates the security level of the user action requiring transaction control, the security level being a numeric value. As a general rule, the higher the level of information security of the action, the more strict control of the operation is required.

The information security level of an action by a user requiring transaction control is generally calculated by the transaction control 130 based on information associated with the user's account. In general, this information is not related to user manipulations performed by the device 190 for the purpose of online interaction with the remote server 199.

In the preferred embodiment, for each detected user action, the transaction monitor 130 determines the baseline information security of the action (eg, the transaction monitor 130 fetches the baseline information security information from the database 111). The operation monitor 130 then calculates the information security level of the user action based on the baseline information security level and the specified user information.

Examples of information associated with a user account are listed below:

- information about the verification of the user account (in the event that the user account of the service provided by the remote server 199, for example, the bank server, is not verified, the transaction control 130 adds a certain value to the basic level of information security in order to increase the specified level, that is, the level of information the security of an action, for example, associated with a bank transfer, for verified users can be, for example, 0.8, for unverified users - 0.9);

- information about the amount of funds in the user's accounts (in the event that the user account of the service provided by the remote server 199, for example, a bank server, contains a non-zero balance, the transaction control 130 adds some value to the basic level of information security in order to increase the specified level , that is, for users with a zero balance, the level of information security of an action, for example, associated with an online payment, can be, for example, 0.8, for users with a balance of up to 1000 US dollars - 0.9, for users with a balance of more than 1000 US dollars - 1.0);

- information about the citizenship of the user (in the event that the user account of the service provided by the remote server 199, for example, a bank server, belongs to a user with the citizenship of a country of the European Union, the control tool 130 adds a certain value to the basic level of information security in order to increase the specified level, that is, for users with citizenship of the European Union, the level of information security of an action, for example, associated with viewing personal account data, can be, for example, 0.5, for users with other citizenship - 0.1);

- information about the duration of the user's registration on the remote server (in the event that the user account of the service provided by the remote server 199, for example, the server of the online store, belongs to the user for more than three years, the operation control tool 130 subtracts some value from the basic level of information security so that lower the specified level, that is, for users with a registration duration of less than one year, the level of information security of an action, for example, associated with an attempt to log in, can be, for example, 0.8, for users with a registration duration from one to three years - 0.75, and for users with a registration duration of more than three years - 0.7);

- information about the rating of the user on the remote server 199 (if the rating of the user of the service on the remote server 199, for example, the server of the online store, is high, the control of the operation 130 subtracts some value from the basic level of information security in order to lower the specified level, then there is for users with a "silver" rating on the AHExpress platform, the level of information security of an action, for example, associated with an online payment, may be, for example, 0.9, and for users with a "platinum" rating -0.7

In a preferred embodiment, the transaction monitor 130 may combine various information from the noted examples to calculate the information security level of an action requiring transaction monitoring.

In a preferred embodiment, the activity monitor 130 receives from the task generator 120 a task vector generated based on the user action and the device of the user 190.

Based on the calculated information security level and the obtained vector of tasks, the operation control tool 130 generates a list of tasks that the user needs to complete to control the operation during online interaction with the remote server 199.

The operation control means 130 generates from the vector of tasks generated by the task generating means 120 a list containing at least one task. In this case, the total weight of the tasks in the list (the level of information security of the task list) must comply with the following rules:

- must be higher or equal to the level of information security of the user's action (for example, if the information security level of the action is calculated as 0.55, then, according to the example in Fig. 2, it corresponds to Task # N, Task # N + other tasks with non-zero weight, Task # 2 + Objective # 5);

- the number of actions is the smallest (according to the example in Fig. 2 it corresponds to Task # N);

- the total weight is the smallest of all possible options, if the number of actions to control the operation is the same (for example, if the information security level of an action is calculated as 0.85, then, according to the example in Fig. 2, it corresponds to Task # N + Task # 5, Task # N + Task # 2, and Task # N + Task # 3, however, the total weight is minimal for Task # N + Task # 3).

In general, the task list is communicated by the activity monitor 130 to the user's device 190 for the user to perform tasks.

The results of the tasks performed by the user, the operation control tool 130 transmits to the task generator 120, which retrains the neural network 200. In this case, if the user completes the tasks successfully and does not change the device 190, the neural network 200 is retrained so that the number of generated tasks decreases and increases task weights. In the event that the user performs tasks incorrectly or changes the device 190, when retraining the neural network 200, the number of tasks increases, the weights of the tasks decrease.

As a result, in one embodiment, if the user successfully completes tasks from the generated list, the task generator 120 retrains the model so that the task list generated by the retrained model contains fewer tasks. In another embodiment, if the user successfully completes tasks from the generated list, the task generating tool 120 retrains the model so that the information security level of the task list is higher than the information security level of the task list generated by the model before retraining.

In a preferred embodiment, the transaction monitor 130 and the task builder 120 are executed on the remote server 199. In another implementation, the transaction monitor 130 and the task builder 120 are executed on the security server 140 (in FIG. 1, the links are shown with dashed lines). Within the framework of the present invention, the security server 140 is a server whose resources are fully or partially used to control the operation during the online interaction of the user with the remote server 199 based on the received data (the aforementioned data about the device and the user's action). In a preferred embodiment, the security server 140 is a cloud-based security service such as Kaspersky Security Network.

In one embodiment, the operation monitor 130 may include a task generator 120, in another implementation, the operation monitor 130 and the task generator 120 are separate modules.

In one implementation, the data about the device 190 collected by the collector 110 is stored by the transaction monitor 130 in the database 111 for further retraining of the neural network 200 on a larger amount of data.

In a further embodiment, the results of the user's execution of tasks are stored by the operation monitor 130 in the database 111 for further retraining of the neural network 200 on a larger amount of data.

The operation monitor 130 transmits the results of the execution of the tasks to the remote server 199. The remote server 199, based on the results of the execution of the tasks, allows or denies the execution of the action.

Examples of the functioning of the present system are discussed below, examples of vectors are shown in FIG. 2.1. Let in the examples - Task # 2 is “pressing the (Enter) button”, Task # 5 is “enter the password”, Task # N is “enter the code from SMS”. The action that the user wants to perform - "enter his personal account", has an information security level of 0.5. A vector with weights before model retraining is indicated by a continuous line, a vector with weights after model retraining is indicated by a dashed line.

Example 1.

Let a vector with the indicated weights for tasks be formed for user actions. The user is authenticating. In order to successfully pass the control of the operation, it is necessary for the user to complete tasks with a total weight of more than 0.5. For example, completed Task # 2 and Task # 5, or only Task # N. However, subject to the above rules, the operation monitor 130 selects Task # N since the number of tasks is the smallest. In the case of a successfully passed control of the operation using the CMC code, the model is retrained, and for subsequent operations from this device 190 the task vector is changed.

Example 2.

Let the user continue to work from device 190 (continuation of Example 1). The user performs another authentication. In order to successfully pass the control of the operation, it is necessary for the user to complete tasks with a total weight of more than 0.5. For example, completed only Task # 5 or only Task # N (since in both cases the number of tasks is minimal). However, subject to the above rules, the operation monitor 130 selects Task # 5 (since the weight of the tasks is the smallest). In the case of a successfully passed control of the operation by entering a password, the model is retrained, and for subsequent operations from this device 190 the vector of tasks is changed.

Example 3.

Let the user continue to work from device 190 (continuation of Example 1), but forgot the password. In case of unsuccessful authentication (the password was entered incorrectly several times), the model is retrained, and for subsequent operations from this device 190 the task vector is changed. However, authentication still requires the user to complete tasks with a total weight greater than 0.5. However, Task # 5 and Task # N now need to be completed. For example, to successfully complete the control of the operation, the user must go through the password reset procedure, and after successfully entering the password, additionally enter the code from the SMS.

Example 4.

Let the user continue to work from device 190 (continuation of Example 1), but root access appeared on the device. In the case of authentication, the model uses information about the potentially dangerous state of device 190. At the same time, for a device with root access, the model calculates a vector with a reduced weight for Task # N, for example, equal to 0.4, since the code from SMS can be intercepted by a malicious application using root -access. In addition, after authentication is performed, the model is retrained, and for subsequent operations from this device 190 the task vector is changed so that task # N will have an even lower weight, for example, 0.3.

FIG. 3 shows a diagram of a method for controlling operations when a user interacts with remote services.

At step 310, the collector 110, based on user manipulations performed by the device 190 for interacting with the remote server 199, detects the user's online interaction with the remote server 199 requiring control of the operation.

In one implementation, the operation control is a procedure for authenticating a user of a service provided by the remote server 199.

In another implementation, the control of the operation is the procedure for authorizing the user's actions when interacting with the service provided by the remote server 199

In general, the collection means 110 is also intended to detect information about the device 190, through which the user interacts with the remote server 199, in particular, his digital fingerprint. In general, the fingerprint contains information about the characteristics of the device 190. The characteristics of the device 190 are discussed in detail in the description of FIG. 1. In one embodiment, fingerprint detection occurs by executing a JavaScript script in the browser on the device 190, said script being a collector 110, can be stored on a remote server 199 and executed when a user from a device 190 accesses a remote server 199.

In yet another implementation, the collection is performed by an application running on device 190, which application may be an anti-virus application, or be designed to access remote services and created using a development kit.

In step 320, the transaction control 130 calculates the information security level of the user action requiring transaction control. The level of information security of a user action requiring control of an operation is a numerical value. In general, the level is calculated by the transaction monitor 130 based on information associated with the user's account. Examples of such information are discussed in detail in the description of FIG. one.

At step 330, a list of tasks to be performed is generated by the control means of operation 130, depending on the calculated information security level for the user's action.

Tasks to be performed by the user are discussed in detail in the description of FIG. one.

In a preferred embodiment, the operation monitor 130 uses the task vector received from the task generator 120 to generate the task list. The task generator 120 creates and trains a task generation model for each user using methods known in the art, taking into account the received user action data. 210 and about the user's device 220. In the general case, the task formation model uses a neural network 200 in its operation. Based on the received data about the actions of the user 210 and about the user's device 220, the said neural network 200 generates at the output a vector of tasks 290 that the user needs to perform for control of the operation, while the vector contains at least one task. In general, the resulting vector contains weights for each task. Operation control tool 130 compares the indicated weights from the resulting task vector with the information security level value to generate a list of tasks based on the rules.

Examples of generating a task list based on the calculated information security level as well as the task vector 290 are discussed in detail in the description of FIG. one.

At step 340, the operation control 130 provides the generated task list for execution to the user performing the action requiring operation control.

At step 350, with the help of the remote server 199, if the user successfully completes the tasks from the generated list, said user action is performed when the user interacts online with the remote server 199.

In step 360, if the user successfully completes the tasks from the generated list, the task generator 120 retrains the model so that the task list generated by the retrained model contains fewer tasks. In another embodiment, if the user successfully completes tasks from the generated list, the task generating tool 120 retrains the model so that the information security level of the task list is higher than the information security level of the task list generated by the model before retraining. Thus, in the future, the list of tasks to be performed is generated by the task generating means 120 using the retrained model based on the tasks performed by the user earlier.

FIG. 4 shows an example of a general-purpose computer system, a personal computer or server 20, comprising a central processing unit 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processing unit 21. The system bus 23 is implemented as any bus structure known from the prior art, containing in turn a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interfacing with any other bus architecture. System memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26 contains basic procedures that transfer information between the elements of the personal computer 20, for example, at the time of loading the operating room systems using ROM 24.

The personal computer 20, in turn, contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29 and an optical drive 30 for reading and writing to removable optical disks 31, such as CD-ROM, DVD -ROM and other optical media. The hard disk 27, the magnetic disk drive 28, and the optical drive 30 are connected to the system bus 23 via the hard disk interface 32, the magnetic disk interface 33, and the optical drive interface 34, respectively. Drives and corresponding computer storage media are non-volatile storage media for computer instructions, data structures, program modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29 and a removable optical disk 31, but it should be understood that other types of computer storage media 56 that are capable of storing data in a computer readable form (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.), which are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36, where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38 and program data 39. The user has the ability to enter commands and information into the personal computer 20 through input devices (keyboard 40, manipulator " mouse "42). Other input devices may be used (not shown): microphone, joystick, game console, scanner, etc. Such input devices are conventionally connected to the computer system 20 through a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer may be equipped with other peripheral output devices (not displayed), for example, speakers, a printer, etc. ...

The personal computer 20 is capable of operating in a networked environment using a network connection with other or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the entity. the personal computer 20 shown in FIG. 4. The computer network may also contain other devices, for example, routers, network stations, peer-to-peer devices or other network nodes.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, personal computer 20 is connected to local network 50 via a network adapter or network interface 51. When using networks, personal computer 20 may use a modem 54 or other means of providing communication with a wide area network, such as the Internet. Modem 54, which is an internal or external device, is connected to the system bus 23 via a serial port 46. It should be noted that network connections are only exemplary and are not required to reflect the exact configuration of the network, i. E. in fact, there are other ways of establishing a connection by technical means of communication of one computer with another.

In conclusion, it should be noted that the information given in the description are examples and do not limit the scope of the present invention defined by the claims. One skilled in the art will appreciate that there may be other embodiments of the present invention consistent with the spirit and scope of the present invention.

Claims (32)

1. A method for controlling an operation when a user interacts with a remote server, containing the stages at which: a) using the collection means, at least one user action is detected when the user interacts with the remote server, requiring control of the operation; b) using the task formation tool, a trained model is used, which, based on data about the user's action and about the user's device, generates a vector of tasks to be performed, and transfers the generated task vector to the operation control tool; c) using the operation control means, the value of the information security level of said user action requiring control of the operation is calculated, a list of tasks to be performed for said user action based on the mentioned generated task vector is generated depending on the calculated value of the information security level, and the generated list of tasks to be performed is provided user; d) with the help of a remote server, if the user successfully completes tasks from the generated list, the said user action is performed. 2. The method of claim 1, wherein the control of the operation is at least a user authentication procedure. 3. The method according to claim 1, wherein the control of the operation is at least a procedure for authorizing the operation. 4. The method of claim 1, wherein the collecting means detects at least one user action based on user manipulations performed by the user's device for interacting with a remote server. 5. The method according to claim 1, wherein the collection means identifies data about the user's device. 6. The method according to claim 1, wherein the operation control means calculates an information security level value based on information associated with a user account on a remote server. 7. The method according to claim 6, in which the information associated with the user account on the remote server is at least information: - about the verification of the user account; - about the amount of funds in the user's accounts; - about the citizenship of the user; - about the duration of user registration; - about the user's rating. 8. The method according to claim 1, wherein the list of tasks to be performed includes at least one task, including, in particular: - button press; - input of SARTSNA; - entering a password; - Turing test; - entering the authentication code; - request for a code in a message; - following the link in the message; - providing a QR code; - provision of biometric data; - provision of voice confirmation. 9. The method of claim 1, wherein the task vector includes weight values for each task. 10. The method according to claim 9, in which a list of tasks is formed using the operation control means to be performed based on the rules and the results of the comparison of the information security level value with the task weights from the task vector. 11. The method according to claim 1, wherein the list of tasks to be performed is generated using the retrained model based on the tasks performed earlier. 12. The method according to claim 11, in which, if the user successfully completes tasks from the generated list, the model is retrained so that the task vector generated by the retrained model contains fewer tasks. 13. The method according to claim 11, in which, if the user successfully completes tasks from the generated list, the model is retrained so that the values of the task weights are higher than the values of the task weights generated by the model before the retraining.

Images