Policy-driven contextual risk evaluation in OAuth 2.0 authentication frameworks for AI chatbot-based RPA systems

Abstract

With the advent of smartphones, we can access internet services regardless of location. This shift in environment has led to the demand for services that can be utilized anytime, anywhere. Consequently, Robotic Process Automation (RPA) technology, which automates simple and repetitive tasks in industrial settings, is gaining significant attention. There is a growing trend to combine this with Artificial Intelligence (AI) chatbot technology to achieve full automation and handle higher-level tasks. However, when performing high-level tasks based on an AI chatbot-based RPA system, situations arise where the AI chatbot relies on the user’s judgment. In such scenarios, the absence of an appropriate mechanism or technology to perform identity verification between the user and the AI chatbot exposes the system to security threats like personal information leakage and system takeover. Accordingly, this paper proposes an OAuth 2.0 integrated authentication framework utilizing a context-based risk assessment approach. This framework aims to reduce the likelihood of security threats and minimize the scale of damage caused by such threats. It achieves this by enabling access control based on the user’s context while requiring the user to provide minimal information when utilizing the AI chatbot-based RPA system. More specifically, the proposed framework employs a risk assessment based on the sigmoid function, which accounts for sensitivity variations across different contexts. This approach enables sensitive adjustments to access permissions in response to contextual changes, rather than applying a fixed risk assessment. This demonstrates the framework’s capability to provide a trustworthy automated work environment through appropriate access control. Specifically, the proposed risk assessment formula quantitatively analyzes sensitivity changes for each contextual variable through mathematical interpretation. Based on this, it structurally derives the correlation between risk scores and policies. Furthermore, experimental results confirm consistency between policy flow and risk assessment, such as issuing ‘Full Access Tokens’ in normal situations and applying Access Denied in high-risk situations. Furthermore, using data flow diagrams and STRIDE, potential security threats within the proposed framework were modeled. Simulation of actual security threats demonstrated the framework’s ability to mitigate these threats, with an average latency of 9.22ms and memory usage of 64.00MB required for threat response. This empirically demonstrates that the proposed framework is a valid authentication structure capable of simultaneously achieving real-time performance, security, and lightweight characteristics even in AI-based automated environments.