How It Works

The Right Security Response.
Automatically.

STRATIUM evaluates two dimensions for every request:
how risky is this action, and how much do we trust this identity right now?

The Two Dimensions

Risk Level (0–4)
What is being requested?

Level 0: Public Data
Market feeds, status pages, public information. No authentication needed.
Level 1: Read-Only
Account history, profile information. Authenticated users only.
Level 2: Write/Sensitive
Placing orders, updating settings, modifying personal data.
Level 3: High-Value
Withdrawals, transfers, credential changes. Highest scrutiny.
Level 4: Admin Critical
System configuration, user management, security settings.

Identity Trust
How trusted is this session?

0-30: Untrusted
No login, or suspicious signals detected. IP, device, or behavior anomalies.
30-60: Changed
Logged in but IP or device changed. Partial trust; needs verification.
60-90: Normal
Normal authenticated session from expected location and device.
90-100: Verified
Recently completed 2FA or step-up authentication. Full trust.
Continuous Signals
IP stability • Device fingerprint • Session age • Behavior patterns • Manual revocation

The Risk/Trust Matrix

STRATIUM evaluates this matrix on every request — before it reaches your backend. The intersection of Risk Level and Identity Trust Score determines the enforcement action.

Risk Level 0-30 Trust
(No login / Suspicious)		 30-60 Trust
(IP Changed)		 60-90 Trust
(Logged In)		 90-100 Trust
(Just 2FA'd)
Level 0
Public data		 CAPTCHA Pass Pass Pass
Level 1
Read-only		 Require login Require login Pass Pass
Level 2
Write/sensitive		 Require 2FA Require 2FA Pass Pass
Level 3
High-value (withdrawal)		 Refuse + Cooldown Refuse + Cooldown Require 2FA Pass
Level 4
Admin critical		 Refuse + Cooldown Refuse + Cooldown Require 2FA Pass

Step-by-Step Request Flow

Here's what happens when a request arrives at STRATIUM:

Request Arrives

A request is sent to your STRATIUM gateway endpoint.

JWT Verified

STRATIUM decodes and validates the JWT. Session identity is confirmed.

Risk Level Lookup

The endpoint's configured risk level is retrieved (0-4).

Trust Score Calculated

All identity signals are evaluated: IP, device, session age, behavior.

Matrix Evaluated

Risk × Trust matrix is checked to determine required enforcement.

Challenge Generated

If required, the appropriate challenge is issued (CAPTCHA / OTP / 2FA / Hardware key).

Request Forwarded

If challenge passes (or matrix says Pass), request is routed to your backend.

Audit Logged

Response is returned to user; complete audit log entry is written.

Challenge Types

STRATIUM automatically selects the enforcement mechanism based on risk and trust context:

CAPTCHA

For low-risk actions with suspicious traffic patterns. Quick bot detection.

Email/SMS OTP

For medium-risk operations requiring identity step-up. 6-digit code sent securely.

2FA / Authenticator App

For high-risk transactions. TOTP from authenticator app or hardware token.

FIDO2/WebAuthn

For admin-critical operations. Phishing-resistant hardware key verification.

Trust Signals Monitored

STRATIUM continuously monitors these signals to maintain an accurate identity trust score:

  • IP Address Stability & Geolocation: Sudden changes in IP location or high-risk geographic areas lower trust.
  • Device Fingerprint Consistency: Passive HTTP headers combined with active browser fingerprinting detect device changes.
  • Session Age & Inactivity Decay: Older sessions naturally decay in trust; long inactivity raises suspicion.
  • Behavioral Anomalies: Time-of-day patterns, request velocity, and unusual actions trigger trust re-evaluation.
  • IP Reputation: Integration with threat intelligence databases flags known malicious IPs.
  • Manual Trust Revocation: Security admins can instantly revoke trust for a session or device.

This continuous evaluation means STRATIUM adapts to context in real-time — no rigid rules, no false positives from valid users on legitimate networks.