Login and authentication methods and systems

Patent metadata

Field	Value
Publication number	US-11528277-B1
Application number	US-202117197865-A
Country	US
Kind code	B1
Filing date	Mar 10, 2021
Priority date	Dec 7, 2017
Publication date	Dec 13, 2022
Grant date	Dec 13, 2022

Abstract

Systems, methods, and apparatuses for authenticating requests to access one or more accounts over a network using authenticity evaluations of two or more automated decision engines are discussed. A login request for access to a user account may be submitted to multiple decision engines that each apply different rulesets for authenticating the login request, and output an evaluation of the authenticity of the login request. Based on evaluations from multiple automated decision engines, the login request may be allowed to proceed to validation of user identity and, if user identity is validated, access to the user account may be authorized. Based on the evaluations, the login attempt may also be rejected. One or more additional challenge question may be returned to the computing device used to request account access, and the login request allowed to proceed to validation of identity if the response to the challenge question is deemed acceptable.

First claim

What is claimed is:

1. A computer-implemented method for authenticating requests to access one or more accounts over a network using authenticity evaluations by two or more automated decision engines, the method comprising:
accepting, from a remote computing device, a login request for access to a user account, the login request having been submitted through a networked account portal accessed via the remote computing device;
submitting the login request to a first automated decision engine configured to apply a first ruleset for authenticating the login request and output a first determination of the authenticity of the login request based on application of the first ruleset;
submitting at least one of the login request and the first determination to a second automated decision engine configured to apply a second ruleset for authenticating the login request and output a second determination of the authenticity of the login request based on the application of the second ruleset, wherein the second ruleset differs from the first ruleset such that the second automated decision engine differs from the first automated decision engine; and
based on the first and second determinations from the first and second automated decision engines, respectively, performing at least one of the following acts:
i) allowing the login request to proceed to validation of user identity and, if user identity is validated, authorizing access to the user account;
ii) blocking the login request from proceeding to validation of user identity; or
iii) returning a challenge query to the networked account portal.

2. The method of claim 1 , wherein the first and second automated decision engines, in authenticating the login request, are adapted to evaluate whether the login request was submitted by a human user or a software robot.

3. The method of claim 2 , wherein if the login request is blocked from proceeding to validation of user identity, the method further includes returning, to the networked account portal, a standardized error message that does not indicate a result of the evaluation corresponding to whether the login request was submitted by a human user or a software robot.

4. The method of claim 1 , wherein validation of user identity includes validating one or both of a username and a password of an owner of the user account.

5. The method of claim 1 , wherein returning the challenge query to the networked account portal comprises:
returning a challenge question to the networked account portal;
receiving, via the networked account portal, a response to the challenge question; and
providing the response to one or both of the first and second automated decision engines.

6. The method of claim 5 , wherein the challenge question is a second challenge question submitted via the networked account portal and the response is a second response received via the networked account portal, and wherein one or both of the first and second automated decision engines is configured to submit a first challenge question via the networked account portal and receive a first response used in making one or both of the first and second determinations.

7. The method of claim 1 , wherein, by using the first and second determinations from the first and second automated decision engines, respectively, the method reduces one or both of false positives and false negatives in evaluating whether login requests are submitted by human users or software robots.

8. The method of claim 1 , wherein the step of allowing, blocking, or returning a challenge query based on the first and second determinations includes submitting both the first and second determinations to an automated central orchestration engine configured to apply, to the first and second determinations, a third ruleset for authenticating the login request, wherein the third ruleset differs from the first and second rulesets.

9. The method of claim 8 , wherein the automated central orchestration engine does not apply the third ruleset to the login request in authenticating the login request.

10. The method of claim 1 , wherein the step of allowing, blocking, or returning a challenge query according to (i), (ii), or (iii), respectively, is based only on the first and second determinations from the first and second automated decision engines, respectively.

11. The method of claim 1 , wherein the networked account portal is presented to the remote computing device via a software application executing on the remote computing device, and wherein the login request includes data corresponding to the remote computing device executing the software application.

12. The method of claim 1 , wherein the login request is provided by a submitter, and wherein the login request includes data corresponding to behavior of the submitter of the login request.

13. A system for authenticating requests to access one or more accounts over a network using authenticity evaluations by two or more automated decision engines, the system comprising a processor and a memory having instructions that, when executed by the processor, are configured to direct the system to:
accept, from a remote computing device, a login request for access to a user account, the login request having been submitted through a networked account portal accessed via the remote computing device;
submit the login request to a first automated decision engine configured to apply a first ruleset for authenticating the login request and output a first determination of the authenticity of the login request based on application of the first ruleset;
submit at least one of the login request and the first determination to a second automated decision engine configured to apply a second ruleset for authenticating the login request and output a second determination of the authenticity of the login request based on the application of the second ruleset, wherein the second ruleset differs from the first ruleset such that the second automated decision engine differs from the first automated decision engine;
based on the first and second determinations from the first and second automated decision engines, respectively, perform at least one of the following acts:
i) allow the login request to proceed to validation of user identity and, if user identity is validated, authorizing access to the user account;
ii) block the login request from proceeding to validation of user identity; and
iii) return a challenge query to the networked account portal.

14. The system of claim 13 , wherein the first and second automated decision engines, in authenticating the login request, are adapted to evaluate whether the login request was submitted by a human user or a software robot.

15. The system of claim 13 , wherein the networked account portal is presented to the remote computing device via a device application executing on the remote computing device, and wherein the system is configured such that returning the challenge query to the networked account portal comprises:
returning a challenge question to the device application;
receiving, via the device application, a response to the challenge question; and
providing the response to one or both of the first and second automated decision engines.

16. The system of claim 13 , wherein validation of user identity includes validating one or both of a username and a password of an owner of the user account.

17. The system of claim 13 , wherein the networked account portal is presented to the remote computing device via a web browser or a mobile device application executing on the remote computing dev

Assignees

• Wells Fargo Bank Na

Inventors

• Castonguay Mark David
• Hanwella Upul D
• Hall Bryan
• Maiorana Nicola A
• Lerner David

Classifications

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title

• G06F2221/2103

  Challenge-response · CPC title

• G06F2221/2133

  Verifying human interaction, e.g., Captcha · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title