System and method for generating user authentication challenges

Patent metadata

Field	Value
Publication number	US-9348981-B1
Application number	US-201213355486-A
Country	US
Kind code	B1
Filing date	Jan 21, 2012
Priority date	Jan 23, 2011
Publication date	May 24, 2016
Grant date	May 24, 2016

Abstract

A system and method for generating user authentication challenges based on risk level is provided. A login request from a user is received. The login request includes identifying information associated with the user sending the login request. A risk analysis based on the identifying information associated with the user sending the login request is performed. A level of risk is identified. The level of risk is part of a risk index that includes multiple levels of risk. An authentication challenge based on the identified level of risk is generated. The login request is allowed or denied based on the completion on the authentication challenge.

First claim

What is claimed is:

1. A computer-implemented method performed by one or more computing devices for generating an authentication challenge to a user, the method comprising:
receiving, at the one or more computing devices, a first login request from a user, wherein the first login request includes identifying information associated with the user from which the first login request was received;
performing a risk analysis of the user, using the one or more computing devices, based on the identifying information associated with the user sending the first login request;
identifying, using the one or more computing devices, a level of risk associated with the user based on a comparison between an IP address of the user and a list of known adversarial IP addresses and a determination of a proximity between a first origin of the first login request and a second origin of a previous successful login request combined with a time between the first login request and the previous successful login request, wherein the level of risk associated with the user is one of two or more levels of risk associated with a risk index wherein each of the two or more levels of risk represents a degree of confidence the user is an adversarial user;
determining, at the one or more computing devices, whether to generate an authentication challenge based at least in part on the identified level of risk of the user;
if a determination is made to generate the authentication challenge based at least in part on the identified level of risk of the user, generating, at the one or more computing devices, the authentication challenge associated with a level of difficulty, the level of difficulty of the authentication challenge based at least in part on the identified level of risk of the user; and
sending the generated authentication challenge for display to the user from which the first login request was received.

2. The computer-implemented method of claim 1 , further comprising:
analyzing the user's interaction with the authentication challenge and altering the level of risk associated with the user or denying the first login request based on the user's interaction.

3. The computer-implemented method of claim 1 , wherein the analyzing further includes organizing the levels of risk into the risk index.

4. The computer-implemented method of claim 1 , further comprising:
receiving a response from the user and assessing completion of the authentication challenge based on the response from the user.

5. The computer-implemented method of claim 1 , wherein the generated authentication challenge for the level of risk is different from a second authentication challenge associated with a second level of risk, wherein the second level of the two or more levels of risk associated with a risk index.

6. The computer-implemented method of claim 1 , further comprising:
identifying an authentication challenge from multiple authentication challenges, each of the multiple authentication challenges including a degree of difficulty associated with at least one of the multiple levels of risk.

7. The computer-implemented method of claim 1 , wherein the level of difficulty of the authentication challenges generated varies in degree of difficulty.

8. The computer-implemented method of claim 1 , wherein at least one of the multiple levels of risk correspond to a simple authentication challenge.

9. The computer-implemented method of claim 1 , wherein at least one of the multiple levels of risk correspond to a difficult authentication challenge.

10. The computer-implemented method of claim 1 , wherein at least one of the multiple levels of risk corresponds to eliminating the generation of an authentication challenge.

11. The computer-implemented method of claim 1 , wherein identifying the level of risk associated with the user based on the determination of the proximity between the first origin of the first login request the second origin of the previous successful login request combined with the time between the first login request and the previous successful login request includes calculating whether the time between the first login request at a first geographic location and the previous successful login request at a second geographic location exceeds a travel time between the first geographic location and the second geographic location.

12. A system for generating an authentication challenge to a user, the system comprising:
one or more processors;
a login receiver stored on a memory and executable by the one or more processors for receiving a first login request from a user, wherein the first login request includes identifying information associated with the user sending the first login request;
a risk analysis engine stored on a memory and executable by the one or more processors for performing a risk analysis of the user based on the identifying information associated with the user sending the first login request and identifying a level of risk associated with the user based on a comparison between an IP address of the user and a list of known adversarial IP addresses and a determination of a proximity between a first origin of the first login request and a second origin of a previous successful login request combined with a time between the first login request and the previous successful login request, wherein the level of risk associated with the user is part of a risk index that includes multiple levels of risk wherein each of the multiple levels of risk represents a degree of confidence the user is an adversarial user; and
a challenge generation engine stored on a memory and executable by the one or more processors for determining whether to generate an authentication challenge based on the identified level of risk of the user, generating the authentication challenge associated with a level of difficulty, the level of difficulty of the authentication challenge based on the identified level of risk of the user if a determination is made to generate the authentication challenge based on the identified level of risk of the user and sending the authentication challenge for display to the user.

13. The system of claim 12 , further comprising:
a challenge assessment engine stored on a memory and executable by the one or more processors for analyzing the user's interaction with the authentication challenge and altering the level of risk associated with the user or denying the first login request based on the user's interaction.

14. The system of claim 12 , further comprising:
a challenge assessment engine stored on a memory and executable by the one or more processors for receiving a response from the user and assessing completion of the authentication challenge based on the response from the user.

15. The system of claim 12 , wherein the generated authentication challenge for the level of risk is different from a second authentication challenge associated with a second level of risk, wherein the second level of the two or more levels of risk associated with a risk index.

16. The system of claim 12 , further comprising identifying an authentication challenge from multiple authentication challenges, each of the multiple authentication challenges including a degree of difficulty associated with at least one of the multiple levels of risk.

17. The system of claim 12 , wherein the level of difficulty of the authentication challenges generated varies in degree of difficulty.

18. The system of claim 12 , wherein at least one of the multiple levels of risk correspond to a simple authentication challenge.

Assignees

• Hearn Michael Christopher
• Archer Andrew M
• Thakur Madhukar Narayan
• Shen Honghai
• Doshi Shreyas S
• Google Inc

Inventors

• Hearn Michael Christopher
• Archer Andrew M
• Thakur Madhukar Narayan
• Shen Honghai
• Doshi Shreyas S

Classifications

• G06F21/31 Primary

  User authentication · CPC title

• H04L9/3271

  using challenge-response · CPC title

• G06F2221/2133

  Verifying human interaction, e.g., Captcha · CPC title