Confidence-based authentication

Patent metadata

Field	Value
Publication number	US-9485237-B1
Application number	US-201314105836-A
Country	US
Kind code	B1
Filing date	Dec 13, 2013
Priority date	Oct 19, 2011
Publication date	Nov 1, 2016
Grant date	Nov 1, 2016

Abstract

Disclosed are various embodiments that perform confidence-based authentication of a user. An identification of a user account is obtained from a user, and a minimum confidence threshold is determined. Multiple authentication challenges are presented to the user. Responses are obtained from the user to a subset of the challenges, with each response having a corresponding authentication point value. A confidence score is generated for the user, where the confidence score is increased by the respective authentication point values of the correct responses. The user is authenticated as being associated with the user account in response to determining that the confidence score meets the minimum confidence threshold.

First claim

Therefore, the following is claimed:

1. A non-transitory computer-readable medium embodying a program executable in at least one first computing device, wherein when executed the program causes the at least one first computing device to at least:
in response to receiving an identification of a user account from a second computing device, determine a minimum confidence threshold and a minimum inverse confidence threshold based at least in part on a particular account type associated with the user account;
present a plurality of authentication questions;
in response to receiving corresponding answers to individual ones of a subset of the plurality of authentication questions, generate a confidence score, wherein the confidence score is increased by respective authentication point values of the corresponding answers that are correct;
generate an inverse confidence score, wherein the inverse confidence score is increased by the respective authentication point values of the corresponding answers that are incorrect;
determine whether the confidence score meets the minimum confidence threshold and whether the inverse confidence score meets the minimum inverse confidence threshold;
authenticate a user at the second computing device as being associated with the user account in response to determining that the confidence score meets the minimum confidence threshold and the inverse confidence score does not meet the minimum inverse confidence threshold; and
wherein at least one of the plurality of authentication challenges corresponds to a dummy question, and generating the inverse confidence score further comprises increasing the inverse confidence score by a respective authentication point value associated with a corresponding answer to the dummy question in response to determining that the dummy question is answered by the user.

2. The non-transitory computer-readable medium of claim 1 , wherein when executed the program further causes the at least one first computing device to at least present an additional authentication question in response to determining that the confidence score does not meet the minimum confidence threshold and the inverse confidence score does not meet the minimum inverse confidence threshold.

3. The non-transitory computer-readable medium of claim 1 , wherein when executed the program further causes the at least one first computing device to at least deem authentication of the user at the second computing device as being associated with the user account to have failed as a result of determining that the inverse confidence score meets the minimum inverse confidence threshold.

4. The non-transitory computer-readable medium of claim 1 , wherein when executed the program further causes the at least one first computing device to at least authorize the user at the second computing device to access anonymously accessible resources when the authentication fails.

5. The non-transitory computer-readable medium of claim 1 , wherein when executed the program further causes the at least one first computing device to at least authorize the user at the second computing device to access a resource associated with the user account after the user at the second computing device is authenticated as being associated with the user account.

6. A system, comprising:
at least one first computing device; and
an authentication application executable in the at least one computing device, wherein when executed the authentication application causes the at least one first computing device to at least:
present a plurality of authentication challenges to a user at a second computing device in response to receiving an identification of a user account from the user;
generate a confidence score for the user at the second computing device in response to receiving corresponding responses to individual ones of a subset of the plurality of authentication challenges from the user at the second computing device, individual ones of the corresponding responses being associated with a respective authentication point value, at least two of the corresponding responses that are correct being associated with different respective authentication point values that correspond to the respective authentication challenges, the confidence score being increased by the respective authentication point values of the corresponding responses that are correct;
authenticate the user at the second computing device as corresponding to the user account in response to determining that the confidence score meets a minimum confidence threshold; and
wherein at least one of the plurality of authentication challenges corresponds to a dummy question, and generating the confidence score further comprises decreasing the confidence score by a respective authentication point value associated with a corresponding answer to the dummy question in response to determining that the dummy question is answered by the user.

7. The system of claim 6 , wherein when executed the authentication application further causes the at least one first computing device to at least determine a characteristic associated with the second computing device, wherein at least one of the plurality of authentication challenges is determined based at least in part on the characteristic.

8. The system of claim 6 , wherein when executed the authentication application further causes the at least one first computing device to at least:
determine a characteristic associated with the second computing device; and
determine the minimum confidence threshold based at least in part on the characteristic.

9. The system of claim 6 , wherein when executed the authentication application further causes the at least one first computing device to at least present at least one other authentication challenge to the user at the second computing device in response to determining that the confidence score is below the minimum confidence threshold and above a negative confidence threshold.

10. The system of claim 6 , wherein when executed the authentication application further causes the at least one first computing device to at least:
determine a negative confidence threshold;
deem authentication of the user at the second computing device as corresponding to the user account to have failed as a result of determining that the confidence score falls beneath the negative confidence threshold; and
wherein the confidence score is decreased by the respective authentication point values of the corresponding responses that are incorrect.

11. The system of claim 6 , wherein at least one of the plurality of authentication challenges has at least two possible correct responses, at least some of the at least two possible correct responses being associated with different authentication point values.

12. The system of claim 6 , wherein the user account is associated with one of a plurality of account types, and individual ones of the plurality of account types are associated with different minimum confidence thresholds.

13. The system of claim 6 , wherein when executed the authentication application further causes the at least one first computing device to at least generate the plurality of authentication challenges based at least in part on whether a particular hardware module is coupled to the second computing device.

14. The system of claim 6 , wherein when executed the authentication application further causes the at least one first computing device to at least determine the minimum confidence threshold based in part on whether a security credential reset is requested for the user account.

15. A method, comprising:
presenting, via a

Assignees

• Amazon Tech Inc

Inventors

• Johansson Jesper Mikael
• Canavor Darren Ernest
• Hitchcock Daniel Wade
• Vijyapurpu Chandra Sekhar Venkata Bhanu

Classifications

• H04L9/3231

  Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861) · CPC title

• G06Q20/40145

  Biometric identity checks · CPC title

• H04W4/80

  Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication · CPC title

• H04L9/3271

  using challenge-response · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title