Systems and methods for authentication using low quality and high quality authentication information

Patent metadata

Field	Value
Publication number	US-9519761-B2
Application number	US-201213605886-A
Country	US
Kind code	B2
Filing date	Sep 6, 2012
Priority date	Sep 6, 2012
Publication date	Dec 13, 2016
Grant date	Dec 13, 2016

Abstract

Systems, methods, and devices for authenticating a user are provided. A device includes one or more processors configured to determine if a requested service requires high quality authentication, generate a request for high quality authentication if the requested service requires high quality authentication, and generate a request for low quality authentication if the requested service requires low quality authentication. The device also include a network interface component coupled to a network, the network interface component configured to: receive the request for the service requiring authentication, and a memory, the memory storing high quality authentication information and low quality authentication information for authenticating the user.

First claim

What is claimed is:

1. A system, for authenticating a user, comprising:
a non-transitory memory storing instructions, high quality authentication information, and low quality authentication information; and
one or more hardware processors coupled to the non-transitory memory and configured to execute instructions to cause the system to perform operations comprising:
determining whether a requested service associated with a user triggers (i) a request for high quality authentication information from the user or (ii) a request for low quality authentication information from the user based on whether a previously performed authentication within a predetermined amount of time was a successful high quality authentication;
generating a request for low quality authentication information in response to determining that the previously performed authentication within the predetermined amount of time was a successful high quality authentication;
obtaining low quality authentication information responsive to the request for low quality authentication information;
in response to that determining the user does not pass a low quality authentication based on the obtained low quality authentication information, determining whether the requested service requires a successful authentication; and
responsive to determining that the requested service does not require a successful authentication, allowing the request for service.

2. The system of claim 1 , wherein a request for high quality authentication information comprises a request for the user to provide at least one of a user name, a password, a biometric identifier, or a combination thereof.

3. The system of claim 1 , wherein a request for low quality authentication information comprises a request for the user to provide at least one of an image of the user, a biometric identifier of the user, a location, sensor information, or a combination thereof.

4. The system of claim 1 , wherein the operations further comprise: requesting the user to perform a low quality authentication on a predefined time schedule.

5. The system of claim 1 , wherein the request for low quality authentication information comprises a plurality of requests for low quality authentication information.

6. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
receiving, from a user, a request for a service that requires authentication;
determining whether the requested service triggers a high quality authentication information or a request for low quality authentication information based on a previously performed successful authentication within a predetermined amount of time;
performing a high quality authentication if the service triggers a request for high quality authentication information;
performing a low quality authentication if the service triggers a request for the low quality authentication information;
determining whether the requested service requires a successful authentication responsive to determining that the user does not pass the high quality authentication or the low quality authentication; and
allowing the request for service responsive to determining that the service does not require a successful authentication.

7. The non-transitory machine-readable medium of claim 6 , wherein the operations further comprise:
determining whether the requested service triggers a request for high quality authentication information or a request for low quality authentication information based on an existence of a valid user session.

8. The non-transitory machine-readable medium of claim 6 , wherein performing the high quality authentication comprises performing an authentication based on at least one of a user name, a password, a biometric identifier, or a combination thereof.

9. The non-transitory machine-readable medium of claim 6 , wherein performing the low quality authentication comprises performing an authentication based on at least one of an image of the user, a biometric identifier of the user, a location, sensor information, or a combination thereof.

10. The non-transitory machine-readable medium of claim 6 , wherein determining whether the requested service triggers a request for high quality authentication information comprises:
determining whether the requested service is a service that always triggers a request for high quality authentication information; or
determining whether the requested service exceeds a predetermined risk threshold.

11. The non-transitory machine-readable medium of claim 6 , wherein performing the high quality authentication comprises performing a plurality of authentications.

12. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
performing an initial authentication successfully;
receiving, from a user, a request for a service;
determining that the requested service triggers a request for low quality authentication information in response to determining that the initial authentication was successfully performed within a predetermined amount of time and is a high quality authentication;
obtaining the low quality authentication information responsive to the request for low quality authentication information;
performing a low quality authentication based on the obtained low quality authentication information;
permitting the service responsive to determining that the low quality authentication is successfully performed;
in response to that determining the low quality authentication is not successfully performed, determining whether the requested service requires a successful authentication; and
responsive to determining that the requested service does not require a successful authentication, allowing the request for service.

13. The non-transitory machine-readable medium of claim 12 , wherein performing the high quality authentication comprises:
requesting high quality authentication information from the user; and
receiving the requested high quality authentication information from the user.

14. The non-transitory machine-readable medium of claim 13 , wherein the high quality authentication is performed based on at least one of a user name, a password, a biometric identifier, or a combination thereof.

15. The non-transitory machine-readable medium of claim 12 , wherein a request for low quality authentication information comprises:
a request for at least one of an image of the user, a biometric identifier of the user, a location, sensor information, or a combination thereof.

16. The non-transitory machine-readable medium of claim 12 , wherein determining that the service triggers a request for low quality authentication information when the initial authentication is a high quality authentication comprises:
determining whether the requested service is a service that always triggers a request for high quality authentication information; or
determining whether the requested service exceeds a predetermined risk threshold.

17. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
transmitting a request for service;
receiving, from a user, a request for authentication information;
in response to receiving the request for authentication information, determining that the request for authentication information is a request for low quality authentication information, the determination being based on a

Assignees

• Jakobsson Bjorn Markus
• Paypal Inc

Inventors

• Jakobsson Bjorn Markus

Classifications

• G06F2221/2111

  Location-sensitive, e.g. geographical location, GPS · CPC title

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title

• H04W12/06

  Authentication · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F21/31 Primary

  User authentication · CPC title