Event-based security challenges

• US 10,083,284 B2
• Filed: 03/28/2016
• Issued: 09/25/2018
• Est. Priority Date: 07/18/2013
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Koch, Robert Alan, Bridger, II, Robert, Lee, Jr., James T.
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): Stoica, Adrian
• Application Number:
  US15/082,079
• Publication Number:
  US 20160210449A1
• Time in Patent Office: 911 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Concepts and technologies are disclosed herein for event-based security challenges. A computer can execute a security application. The computer can receive a request for authentication information associated with a user device. The computer can access event data corresponding to the user device. The computer can generate, based upon the event data, a challenge question and a response to the challenge question. The computer can provide data indicating the challenge question and the response to a requestor associated with the request.

Claims

1. A method comprising:

receiving, at a first computing device comprising a processor and from a second computing device that hosts a resource, a request for a challenge question and a response to the challenge question, wherein the challenge question and the response are used by the second computing device to authenticate a user associated with a user device that has requested access to the resource; and

in response to receiving the request for the challenge question and the response,

accessing, by the first computing device, event data that relates to an event associated with the user of the user device,

determining, by the first computing device and based on a setting associated with the user and based on a resource type associated with the resource, a difficultly level to be required for the response to the challenge question, wherein the difficulty level comprises a degree of accuracy,

generating, by the first computing device, the challenge question based upon the event data and the difficulty level,

generating, by the first computing device, the response based upon the event data and the difficulty level, the response comprising a valid response to the challenge question, and

providing, by the first computing device and to the second computing device, the challenge question and the response.

2. The method of claim 1, wherein the resource comprises a website, and wherein the resource type is selected from a group of resource types comprising a social networking site, a banking site, and a trading site.

3. The method of claim 1, wherein the event comprises a transaction, and wherein the challenge question and the response are based on an amount associated with the transaction.

4. The method of claim 3, wherein the degree of accuracy for the amount is within a range from zero to two decimal places.

5. The method of claim 1, wherein the challenge question and the response are based on an identity of a device that was in a proximity of the user device when the event occurred.

6. The method of claim 1, wherein the event data is obtained from another user device that is associated with the user, and wherein the event data is transmitted to the first computing device by the other user device.

7. The method of claim 1, wherein the challenge question and the response relate to a time at which the user device was near an automobile.

8. The method of claim 1, wherein the challenge question and the response are based on a social networking post of the user on a social networking site.

9. The method of claim 1, wherein the challenge question and the response are based on a data download.

10. The method of claim 1, wherein the challenge question and the response are based on an identity of another user that was in a proximity of the user device at a particular time.

11. A system comprising:

a first computing device comprising a processor; and

a memory that stores computer-executable instructions that, when executed by the processor, cause the processor to perform operations comprising

receiving, at the first computing device and from a second computing device that hosts a resource, a request for a challenge question and a response to the challenge question, wherein the challenge question and the response are used by the second computing device to authenticate a user associated with a user device that has requested access to the resource, and

in response to receiving the request for the challenge question and the response,

accessing event data that relates to an event associated with the user of the user device,

determining, based on a setting associated with the user and based on a resource type associated with the resource, a difficultly level to be required for the response to the challenge question, wherein the difficulty level comprises a degree of accuracy,

generating the challenge question based upon the event data and the difficulty level,

generating the response based upon the event data and the difficulty level, the response comprising a valid response to the challenge question, and

providing, to the second computing device, the challenge question and the response.

12. The system of claim 11, wherein the resource comprises a website, and wherein the resource type is selected from a group of resource types comprising a social networking site, a banking site, and a trading site.

13. The system of claim 11, wherein the event comprises a transaction, and wherein the challenge question and the response are based on an amount associated with the transaction.

14. The system of claim 11, wherein the resource comprises a website.

15. The system of claim 11, wherein the event data is obtained from another user device that is associated with the user, and wherein the event data is transmitted to the first computing device by the other user device.

16. A computer storage medium having computer-executable instructions stored thereon that, when executed by a processor, cause the processor to perform operations comprising:

receiving, at a first computing device and from a second computing device that hosts a resource, a request for a challenge question and a response to the challenge question, wherein the challenge question and the response are used by the second computing device to authenticate a user associated with a user device that has requested access to the resource; and

in response to receiving the request for the challenge question and the response,

accessing event data that relates to an event associated with the user of the user device,

determining, based on a setting associated with the user and based on a resource type associated with the resource, a difficultly level to be required for the response to the challenge question, wherein the difficulty level comprises a degree of accuracy,

generating the challenge question based upon the event data and the difficulty level,

generating the response based upon the event data and the difficulty level, the response comprising a valid response to the challenge question, and

providing, to the second computing device, the challenge question and the response.

17. The computer storage medium of claim 16, wherein the resource comprises a website, and wherein the resource type is selected from a group of resource types comprising a social networking site, a banking site, and a trading site.

18. The computer storage medium of claim 16, wherein the event comprises a transaction, and wherein the challenge question and the response are based on an amount associated with the transaction.

19. The computer storage medium of claim 16, wherein the challenge question and the response are based on an identity of a device that was in a proximity of the user device when the event occurred.

20. The computer storage medium of claim 16, wherein the event data is obtained from another user device that is associated with the user, and wherein the event data is transmitted to the first computing device by the other user device.