System and method for risk based authentication

• US 20050097320A1
• Filed: 09/13/2004
• Published: 05/05/2005
• Est. Priority Date: 09/12/2003
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Bennett, Naftali, Golan, Lior, Orad, Amir
• Granted Patent: US 8,572,391 B2
• Time in Patent Office: Days
• US Class Current: 713/166
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing

Abstract

A system and method may allow for flexible transaction processing based on for example the risk assessment of a transaction and/or a user or party to a transaction. Based on a risk level, for example, a level of authentication for the transaction may be set or altered.

Claims

1. A method comprising:

assessing the risk level of a transaction; and

based on the risk level, setting a level of authentication for the transaction.

2. The method of claim 1, comprising using the level of authentication to determine a set of authentication details required of a party to the transaction.

3. The method of claim 2, wherein the user was previously authenticated

4. The method of claim 2, wherein the set of authentication details includes at least a password.

5. The method of claim 1, comprising choosing among a set of levels of login security for the transaction, based on the risk level.

6. The method of claim 1, comprising setting the level of authentication after the transaction has already started.

7. The method of claim 1, wherein the transaction is a financial transaction.

8. The method of claim 1, wherein assessing the risk level of the transaction includes at least evaluating the party wishing to participate in the transaction.

9. The method of claim 8 wherein the evaluation of the party includes evaluating whether the party is who the party claims to be.

10. The method of claim 8 wherein evaluating the party includes evaluating whether the party meets a certain criteria.

11. The method of claim 1, wherein assessing the risk level of the transaction includes at least evaluating the transaction.

12. The method of claim 1, wherein assessing the risk level of the transaction includes at least evaluating size of the transaction.

13. The method of claim 1, comprising basing the risk level assessment on a set of stored data and altering the set of stored data based on the transaction.

14. The method of claim 1, comprising using the level of authentication to determine the type of authentication required of a party to the transaction.

15. The method of claim 1, comprising, in response to a certain risk level, requiring a further authentication step after an initial authentication step.

16. The method of claim 1, comprising, in response to a certain risk level, making a certain authentication step mandatory instead of optional.

17. The method of claim 1, wherein the transaction is a password recovery.

18. The method of claim 1, comprising overriding the setting a level of authentication for the transaction.

19. The method of claim 1, comprising if the user is among a set of predefined users, or the transaction meets certain criteria overriding the setting a level of authentication for the transaction.

20. The method of claim 1, comprising collecting user or transaction data and storing the data for future risk assessment.

21. The method of claim 1, comprising collecting user data and storing the data for future authentication.

22. The method of claim 1, comprising collecting transaction data and storing the transaction data for future risk assessment.

23. The method of claim 1, comprising authenticating a party to the transaction.

24. A method comprising:

accepting from a user a request to begin a transaction;

evaluating one or more of the user and the transaction for a level of risk; and

if the level of risk is above a threshold, requiring the user to provide authentication details.

25. The method of claim 24, wherein accepting the request includes at least accepting an initial set of authentication details.

26. The method of claim 24, comprising prior to accepting the request accepting from the user authentication details.

27. The method of claim 24, wherein evaluating one or more of the user and the transaction for risk includes at least evaluating the past transaction history of the user.

28. The method of claim 24, comprising if the user is among a set of predefined users, overriding requiring the user to provide security details.

29. A system comprising a processor to:

assess the risk level of a transaction; and

based on the risk level, set a level of authentication for the transaction.

30. The system of claim 29, wherein the processor is to authenticate a party to the transaction.

31. The system of claim 29, wherein the processor is to use the level of authentication to determine a set of authentication details required of a party to the transaction.

32. The system of claim 29, wherein the set of authentication details includes at least a password.

33. The system of claim 29, wherein the processor is to choose among a set of levels of login security for the transaction, based on the risk level.

34. The system of claim 29, wherein assessing the risk level of the transaction includes at least evaluating the party wishing to participate in the transaction.

35. The system of claim 29, wherein the processor is to in response to a certain risk level, require a further authentication step after an initial authentication step.

36. The system of claim 29, wherein the transaction is a password recovery.

37. A system comprising a processor to:

accept from a user a request to begin a transaction;

evaluate one or more of the user and the transaction for a level of risk; and

if the level of risk is above a threshold, require the user to provide security details.

38. The system of claim 37, wherein accepting the request includes at least accepting an initial set of security details.

39. The system of claim 37, wherein evaluating one or more of the user and the transaction for risk includes at least evaluating the past transaction history of the user.

40. The system of claim 37, wherein the processor is to, if the user is among a set of preferred users, override the requiring the user to provide security details.