PROTECTION FROM UNFAMILIAR LOGIN LOCATIONS

• US 20120304260A1
• Filed: 07/06/2011
• Published: 11/29/2012
• Est. Priority Date: 05/27/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Steeves, David, Abrams, Luke, Dangayach, Hersh, Fleischman, Eric, Raju, Prabu, Vitaldevara, Krishna, Wong, Winfred, Rouskov, Yordan, Manne, Ramesh, Shekar, Niyantha, Baral, Payoj, Ramaswamy, Meenakshi
• Granted Patent: US 9,177,125 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 2101/69 using geographic information, e.g. room number
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

In one embodiment, a user authentication server may use geo-location tracking to determine whether to present an enhanced identity challenge. A communication interface 180 may receive a user login attempt by a user and a current location of the user login attempt. A data storage 150 may store a user location profile of the user. A processor 120 may execute a comparison of the current location to the user location profile. The communication interface 180 may present the user with an enhanced identity challenge before allowing user access based on the comparison.

Claims

1. A machine-implemented method for authenticating a user session, comprising:

recognizing a current location of a user login attempt;

executing a comparison of the current location to a user location profile associated with a user account; and

presenting a user with an enhanced identity challenge before allowing user access based on the comparison.

2. The method of claim 1, further comprising:

tracking in the user location profile a previous location of the user.

3. The method of claim 1, further comprising:

determining whether an immediately previous location is within traveling distance of the current location; and

selecting a challenge level for the enhanced identity challenge based on whether the current location is within traveling distance.

4. The method of claim 3, further comprising:

presenting the user with a high difficulty identity challenge if the current location is not within traveling distance.

5. The method of claim 4, further comprising:

sending a short messaging system code to a mobile telephone associated with the user account.

6. The method of claim 1, further comprising:

designating the current location as a familiar location upon successful response to the enhanced identity challenge.

7. The method of claim 6, further comprising:

decertifying a familiar location with an expired aging period.

8. The method of claim 1, further comprising:

collecting a low difficulty identity challenge response and a high difficulty identity challenge response.

9. The method of claim 1, further comprising:

collecting a login location history while in an observation mode; and

determining a home region based on the login location history.

10. The method of claim 9, further comprising:

resizing the home region based on at least one of user activity and system configuration.

11. The method of claim 9, further comprising:

exiting observation mode upon reaching at least one of a location threshold and a learning period threshold.

12. The method of claim 1, further comprising:

incrementing an unfamiliar login location counter; and

presenting a user with an enhanced identity challenge if the unfamiliar login location counter exceeds an unfamiliar login location threshold.

13. The method of claim 12, further comprising:

decrementing the unfamiliar login location counter upon successful response to the enhanced identity challenge.

14. A tangible machine-readable medium having a set of instructions detailing a method stored thereon that when executed by one or more processors cause the one or more processors to perform the method, the method comprising:

collecting a login location history while in an observation mode to create a user location profile associated with a user account;

executing a comparison of a current geo-location of a user login attempt to the user location profile; and

presenting the user with an enhanced identity challenge before allowing user access based on the user location profile.

15. The tangible machine-readable medium of claim 14, further comprising:

marking a user account as a compromised account upon a failed response to the enhanced identity challenge.

16. The tangible machine-readable medium of claim 15, further comprising:

clearing a familiar location list of the compromised account.

17. The tangible machine-readable medium of claim 14, further comprising:

factoring whether the user login attempt is from a trusted device into a determination to present the enhanced identity challenge.

18. The tangible machine-readable medium of claim 14, further comprising:

selecting a challenge level for the enhanced identity challenge based on whether the current geo-location is a fraud hotspot.

19. A user authentication server, comprising:

a communication interface to receive a user login attempt by a user and a current geo-location of the user login attempt;

a data storage to store a user location profile of the user; and

a processor executing a comparison of the geo-location to the user location profile and selecting a challenge level for an enhanced identity challenge based in part on the comparison.

20. The user authentication server of claim 19, wherein the data storage stores the current geo-location as a familiar location upon successful response to the identity challenge.