ADAPTIVE SECONDARY AUTHENTICATION CRITERIA BASED ON ACCOUNT DATA

• US 20150220926A1
• Filed: 04/13/2015
• Published: 08/06/2015
• Est. Priority Date: 12/31/2012
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: McLachlan, Jonathan G., Farrugia, Augustin J., Sullivan, Nicholas T.
• Granted Patent: US 9,530,133 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

An authentication challenge system for performing secondary authentication for an account associated with an online store is described. In one embodiment, the authentication challenge system includes a question generation engine, which can derive a series of questions based upon activity associated with a user account of an online store; a network interface, which can transport the series of one or more questions derived by the question generation engine to authenticate the user to the online store; a confidence engine, which can determine a required confidence level for a successful authentication, and can compute a confidence score of the user identity; and a quality engine, which can adjust the question generation engine and the confidence engine based upon an analysis of question and answer metrics across multiple accounts of the online store. The online store can include digital media, such as music, movies, books or applications for electronic computing devices.

Claims

1. A method of generating secondary authentication questions, the method comprising:

accessing a purchase history associated with an account of an online store wherein the online store includes digital media including at least one of music, movies, books or apps;

deriving a set of questions based on the purchase history of a unique identifier associated with the account;

deriving a set of questions based on a presumed media genre preference associated with the unique identifier; and

filtering questions from one or more sets of questions based on privacy settings.

2. The method as in claim 1, further comprising:

receiving a periodic quality score update for one or more questions; and

adjusting one or more questions based on the periodic quality score updates.

3. The method as in claim 1, further comprising establishing correctness criteria for each set of questions and adjusting one or more questions based on quality score updates.

4. The method as in claim 3 wherein establishing correctness criteria for a set of questions comprises establishing correctness criteria for each question in the set of questions.

5. The method as in claim 1, further comprising:

transmitting one or more adaptively determined authentication questions to a device, to authenticate the unique identifier associated with an account of the online store;

receiving, from the device, a set of question metrics gathered during the authentication; and

submitting the set of question metrics to a metrics database.

6. A non-transitory computer-readable media storing instructions, which, when performed by a processor, cause the processor to perform operations comprising the method as in claim 1.

7. A non-transitory computer-readable media storing instructions, which, when performed by a processor, cause the processor to perform operations comprising the method as in claim 5.

8. A non-transitory computer-readable media storing instructions, which, when performed by a processor, cause the processor to perform operations to adaptively determine a confidence level, the operations comprising:

receiving a request to determine an authentication threshold required to perform an account activity, wherein the account activity is associated with a unique identifier of the account associated with an online store;

authenticating a user at a device using a primary authentication method;

calculating an activity risk factor based on the requested account activity;

determining an identity confidence factor for the unique identifier of the account; and

determining an authentication threshold for a secondary authentication method based on the requested account activity and the identity confidence factor.

9. The non-transitory computer-readable media as in claim 8, wherein determining an identity confidence factor for the unique identifier comprises:

determining a historical confidence value associated with the activity history of the unique identifier;

determining a device confidence factor based on the activity history of the device, including the frequency of association of the unique identifier with the device;

determining a network confidence factor based on a network address of the device of the user;

determining a location confidence factor based on the geographic location of the device of the user in relation to an expected geographic location; and

determining a primary authentication confidence factor based on primary authentication statistics associated with the unique identifier.

10. The non-transitory computer-readable media as in claim 8, wherein calculating an activity risk factor based on the requested account activity comprises:

computing a score to model a risk of fraud, wherein computing the score comprises assigning a score to account activity, the account activity comprising;

purchasing media from the online store,

purchasing in-app assets via the online store,

restoring past purchases from the online store;

viewing financial information associated with the account; and

changing financial information associated with the account.

11. The non-transitory computer-readable media as in claim 10 wherein computing the score to model the risk of fraud of making or restoring purchases from the online store comprises assigning a score proportional to the value of the purchase.

12. A non-transitory computer-readable media storing instructions, which, when performed by a processor, cause the processor to perform operations, the operations comprising:

receiving a question list and answer scores from a secondary authentication of the unique identifier associated with an account on an online store;

searching a question history associated with the identifier for questions which have been previously asked; and

increasing a difficulty score associated with repeated questions which were answered incorrectly during a secondary authentication session in which the identifier was authenticated.

13. The non-transitory computer-readable media as in claim 12, comprising instructions for further operations comprising decreasing the difficulty score associated with repeated questions which were correctly answered during a secondary authentication session in which the identifier was authenticated.

14. The non-transitory computer-readable media as in claim 13, wherein the media contains instructions to perform further operations, the operations comprising:

retrieving a set of metrics from a question metrics database;

assessing an overall frequency with which a question from the set of questions is asked;

assessing how often the question is answered correctly or incorrectly across a population of users of an online store;

correlating answers with accounts determined to have had at least one compromise of primary credentials; and

increasing attacker difficulty scores for incorrect questions that correlate with compromised primary credentials.

15. A method of generating secondary authentication questions, the method comprising:

accessing an activities history associated with an online account;

deriving a set of questions based on the activities history of a unique identifier associated with the account; and

filtering questions from one or more sets of questions based on privacy settings.

16. The method as in claim 15, further comprising:

receiving a periodic quality score update for one or more questions; and

adjusting one or more questions based on the periodic quality score updates.

17. The method as in claim 15, further comprising establishing correctness criteria for each set of questions and adjusting one or more questions based on quality score updates.

18. The method as in claim 17 wherein establishing correctness criteria for a set of questions comprises establishing correctness criteria for each question in the set of questions.

19. The method as in claim 15, further comprising:

transmitting one or more adaptively determined authentication questions to a device, to authenticate the unique identifier associated with the online account;

receiving, from the device, a set of question metrics gathered during the authentication; and

submitting the set of question metrics to a metrics database.

20. A non-transitory computer-readable media storing instructions, which, when performed by a processor, cause the processor to perform operations comprising the method as in claim 15.

21. A non-transitory computer-readable media storing instructions, which, when performed by a processor, cause the processor to perform operations comprising the method as in claim 19.