Generating authentication challenges based on preferences of a user's contacts

• US 8,250,632 B1
• Filed: 09/27/2011
• Issued: 08/21/2012
• Est. Priority Date: 08/08/2011
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Staddon, Jessica
• Primary Examiner(s): LAFORGIA, CHRISTIAN A
• Application Number:
  US13/246,824
• Time in Patent Office: 329 Days
• Field of Search: 726 4- 7, 726/21, 713/182, 705/319
• US Class Current: 726/4
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Generating user authentication challenges based in part on preferences of one or more contacts of a user includes receiving an authentication request from a user. One or more contacts of the user associated with the authentication request are determined. One or more preferences of the close contact or contacts are determined. An authentication challenge based on the one or more preferences of one or more of the user'"'"'s contacts is generated. The authentication request is allowed or denied based on the completion on the authentication challenge.

Claims

1. A computer-implemented method for generating user authentication challenges performed by one or more computing devices, the method comprising:

receiving, at the one or more computing devices, an authentication request from a user, wherein the authentication request includes primary authentication information and secondary authentication information;

in response to receiving the authentication request, detecting, by the one or more computing devices, a potentially fraudulent authentication attempt based on one or more of the secondary authentication information and a failed authentication attempt, wherein the failed authentication attempt is detected based on analyzing the primary authentication information;

responsive to detecting the potentially fraudulent authentication attempt, identifying, by the one or more computing devices, one or more close contacts of an account owner using one or more factors;

determining, by the one or more computing devices, one or more preferences of the one or more close contacts;

generating, by the one or more computing devices, one or more authentication challenges based at least in part on at least one of the one or more preferences;

sending, by the one or more computing devices, the one or more authentication challenges to the user;

receiving, by the one or more computing devices, a response to the one or more authentication challenges from the user; and

assessing, by the one or more computing devices, completion of the one or more authentication challenges based on the response from the user.

2. The computer-implemented method of claim 1, wherein the primary authentication information is user identifier information.

3. The computer-implemented method of claim 1, wherein the primary authentication information comprises one or more of a user name, a password, a user alias, a retina scan of the user, a fingerprint swipe of the user and an electronic identifier.

4. The computer-implemented method of claim 1, wherein the secondary authentication information comprises one or more of an IP address of a computer from which the authentication request is coming;

a device identification number of a device being used by the user;

a location of the device from which the authentication request is coming; and

browser cookies.

5. The computer-implemented method of claim 1, wherein the one or more factors used to identify whether a contact is the one or more close contacts include one or more of a frequency of interaction between the account owner and the contact;

how recently the contact and the account owner interacted;

a type of commonality between the account owner and the contact;

a number of commonalities between the account owner and the contact;

a duration of contact between the account owner and the contact;

the contact'"'"'s affiliation with the account owner; and

whether the contact is explicitly identified by the account owner as one or more of the account owner'"'"'s close contacts.

6. The computer-implemented method of claim 1, wherein one or more of the preferences are determined explicitly from data of the one or more close contacts.

7. The computer-implemented method of claim 1, wherein one or more of the preferences are determined implicitly from data of the one or more close contacts.

8. The computer-implemented method of claim 1, wherein one or more of the preferences are determined inferentially from data of the one or more close contacts.

9. The computer-implemented method of claim 1, wherein one or more of the preferences are determined based on data collected from one or more of the close contacts playing an online game.

10. The computer-implemented method of claim 1, wherein the failed authentication attempt is detected based on receiving an incorrect password of the account owner.

11. A system for generating user authentication challenges, the system comprising:

one or more processors and a memory,

an authentication receiver, stored in the memory and executable by at least one of the one or more processors, that receives an authentication request from a user, wherein the authentication request includes primary authentication information and secondary authentication information, the authentication receiver communicatively coupled to the user;

a fraudulent authentication detection engine, stored in the memory and executable by at least one of the one or more processors, that receives the authentication request from the authentication receiver and for detecting a potentially fraudulent authentication attempt based on one or more of the secondary authentication information and a failed authentication attempt, wherein the failed authentication attempt is detected based on analyzing the primary authentication information and wherein the fraudulent authentication detection engine is communicatively coupled to the authentication receiver;

a close contact identifier engine, stored in the memory and executable by at least one of the one or more processors, that identifies one or more close contacts of an account owner using one or more factors responsive to the fraudulent authentication detection engine detecting the potentially fraudulent authentication attempt, the close contact identifier engine communicatively coupled to the fraudulent authentication detection engine;

a contact preference engine, stored in the memory and executable by at least one of the one or more processors, that receives the one or more close contacts and for determining one or more preferences of the one or more close contacts, the contact preference engine communicatively coupled to the close contact identifier engine;

a challenge generation engine, stored the memory and executable by at least one of the one or more computing processors, that generates one or more authentication challenges based on the one or more preferences and for sending the one or more authentication challenges to the user, the challenge generation engine communicatively coupled to the contact preference engine and the user; and

a challenge assessment engine, stored the memory and executable by at least one of the one or more computing processors, that receives a response to the one or more authentication challenges from the user and for assessing completion of the one or more authentication challenges based on the response from the user, the challenge assessment engine communicatively coupled to the user.

12. The system of claim 11, wherein the primary authentication information is user identifier information.

13. The system of claim 11, wherein the primary authentication information comprises one or more of a user name, a password, a user alias, a retina scan of the user, a fingerprint swipe of the user and an electronic identifier.

14. The system of claim 11, wherein the secondary authentication information comprises one or more of an IP address of a computer from which the authentication request is coming;

a device identification number of a device being used by the user;

a location of the device from which the authentication request is coming; and

browser cookies.

15. The system of claim 11, wherein the one or more factors used by the close contact identifier engine to identify whether a contact is the one or more close contacts include one or more of a frequency of interaction between the account owner and the contact;

how recently the contact and the account owner have interacted;

a type of commonality between the account owner and the contact;

a number of commonalities between the account owner and the contact;

a duration of contact between the account owner and the contact;

the contact'"'"'s affiliation with the account owner; and

whether the contact is explicitly identified by the account owner as one or more of the account owner'"'"'s close contacts.

16. The system of claim 11, wherein one or more of the preferences are determined explicitly from data of the one or more close contacts.

17. The system of claim 11, wherein one or more of the preferences are determined implicitly from data of the one or more close contacts.

18. The system of claim 11, wherein the one or more preferences are determined inferentially from data of the one or more close contacts.

19. The system of claim 11, wherein the one or more preferences are determined based on data collected from one or more of the close contacts playing an online game.

20. The system of claim 11, wherein the failed authentication attempt is detected based on receiving an incorrect password of the account owner.

21. A computer program product comprising a non-transitory computer usable storage medium including a computer readable program, the computer readable program when executed on a computer causes the computer to perform steps comprising:

receiving an authentication request from a user, wherein the authentication request includes primary authentication information and secondary authentication information;

in response to receiving the authentication request, detecting a potentially fraudulent authentication attempt based on one or more of the secondary authentication information and a failed authentication attempt, wherein the failed authentication attempt is detected based on analyzing the primary authentication information;

responsive to detecting the potentially fraudulent authentication attempt, identifying one or more close contacts of an account owner using one or more factors;

determining one or more preferences of the one or more close contacts;

generating one or more authentication challenges based at least in part on at least one of the one or more preferences;

sending the one or more authentication challenges to the user;

receiving a response to the one or more authentication challenges from the user; and

assessing completion of the one or more authentication challenges based on the response from the user.

22. The computer program product of claim 21, wherein the primary authentication information is user identifier information.

23. The computer program product of claim 21, wherein the primary authentication information comprises one or more of a user name, a password, a user alias, a retina scan of the user, a fingerprint swipe of the user and an electronic identifier.

24. The computer program product of claim 21, wherein the secondary authentication information comprises one or more of an IP address of a device from which the authentication request is coming;

a device identification number of the device being used by the user;

a location of the device from which the authentication request is coming; and

browser cookies.

25. The computer program product of claim 21, wherein the one or more factors used to identify whether a contact is the one or more close contacts include one or more of a frequency of interaction between the account owner and the contact;

how recently the contact and the account owner interacted;

a type of commonality between the account owner and the contact;

a number of commonalities between the account owner and the contact;

a duration of contact between the account owner and the contact;

the contact'"'"'s affiliation with the account owner; and

whether the contact is explicitly identified by the account owner as one or more of the account owner'"'"'s close contacts.

26. The computer program product of claim 21, wherein one or more of the preferences are determined explicitly from data of the one or more close contacts.

27. The computer program product of claim 21, wherein one or more of the preferences are determined implicitly from data of the one or more close contacts.

28. The computer program product of claim 21, wherein one or more of the preferences are determined inferentially from data of the one or more close contacts.

29. The computer program product of claim 21, wherein the one or more preferences are determined based on data collected from one or more of the close contacts playing an online game.

30. The computer program product of claim 21, wherein the failed authentication attempt is detected based on receiving an incorrect password of the account owner.