Just in time polymorphic authentication

• US 9,619,643 B2
• Filed: 05/18/2016
• Issued: 04/11/2017
• Est. Priority Date: 08/27/2014
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Dave, Apeksh M., Jamma, Vijayanand, Doriaraj, Vivekanand
• Primary Examiner(s): Zee, Edward
• Application Number:
  US15/157,506
• Publication Number:
  US 20160259931A1
• Time in Patent Office: 328 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time

Abstract

Methods, systems, apparatuses, and computer-readable media for utilizing just-in-time polymorphic authentication techniques to secure information are presented. In one or more embodiments, a computing platform may receive, from a computing device, a request to access a user account. In response to receiving the request to access the user account, the computing platform may dynamically select, based on one or more polymorphic authentication factors, an authentication method for authenticating a user of the computing device, and the authentication method may be selected from a plurality of predefined authentication methods. Subsequently, the computing platform may generate one or more authentication prompts based on the selected authentication method. The computing platform then may provide the one or more authentication prompts to the user of the computing device. The authentication prompts that are selected for and presented to a particular user during a given access attempt may vary across different attempts.

Claims

1. A method, comprising:

at a computing platform comprising at least one processor, memory, and a communication interface;

receiving, by the at least one processor, via the communication interface, and from a first computing device, a request to access a first user account associated with a customer portal provided by the computing platform, the customer portal comprising at least one online banking user interface configured to present information associated with one or more bank accounts maintained by a financial institution for a user associated with the first user account;

in response to receiving the request to access the first user account, dynamically selecting, by the at least one processor, based on one or more polymorphic authentication factors, a first authentication method for authenticating a user of the first computing device to the first user account associated with the customer portal, the first authentication method being selected from a plurality of predefined authentication methods comprising a stringent authentication method and a baseline authentication method;

generating, by the at least one processor, one or more authentication prompts based on the first authentication method selected for authenticating the user of the first computing device to the first user account associated with the customer portal; and

providing, by the at least one processor, the one or more authentication prompts to the user of the first computing device,

wherein the one or more polymorphic authentication factors comprise one or more external risk factors,

wherein the customer portal provided by the computing platform is associated with an online banking channel, and

wherein dynamically selecting the first authentication method for authenticating the user of the first computing device to the first user account associated with the customer portal comprises selecting the stringent authentication method for authenticating the user of the first computing device to the first user account associated with the customer portal based on at least one external risk factor of the one or more external risk factors indicating that an attack has been attempted on another channel different from the online banking channel.

2. The method of claim 1, wherein the one or more polymorphic authentication factors comprise one or more time-based factors.

3. The method of claim 1, wherein the one or more polymorphic authentication factors comprise one or more counter-based factors.

4. The method of claim 1, wherein the one or more polymorphic authentication factors comprise one or more geographic factors.

5. The method of claim 1, wherein the one or more polymorphic authentication factors comprise one or more event-based factors.

6. The method of claim 1, wherein the one or more polymorphic authentication factors comprise one or more user-specific factors.

7. The method of claim 1, wherein providing the one or more authentication prompts to the user of the first computing device comprises:

generating at least one user interface configured to receive one or more authentication credentials; and

causing the at least one user interface to be presented by the first computing device.

8. The method of claim 1, wherein providing the one or more authentication prompts to the user of the first computing device comprises requesting the user of the first computing device to provide password input.

9. The method of claim 1, wherein providing the one or more authentication prompts to the user of the first computing device comprises requesting the user of the first computing device to provide one-time passcode input.

10. The method of claim 1, wherein providing the one or more authentication prompts to the user of the first computing device comprises requesting the user of the first computing device to provide biometric input.

11. The method of claim 1, wherein providing the one or more authentication prompts to the user of the first computing device comprises causing at least two authentication prompts to be presented to the user of the first computing device in a specific order determined based on the one or more polymorphic authentication factors.

12. The method of claim 1, comprising:

receiving, by the at least one processor, via the communication interface, and from a second computing device different from the first computing device, a request to access a second user account associated with the customer portal provided by the computing platform, the second user account being different from the first user account;

in response to receiving the request to access the second user account, dynamically selecting, by the at least one processor, based on the one or more polymorphic authentication factors, a second authentication method for authenticating a user of the second computing device to the second user account associated with the customer portal, the second authentication method being selected from the plurality of predefined authentication methods;

generating, by the at least one processor, one or more second authentication prompts based on the second authentication method selected for authenticating the user of the second computing device to the second user account associated with the customer portal; and

providing, by the at least one processor, the one or more second authentication prompts to the user of the second computing device.

13. The method of claim 12, wherein the second authentication method for authenticating the user of the second computing device to the second user account associated with the customer portal is different from the first authentication method for authenticating the user of the first computing device to the first user account associated with the customer portal.

14. The method of claim 13, wherein providing the one or more second authentication prompts to the user of the second computing device comprises providing at least one authentication prompt to the user of the second computing device that was not provided to the user of the first computing device.

15. A system, comprising:

at least one processor;

a communication interface communicatively coupled to the at least one processor; and

memory storing computer-readable instructions that, when executed by the at least one processor, cause the system to;

receive, via the communication interface, and from a first computing device, a request to access a first user account associated with a customer portal provided by the system, the customer portal comprising at least one online banking user interface configured to present information associated with one or more bank accounts maintained by a financial institution for a user associated with the first user account;

in response to receiving the request to access the first user account, dynamically select, based on one or more polymorphic authentication factors, a first authentication method for authenticating a user of the first computing device to the first user account associated with the customer portal, the first authentication method being selected from a plurality of predefined authentication methods comprising a stringent authentication method and a baseline authentication method;

generate one or more authentication prompts based on the first authentication method selected for authenticating the user of the first computing device to the first user account associated with the customer portal; and

provide the one or more authentication prompts to the user of the first computing device,

wherein the one or more polymorphic authentication factors comprise one or more external risk factors,

wherein the customer portal provided by the system is associated with an online banking channel, and

wherein dynamically selecting the first authentication method for authenticating the user of the first computing device to the first user account associated with the customer portal comprises selecting the stringent authentication method for authenticating the user of the first computing device to the first user account associated with the customer portal based on at least one external risk factor of the one or more external risk factors indicating that an attack has been attempted on another channel different from the online banking channel.

16. The system of claim 15, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the system to:

receive, via the communication interface, and from a second computing device different from the first computing device, a request to access a second user account associated with the customer portal provided by the system, the second user account being different from the first user account;

in response to receiving the request to access the second user account, dynamically select, based on the one or more polymorphic authentication factors, a second authentication method for authenticating a user of the second computing device to the second user account associated with the customer portal, the second authentication method being selected from the plurality of predefined authentication methods;

generate one or more second authentication prompts based on the second authentication method selected for authenticating the user of the second computing device to the second user account associated with the customer portal; and

provide the one or more second authentication prompts to the user of the second computing device.

17. The system of claim 15, wherein providing the one or more authentication prompts to the user of the first computing device comprises causing at least two authentication prompts to be presented to the user of the first computing device in a specific order determined based on the one or more polymorphic authentication factors.

18. The system of claim 16, wherein the second authentication method for authenticating the user of the second computing device to the second user account associated with the customer portal is different from the first authentication method for authenticating the user of the first computing device to the first user account associated with the customer portal.

19. The system of claim 18, wherein providing the one or more second authentication prompts to the user of the second computing device comprises providing at least one authentication prompt to the user of the second computing device that was not provided to the user of the first computing device.

20. One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, memory, and a communication interface, cause the computing platform to:

receive, via the communication interface, and from a first computing device, a request to access a first user account associated with a customer portal provided by the computing platform, the customer portal comprising at least one online banking user interface configured to present information associated with one or more bank accounts maintained by a financial institution for a user associated with the first user account;

in response to receiving the request to access the first user account, dynamically select, based on one or more polymorphic authentication factors, a first authentication method for authenticating a user of the first computing device to the first user account associated with the customer portal, the first authentication method being selected from a plurality of predefined authentication methods comprising a stringent authentication method and a baseline authentication method;

generate one or more authentication prompts based on the first authentication method selected for authenticating the user of the first computing device to the first user account associated with the customer portal; and

provide the one or more authentication prompts to the user of the first computing device,

wherein the one or more polymorphic authentication factors comprise one or more external risk factors,

wherein the customer portal provided by the computing platform is associated with an online banking channel, and

wherein dynamically selecting the first authentication method for authenticating the user of the first computing device to the first user account associated with the customer portal comprises selecting the stringent authentication method for authenticating the user of the first computing device to the first user account associated with the customer portal based on at least one external risk factor of the one or more external risk factors indicating that an attack has been attempted on another channel different from the online banking channel.