Protection from unfamiliar login locations

• US 9,749,313 B2
• Filed: 09/30/2015
• Issued: 08/29/2017
• Est. Priority Date: 05/27/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Steeves, David, Abrams, Luke, Dangayach, Hersh, Fleischman, Eric, Raju, Prabu, Vitaldevara, Krishna, Shekar, Niyantha, Baral, Payoj, Ramaswamy, Meenakshi, Wong, Winfred, Rouskov, Yordan, Manne, Ramesh
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US14/871,945
• Publication Number:
  US 20160021095A1
• Time in Patent Office: 699 Days
• Field of Search: 726 7
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 2101/69 using geographic information, e.g. room number
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

In one embodiment, a user authentication server may use geo-location tracking to determine whether to present an enhanced identity challenge. A communication interface 180 may receive a user login attempt by a user and a current location of the user login attempt. A data storage 150 may store a user location profile of the user. A processor 120 may execute a comparison of the current location to the user location profile. The communication interface 180 may present the user with an enhanced identity challenge before allowing user access based on the comparison.

Claims

1. A user authentication server, comprising:

a communication interface configured to receive a user login attempt by a user and a current geo-location of the user login attempt;

a data storage configured to store a user location profile of the user identifying a familiar location based on a login location history describing a location for a verified user login attempt within an aging period, wherein the familiar location is decertified from the user location profile upon an expiration of the aging period; and

a processor device configured to execute a comparison of the current geo-location of the user login attempt to the familiar location of the user location profile, presenting the enhanced identity challenge for answering by the user before allowing user access when the current geo-location is outside the familiar location, and otherwise not sending the enhanced identity challenge within the familiar location.

2. The user authentication server of claim 1, wherein the data storage is configured to store the current geo-location as a familiar location upon successful response to the enhanced identity challenge.

3. The user authentication server of claim 1, wherein the data storage is configured to track in the user location profile a previous location of the user.

4. The user authentication server of claim 1, wherein the processor is configured to determining whether an immediately previous location is within traveling distance of the current geo-location and to select a challenge level for the enhanced identity challenge based on whether the current geo-location is within traveling distance.

5. The user authentication server of claim 1, wherein the communication interface is configured to send the user a high difficulty identity challenge as an enhanced identity challenge if the current geo-location is not within traveling distance.

6. The user authentication server of claim 1, wherein the communication interface is configured to send a short messaging system code to a mobile telephone associated with the user.

7. The user authentication server of claim 1, wherein the data storage is configured to mark a user account as a compromised account upon a failed response to the enhanced identity challenge.

8. The user authentication server of claim 1, wherein the communication interface is configured to collect a low difficulty identity challenge response and a high difficulty identity challenge response.

9. The user authentication server of claim 1, wherein the processor is configured to determine a home region based on the login location history.

10. The user authentication server of claim 1, wherein the processor is configured to resize the home region based on at least one of user activity and system configuration.

11. The user authentication server of claim 1, wherein the processor is configured to present the user with the enhanced identity challenge when an unfamiliar login location counter exceeds an unfamiliar login location threshold.

12. The user authentication server of claim 1, further comprising:

an unfamiliar login location counter configured to decrement upon successful response to the enhanced identity challenge.

13. A computing device being configured to:

store in a memory a user location profile of a user identifying a familiar location based on a login location history describing a location for a verified user login attempt within an aging period, wherein the familiar location is decertified from the user location profile upon an expiration of the aging period,

recognize a current geo-location of a user login attempt to a user service,

execute a comparison of the current geo-location to the familiar location of the user location profile,

present a user with an enhanced identity challenge for answering by the user before allowing user access when the current Cleo-location is outside the familiar location, and

otherwise not present the enhanced identity challenge within the familiar location.

14. The computing device of claim 13, wherein the computing device is further configured to mark a user account as a compromised account upon a failed response to the enhanced identity challenge.

15. The computing device of claim 13, wherein the computing device is further configured to clear a familiar location list of a compromised account.

16. The computing device of claim 13, wherein the computing device is further configured to factor whether the user login attempt is from a trusted device into a determination to present the enhanced identity challenge.

17. The computing device of claim 13, wherein the computing device is further configured to select a challenge level for the enhanced identity challenge based on whether the current geo-location is a fraud hotspot.

18. A machine-implemented method for authenticating a user session, comprising:

storing in a memory a user location profile of a user identifying a familiar location describing a location for a verified user login attempt within an aging period, wherein the familiar location is decertified from the user location profile upon an expiration of the aging period;

recognizing a current geo-location of a user login attempt to a user service over a communication interface;

using at least one hardware processor to implement;

executing a comparison of the current geo-location to the familiar location of the user location profile;

presenting a user with an enhanced identity challenge for answering by the user before allowing user access when the current geo-location is outside the familiar location; and

otherwise not presenting the enhanced identity challenge within the familiar location.

19. The method of claim 18, further comprising:

marking a user account as a compromised account upon a failed response to the enhanced identity challenge.

20. A machine-implemented method for authenticating a user session, comprising:

creating a user location profile associated with a user account indicating a familiar location based on a login location history, wherein the familiar location is decertified from the user location profile upon an expiration of an aging period;

executing a comparison of a current geo-location of a user login attempt to the familiar location of the user location profile;

presenting a user with an enhanced identity challenge for answering by the user before allowing user access when the current geo-location is outside the familiar location;

otherwise not sending the enhanced identity challenge within the familiar location; and

updating the user location profile to designate the current geo-location as a new familiar location after a successful login attempt.

21. The method of claim 20, further comprising:

marking a user account as a compromised account upon a failed response to the identity challenge.

22. The method of claim 20, further comprising:

clearing a familiar location list of the compromised account.

23. The method of claim 20, further comprising:

factoring whether the user login attempt is from a trusted device into a determination of the challenge level for the enhanced identity challenge.

24. The method of claim 20, further comprising:

selecting the challenge level for the enhanced identity challenge based on whether the current geo-location is a fraud hotspot.