Determining user authentication requirements based on the current location of the user in comparison to the users's normal boundary of location

• US 9,208,301 B2
• Filed: 02/07/2014
• Issued: 12/08/2015
• Est. Priority Date: 02/07/2014
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Grigg, David M., Bertanzetti, Peter John, Burrell, Charles Jason, Hanson, Carrie Anne, Johansen, Joseph Neil, Toth, Michael E.
• Primary Examiner(s): Lemma, Samson
• Assistant Examiner(s): KANAAN, SIMON P
• Application Number:
  US14/175,643
• Publication Number:
  US 20150227727A1
• Time in Patent Office: 669 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/68 Gesture-dependent or behaviour-dependent

Abstract

Systems, apparatus, methods, and computer program products are provided for determining a user'"'"'s authentication requirements/credentials for a specific network access session based on the current location of the user in comparison to known boundaries of location associated with the user, such as the user'"'"'s residence, place of business or the like. As such, the present invention serves to expedite the process for authenticating a user who desires to gain access to a network service, such as a banking application or the like.

Claims

1. An apparatus for determining user authentication requirements for accessing a network service, the apparatus comprising:

a computing platform including a memory and a processor in communication with the memory; and

an authentication requirements module stored in the memory, executable by the processor and configured to,

receive, from a mobile communication device, a request for a user to access a network service, accessible via an executable application stored on the mobile communication device, that requires user authentication,

in response to receiving the request, determine a current physical location of the user and a time associated with the request,

determine a distance from the current physical location to one of a plurality of predetermined physical locations, wherein the predetermined physical locations include (1) user-defined physical locations, and (2) determined physical locations that are determined based on monitoring, over time, location of the user in relation to the mobile communication device, and

determine user authentication requirements for the user to access the network service based on (1) the determined distance of the current physical location of the user to the predetermined physical location, and (2) the time associated with the request being one of inside or outside of a predetermined period of time associated with the predetermined physical location,

wherein the user is provided access to the network service in response to the user meeting the determined user authentication requirements.

2. The apparatus of claim 1, wherein the authentication requirements module is further configured to determine minimal authentication requirements for the user to access the network service based on (1) the determined distance of the current physical location of the user to the predetermined physical location being within a predetermined distance threshold, and (2) the time associated with the request being within the predetermined period of time associated with the predetermined physical location, wherein the user is provided access to less than full functionality within the network service upon meeting the minimal authentication requirements.

3. The apparatus of claim 1, further comprising a service access module stored in the memory, executable by the processor and configured to determine a level of access that is provided to the user upon meeting the determined authentication requirements, wherein the level of access defines functionality, within the network service, accessible to the user upon meeting the determined authentication requirements.

4. The apparatus of claim 3, wherein the service access module is further configured to determine the level of access based on (1) the determined distance of the current physical location of the user to the predetermined physical location, and (2) the time associated with the request being one of inside or outside of a predetermined period of time associated with the predetermined physical location.

5. The apparatus of claim 4, wherein the service access module is further configured to determine the level of access based on (1) the determined distance of the current physical location of the user to the predetermined physical locations, and (2) the time associated with the request being one of inside or outside of a predetermined period of time associated with the predetermined physical location, wherein the level of access determination is independent of the determination of the authentication requirements.

6. The apparatus of claim 1, wherein the authentication requirements module is further configured to determine a level of authentication required for the user to access the network service based on (1) the determined distance of the current physical location of the user to the predetermined physical location, and (2) the time associated with the request being one of inside or outside of a predetermined period of time associated with the predetermined physical location, wherein the level of authentication is from amongst a plurality of levels of authentication.

7. The apparatus of claim 6, wherein the authentication requirements module is further configured to determine the level of authentication required to access the network service based on (1) the determined distance of the current physical location of the user to the predetermined physical locations, and (2) the time associated with the request being one of inside or outside of a predetermined period of time associated with the predetermined physical location, wherein the levels of authentication are defined by predetermined distance thresholds from the predetermined physical locations.

8. The apparatus of claim 1, wherein the authentication requirements module is further configured to determine a point along an authentication continuum based on (1) the determined proximity in distance of the current physical location of the user to the predetermined physical location, and (2) the time associated with the request being one of inside or outside of a predetermined period of time associated with the predetermined physical location, wherein the point along the continuum is associated with predetermined authentication requirements.

9. The apparatus of claim 1, wherein the authentication requirements module is further configured to determine that the current location is located within a predetermined first zone of authentication, wherein the predetermined first zone of authentication is one of a residence of the user or a place of business of the user and determine the authentication requirements for the first zone as less than full authentication required by the user to access the network service.

10. The apparatus of claim 9, wherein the authentication requirements module is further configured to determine that the current location is located within a predetermined second zone of authentication, wherein the predetermined second zone of authentication is one of a residence of an individual associated with the user or a place of business frequented by the user and determine the authentication requirements for the second zone as more than the authentication requirements associated with the first zone.

11. A method for determining user authentication requirements, the method comprising:

receiving, from a mobile communication device, a request for a user to access a network service, accessible via an executable application stored on the mobile communication device, that requires user authentication;

in response to receiving the request, determining, by a computing device processor, a current physical location of the user and a time associated with the request;

determining, by a computing device processor, a distance of the current physical location to one of a plurality of predetermined physical locations wherein the predetermined physical locations include (1) user-defined physical locations, and (2) determined physical locations that are determined based on monitoring, over time, location of the user in relation to the mobile communication device; and

determining, by a computing device processor, user authentication requirements for the user to access the network service based on (1) the determined distance of the current physical location of the user to the predetermined physical location, and (2) the time associated with the request being one of inside or outside of a predetermined period of time associated with the predetermined physical location,

wherein the user is provided access to the network service in response to the user meeting the determined user authentication requirements.

12. The method of claim 11, wherein determining the authentication requirements further comprises determining minimal authentication requirements for the user to access the network service based on (1) the determined distance of the current physical location of the user to the predetermined physical location being within a predetermined distance threshold, and (2) the time associated with the request being within the predetermined period of time associated with the predetermined physical location, wherein the user is provided access to less than full functionality within the network service upon meeting the minimal authentication requirements.

13. The method of claim 11, further comprising determining, by a computing device processor, a level of access that is provided to the user upon meeting the determined authentication requirements, wherein the level of access defines functionality, within the network service, accessible to the user upon meeting the determined authentication requirements.

14. The method of claim 13, wherein determining the level of access further comprises determining the level of access based on (1) the determined distance of the current physical location of the user to the predetermined physical location, and (2) the time associated with the request being one of inside or outside of a predetermined period of time associated with the predetermined physical location.

15. The method of claim 14, wherein determining the level of access further comprises determining the level of access based on (1) the determined distance of the current physical location of the user to the predetermined physical locations and (2) the time associated with the request, wherein the level of access determination is independent of the determination of the authentication requirements.

16. The method of claim 11, wherein determining the authentication requirements further comprises determining, by the computing device processor, a level of authentication required for the user to access the network service based on (1) the determined distance of the current physical location of the user to the predetermined physical location, and (2) the time associated with the request being one of inside or outside of a predetermined period of time associated with the predetermined physical location, wherein the level of authentication is from amongst a plurality of levels of authentication.

17. The method of claim 16, wherein determining the level of authentication further comprises determining, by a computing device processor, the level of authentication required to access the network service based on (1) the determined distance of the current physical location of the user to the predetermined physical locations, and (2) the time associated with the request being one of inside or outside of a predetermined period of time associated with the predetermined physical location, wherein the levels of authentication are defined by predetermined distance thresholds from the predetermined physical locations.

18. The method of claim 11, wherein determining the authentication requirements further comprises determining, by the computing device processor, a point along an authentication continuum based on (1) the determined proximity in distance of the current physical location of the user to the predetermined physical location, and (2) the time associated with the request being one of inside or outside of a predetermined period of time associated with the predetermined physical location, wherein the point along the continuum is associated with predetermined authentication requirements.

19. The method of claim 11, wherein determining proximity in distance of the current physical location to the predetermined physical location further comprises determining, by the computing device processor, that the current location is located within a predetermined first zone of authentication, wherein the predetermined first zone of authentication is one of a residence of the user or a place of business of the user and wherein determining the authentication requirements further comprises determining the authentication requirements as less than full authentication required by the user to access the network service.

20. The method of claim 19, wherein determining proximity in distance of the current physical location to one of at least one predetermined physical locations further comprises determining, by the computing device processor, that the current location is located within a predetermined second zone of authentication, wherein the predetermined second zone of authentication is one of a residence of an individual associated with the user or a place of business frequented by the user and wherein determining the authentication requirements further comprises determining the authentication requirements as more than the authentication requirements associated with the first zone.

21. A computer program product comprising:

a non-transitory computer-readable medium comprising;

a first set of codes for causing a computer to receive from a mobile communication device, a request for a user to access a network service, accessible via an executable application stored on the mobile communication device, that requires user authentication;

a second set of codes for causing a computer to, in response to receiving the request, determine a current physical location of the user and a time associated with the request;

a third set of codes for causing a computer to determine a distance of the current physical location to one of a plurality of predetermined physical locations, wherein the predetermined physical locations include (1) user-defined physical locations and (2) determined physical locations that are determined based on monitoring, over time, location of the user in relation to the mobile communication device; and

a fourth set of codes for causing a computer to determine user authentication requirements for the user to access the network service based on (1) the determined distance of the current physical location of the user to the predetermined physical location, and (2) the time associated with the request being one of inside or outside of a predetermined period of time associated with the predetermined physical location,

wherein the user is provided access to the network service in response to the user meeting the determined user authentication requirements.

22. The computer program product of claim 21, wherein the third set of codes is further configured to cause the computer to determine minimal authentication requirements for the user to access the network service based on (1) the determined distance of the current physical location of the user to the predetermined physical location being within a predetermined distance threshold, and (2) the time associated with the request being within the predetermined period of time associated with the predetermined physical location, wherein the user is provided access to less than full functionality within the network service upon meeting the minimal authentication requirements.

23. The computer program product of claim 21, further comprising a fifth set of codes for causing a computer to determine a level of access that is provided to the user upon meeting the determined authentication requirements, wherein the level of access defines functionality, within the network service, accessible to the user upon meeting the determined authentication requirements.

24. The computer program product of claim 21, wherein the third set of codes is further configured to cause the computer to determine a level of authentication required for the user to access the network service based on (1) the determined proximity in distance of the current physical location of the user to the predetermined physical location, and (2) the time associated with the request being one of inside or outside of a predetermined period of time associated with the predetermined physical location, wherein the level of authentication is from amongst a plurality of levels of authentication.

25. The computer program product of claim 21, wherein the third set of codes is further configured to cause the computer to determine a point along an authentication continuum based on (1) the determined distance of the current physical location of the user to the predetermined physical location, and (2) the time associated with the request being one of inside or outside of a predetermined period of time associated with the predetermined physical location, wherein the point along the continuum is associated with predetermined authentication requirements.