FIELD OF THE INVENTION

The present invention is related to computer software and hardware and more specifically to computer software and hardware for authentication of users.

BACKGROUND OF THE INVENTION

Current methods of authenticating users are suboptimal. What is needed is a system and method for improved authentication of users.

SUMMARY OF INVENTION

A system and method receives any or all of: different weights, and/or different formulas for computing an authentication score and/or different thresholds for identifying whether a user is considered to be authenticated, for each of several features or types of features that can be provided to users. The weights, formulas or thresholds may be provided for each combination of a) feature or feature type and b) each of several types of devices. The weights, formulas or thresholds may be provided for all features or feature types, and optionally devices. For example, a different set of weights may be assigned to each feature or feature type and a single threshold may be used for all feature types, or vice versa.

When the user requests a feature, the component scores from one or more methods of authenticating a user, some or all of which are not considered to be strong authentication methods, will be multiplied by the weights for the feature or feature type corresponding to the feature, and optionally the device, to produce an authentication score; or component scores from such one or more authentication methods are applied to the formula for authenticating the user for that feature or feature type, and optionally device, or one such formula or set of weights is applied for all features or all features and all devices. The threshold or different thresholds for the feature or type of feature requested, and optionally the device, or for all features, is used to identify whether the feature should be provided to the user. If the authentication score exceeds the threshold, the feature is provided to the user and otherwise, the feature may not be provided to the user. If types of features are used, an assignment of each feature to its type is also received.

When the user requests a feature, for example, a feature of a website, in one embodiment, an authentication score is computed for the user at first using passive methods of authentication, those that do not require the user to do anything for the sole purpose of authenticating that user. Each of one or more passive techniques of authentication is assigned a component score based on how well the passive indications corresponding to the technique indicate that the user is who he or she appears to be. For example, if the user is using a computer system that was used by that user to authenticate himself or herself previously at least to the threshold score corresponding to the feature requested, a computer system fingerprinting score based on the similarity of components of the computer system with those previously recorded for that user when the user was authenticated to at least a threshold level for the feature requested will be higher than the component score that results if the user had not used a computer system with the same components to so authenticate himself or herself recently, and that component score will be higher than if the user has never used the computer before. Each of one or more component scores from one or more passive authentication techniques is used to produce the authentication score, either by multiplying the component score or scores by the applicable weight for the feature or feature type, and optionally the device, or by using the component score or scores in the applicable formula for the feature or feature type, and optionally the device and comparing it to the applicable threshold.

If the authentication score meets or exceeds the applicable threshold, the feature is provided to the user. Otherwise, active methods of authentication are requested from the user, such as the user speaking a phrase, returning a series of characters provided via a communication method different from the one over which the characters were provided, or using other conventional methods of active authentication, those which the user is requested to take an action for the primary purpose of authenticating the user. In one embodiment, various methods of active authentication may be available to authenticate a user, and one or more such methods are selected so that when the authentication score is recomputed including both the passive and active authentication score components, weighted and summed according to the applicable weights for the feature or feature type, or used to compute the authentication score using the applicable formula for the feature or feature type, the user's authentication score can, or is expected to, exceed the threshold.

In one embodiment, the available active authentication techniques are selected using an inconvenience score assigned to each technique that estimates the inconvenience to the user of authenticating himself or herself using that method of authentication, so as to minimize the inconvenience to the user. In one embodiment, a possible or an estimated score component for each active authentication technique is used, either instead of, or in addition to, the inconvenience score, to select the one or more methods of active authentication to request from the user. A possible score is the highest score or a percentage of the highest score reasonably expected if the authentication technique succeeds at least at a moderately high level. Such estimated scores are either recent average component scores for the authentication techniques that the user has recently generated when the techniques were attempted by the user in the past. If insufficient data is available for such user, optionally on the same type of device, for a given active authentication technique, the average component score achieved by the use of the technique for all users, optionally on the same type of device, may be used instead. The selection of the active authentication technique is performed by selecting the active authentication techniques that are estimated to, when weighted with the applicable weights or used in the applicable formula, cause the user's total authentication score from all forms of authentication to exceed the threshold applicable to the requested feature, optionally while minimizing the total inconvenience to the user. In one embodiment, multiple forms of active authentication produce an inconvenience score that is greater than the sum of the inconvenience scores for each authentication, so that fewer active authentication techniques are favored.

In one embodiment, requesting a user to provide a password has a higher inconvenience score than at least one or more other active authentication techniques, so that requesting a password may be least favored or used as a last resort.

In another embodiment, passwords are not used in computing the authentication score, only other authentication techniques are used. Such techniques may be referred to as “sinepassword” authentications. In another embodiment, binary forms of authentication, where the authentication technique has only two scores, corresponding to success or failure, are not used or not used by all authentication techniques to compute the authentication score.

