Authentication risk evaluation
A computer is configured to receive an authentication request that identifies one or more authentication form factors, and for each form factor identified, further identifies at least one parameter. The computer is further configured to generate a risk score for the authentication request using the parameter, the risk score being based at least in part on a complexity associated with each of the one or more authentication form factors. The computer is further configured to provide the risk score to a requester.
1. A system comprising:
a computer server having a processor and a memory, the server configured to:
receive an authentication request that identifies one or more authentication form factors, and for each form factor identified, further identifies at least one parameter;
generate a risk score for the authentication request using the parameter, the risk score being based at least in part on a complexity associated with each of the one or more authentication form factors and on an upper bound on a number of guesses that an attacker may make to recover a token before the attacker is locked out from additional attacks, the upper bound based on a lockout time and at least one of a token lifetime, an attempt number, or lockout strikes, the lockout time being a time period for which a lockout will apply;
provide the risk score to a requester; and
when the upper bound is based on the lockout time, token lifetime and lockout strikes, compute the upper bound by dividing a product of the token lifetime and the lockout strikes by the lockout time.
2. The system of claim 1 , the server further configured to associate the risk score with a risk level, and to provide the risk level to the requester along with the risk score.
3. The system of claim 1 , wherein the one or more authentication form factors includes at least one of one-time authentication (OTA), static knowledge-based authentication (SKBA), and user password authentication (UPA).
4. The system of claim 1 , wherein the at least one parameter includes at least one of a location identifier for a source of the authentication request, and the risk score is based at least in part on one of: a determination of geo-velocity and a history relating to the location.
5. The system of claim 1 , wherein the at least one parameter includes at least one of a number representing a number of authentication attempts that may be made before a lockout, a lockout duration, a password length, a token length, a token complexity, an answer space, an OTA pin length, an attempts rate, and a token lifetime.
6. The system of claim 1 , further comprising a computer client having a processor and a memory, the client configured to send the authentication request to the server.
7. The system of claim 1 , the server further configured to store the risk score in a data store along with an identifier or identifiers for the one or more authentication form factors and the at least one parameter.
8. A method, comprising:
receiving, in a computer having a processor and a memory, an authentication request that identifies one or more authentication form factors, and for each form factor identified, further identifies at least one parameter;
generating, in the computer, a risk score for the authentication request using the parameter, the risk score being based at least in part on a complexity associated with each of the one or more authentication form factors and on an upper bound on a number of guesses that an attacker may make to recover a token before the attacker is locked out from additional attacks, the upper bound based on a lockout time and at least one of a token lifetime, an attempt number, or lockout strikes, the lockout time being a time period for which a lockout will apply;
providing the risk score to a requester; and
when the upper bound is based on the lockout time, token lifetime and lockout strikes, compute the upper bound by dividing a product of the token lifetime and the lockout strikes by the lockout time.
9. The method of claim 8 , further comprising associating the risk score with a risk level, and providing the risk level to the requester along with the risk score.
10. The method of claim 8 , wherein the one or more authentication form factors includes at least one of one-time authentication (OTA), static knowledge-based authentication (SKBA), and user password authentication (UPA).
11. The method of claim 8 , wherein the at least one parameter includes at least one of a location identifier for a source of the authentication request, and the risk score is based at least in part on one of: a determination of geo-velocity and a history relating to the location.
12. The method of claim 8 , wherein the at least one parameter includes at least one of a number representing a number of authentication attempts that may be made before a lockout, a lockout duration, a password length, a token length, a token complexity, an answer space, an OTA pin length, an attempts rate, and a token lifetime.
13. The method of claim 8 , further comprising storing the risk score in a data store along with an identifier or identifiers for the one or more authentication form factors and the at least one parameter.
14. A non-transitory computer-readable medium tangibly embodying computer executable instructions, including instructions for:
receiving, in a computer having a processor and a memory, an authentication request that identifies one or more authentication form factors, and for each form factor identified, further identifies at least one parameter;
generating, in the computer, a risk score for the authentication request using the parameter, the risk score being based at least in part on a complexity associated with each of the one or more authentication form factors and on an upper bound on a number of guesses that an attacker may make to recover a token before the attacker is locked out from additional attacks, the upper bound based on a lockout time and at least one of a token lifetime, an attempt number, or lockout strikes, the lockout time being a time period for which a lockout will apply;
providing the risk score to a requester; and
when the upper bound is based on the lockout time, token lifetime and lockout strikes, compute the upper bound by dividing a product of the token lifetime and the lockout strikes by the lockout time.
15. The medium of claim 14 , further comprising instructions for associating the risk score with a risk level, and providing the risk level to the requester along with the risk score.
16. The medium of claim 14 , wherein the one or more authentication form factors includes at least one of one-time authentication (OTA), static knowledge-based authentication (SKBA), and user password authentication (UPA).
17. The medium of claim 14 , wherein the at least one parameter includes at least one of a location identifier for a source of the authentication request, and the risk score is based at least in part on one of: a determination of geo-velocity and a history relating to the location.
18. The medium of claim 14 , wherein the at least one parameter includes at least one of a number representing a number of authentication attempts that may be made before a lockout, a lockout duration, a password length, a token length, a token complexity, an answer space, an OTA pin length, an attempts rate, and a token lifetime.
19. The medium of claim 14 , further comprising instructions for storing the risk score in a data store along with an identifier or identifiers for the one or more authentication form factors and the at least one parameter.
20. The system of claim 1 , wherein the complexity associated with each authentication form factor is an entropy complexity.
21. The system of claim 20 , wherein the entropy complexity associated with each authentication form factor is configured to include a number of combinations of characters in a token that could be presented.
22. The system of claim 1 , wherein when the authentication request identifies multiple authentication form factors, the complexity is a combination of each complexity of each authentication form factor.