Method and system protecting against identity theft or replication abuse

1. A method, implemented by a computer-implemented authentication system, for authenticating a user attempting to access a target component of a computer system, the method comprising:

a) receiving, from a first user system via a computer network, user authentication information and a network address identifying the first user system within the computer network;

b) obtaining at least one data item of contextual information collected from a wireless communications device, the contextual information being indicative of a property of an environment of the wireless communications device associated with the user authentication information;

c) authenticating the user based on at least the user authentication information; and

d) subject to successful authentication, granting the user access to the target component and maintaining a data record indicative of a stored security context comprising the received network address and the obtained contextual information collected from the wireless communications device; wherein the method further comprises:

determining, based on one or more selection criteria, at least one recurrent security context from the maintained data record, the same recurrent security context having previously occurred a number of times, the stored security context having associated with it data about one or more previous occurrences of said stored security context, wherein a previous occurrence of said stored security context refers to a successful login attempt by the user to access the target component having been made from the received network address and the associated contextual information collected from the wireless communication device matching the stored security context, wherein the recurrent security context refers to multiple previously determined occurrences of said successful login attempts, wherein the first user system is different from the wireless communications device; and

using the determined recurrent security context in a subsequent decision whether to grant a subsequent request by said user to access the target component.

2. The method according to claim 1 , wherein the contextual information comprises one or more of a service set identifier of a wireless local network to which the wireless communications device is connected; a service set identifier of a wireless local network detected by the wireless communications device, a network address of a node of a network to which the wireless communications device is connected, geographical coordinates of a current position of the wireless communications device; or a public internet protocol address of the wireless communications device.

3. The method according to claim 1 , wherein obtaining at least one data item of contextual information comprises causing the wireless communications device to execute a software application configured to cause the wireless communications device to collect the contextual information and to forward the collected contextual information to the computer-implemented authentication system.

4. The method according to claim 1 , wherein obtaining at least one data item of contextual information comprises obtaining, from a software application executed on a server computer configured to provide a service to wireless communications devices, a network address from which the wireless communications device has previously accessed said server computer to obtain said service or other data indicative of a property of the wireless communications device or at least one property of an environment of the wireless communications device.

5. The method according to claim 1 , wherein authenticating the user comprises:

sending, via a communications network, challenge data to said wireless communications device;

receiving a one-time passcode; and

verifying the received one-time passcode.

6. The method according to claim 5 , further comprising causing the wireless communications device to compute the passcode from at least the challenge data and a secret key of the wireless communications device.

7. The method according to claim 6 , wherein verifying the received passcode comprises using the challenge data, the received passcode and a digital key stored by the computer-implemented authentication system and associated with the wireless communications device.

8. The method according to claim 5 , wherein the receiving the one-time passcode includes receiving the one-time passcode from the first user system via the computer network.

9. The method according to claim 1 , further comprising: if the received network address matches the network address of a previously determined recurrent security context, granting access to the target component without further authentication only if the obtained contextual information corresponds to the contextual information of said previously determined recurrent security context.

10. The method according to claim 1 , further comprising: if the obtained contextual information corresponds to the contextual information of a previously determined recurrent security context, and if the received network address does not match the network address of said previously determined recurrent security context, granting access to the target component only subject to an additional user authentication process.

11. The method according to claim 1 , wherein the determining is carried out after repeated successful access attempts from the received network address, and with a given recurring set of contextual information, and wherein the recurrent security context includes the received network address and the recurring contextual information which have been repeatedly associated with successful access attempts.

12. A method, implemented by a wireless communications device, for facilitating authentication of a user attempting to access a target component of a computer system, the method comprising:

receiving, from an authentication system, a request to collect contextual information indicative of a current geographical location of the wireless communication device and/or a location of the wireless communication device within a communications network environment, or data indicative of a geographical or communications network environment in which the user requests access to the target component, wherein the receiving the request includes:

receiving, from the authentication system responsive to a login session, challenge data associated with user authentication information of the user; and

computing in real-time during the login session a one-time passcode for verification by the authentication system based on at least the received challenge data and a secret key stored by the wireless communications device

causing the computed passcode to be displayed on the wireless communications device; and

executing a software application configured to cause the wireless communications device to obtain at least one data item of contextual information and to send the obtained contextual information to the authentication system.

13. The method according to claim 12 , wherein the contextual information comprises one or more of a service set identifier of a wireless local network to which the wireless communications device is connected; a service set identifier of a wireless local network detected by the wireless communications device, a network address of a node of a network to which the wireless communications device is connected, geographical coordinates of a current position of the wireless communications device; or a public internet protocol address of the wireless communications device.

14. A data processing system configured to perform a method, implemented by a computer-implemented authentication system, for authenticating a user attempting to access a target component of a computer system, the method comprising:

a) receiving, from a first user system via a computer network, user authentication information and a network address identifying the first user system within the computer network;

b) obtaining at least one data item of contextual information collected from a wireless communications device, the contextual information being indicative of a property of an environment of the wireless communications device associated with the user authentication information;

c) authenticating the user based on at least the user authentication information; and

d) subject to successful authentication, granting the user access to the target component and maintaining a data record indicative of a stored security context comprising the received network address and the obtained contextual information collected from the wireless communications device; wherein the method further comprises:

determining, based on one or more selection criteria, at least one recurrent security context from the maintained data record, the same recurrent security context having previously occurred a number of times, the stored security context having associated with it data about one or more previous occurrences of said stored security context, wherein a previous occurrence of said stored security context refers to a successful login attempt by the user to access the target component having been made from the received network address and the associated contextual information collected from the wireless communication device matching the stored security context, wherein the recurrent security context refers to multiple previously determined occurrences of said successful login attempts, wherein the first user system is different from the wireless communications device; and

using the determined recurrent security context in a subsequent decision whether to grant a subsequent request by said user to access the target component.

15. A wireless communications device configured to perform a method, implemented by a wireless communications device, for facilitating authentication of a user attempting to access a target component of a computer system, the method comprising:

receiving, from an authentication system, a request to collect contextual information indicative of a current geographical location of the wireless communication device and/or a location of the wireless communication device within a communications network environment, or data indicative of a geographical or communications network environment in which the user requests access to the target component, wherein the receiving the request includes:

receiving, from the authentication system responsive to a login session, challenge data associated with user authentication information of the user; and

computing in real-time during the login session a one-time passcode for verification by the authentication system based on at least the received challenge data and a secret key stored by the wireless communications device

causing the computed passcode to be displayed on the wireless communications device; and

executing a software application configured to cause the wireless communications device to obtain at least one data item of contextual information and to send the obtained contextual information to the authentication system.

16. A computer program product comprising computer program code adapted to cause a data processing system to perform a method, implemented by a computer-implemented authentication system, for authenticating a user attempting to access a target component of a computer system, when said computer program code is executed on said data processing system, the method comprising:

a) receiving, from a first user system via a computer network, user authentication information and a network address identifying the first user system within the computer network;

b) obtaining at least one data item of contextual information collected from a wireless communications device, the contextual information being indicative of a property of an environment of the wireless communications device associated with the user authentication information;

c) authenticating the user based on at least the user authentication information; and

d) subject to successful authentication, granting the user access to the target component and maintaining a data record indicative of a stored security context comprising the received network address and the obtained contextual information collected from the wireless communications device; wherein the method further comprises:

determining, based on one or more selection criteria, at least one recurrent security context from the maintained data record, the same recurrent security context having previously occurred a number of times, the stored security context having associated with it data about one or more previous occurrences of said stored security context, wherein a previous occurrence of said stored security context refers to a successful login attempt by the user to access the target component having been made from the received network address and the associated contextual information collected from the wireless communication device matching the stored security context, wherein the recurrent security context refers to multiple previously determined occurrences of said successful login attempts, wherein the first user system is different from the wireless communications device; and

using the determined recurrent security context in a subsequent decision whether to grant a subsequent request by said user to access the target component.