Non-repeatable challenge-response authentication
User data is aggregated across a plurality of electronic communication channels and domains. An online system initially authenticates a user for access to the online system over a network. The online system provides a user identifier for the user to an authentication service. The authentication service generates a non-repeatable challenge from the aggregated user data for the user identifier and provides the non-repeatable challenge to the online system. The online system provides the challenge to the user and receives a response from the user. The online system provides the response to the authentication service and the authentication sends a success or failure back to the online system based on the response to the challenge, and based on the success or failure the online system makes a final determination for authenticating the user for accessing to the online system.
1. A method, comprising:
aggregating user-specific electronic activity across a plurality of domains and electronic communication channels, wherein aggregating further includes classifying the user into one or more classifications based on that user's aggregated user-specific electronic activity, wherein classifying further includes:
randomly selecting a particular classification;
identifying a template assigned to that particular classification;
randomly selecting a challenge-response entry from a plurality of entries in the template; and
augmenting the searching of the aggregated user-specific electronic activity with information identified in the challenge-response entry;
receiving a challenge-response request from an authentication system for a user;
generating a non-repeatable challenge-response by searching the aggregated user-specific electronic activity with an identifier for the user in response to receiving the challenge-response request;
providing the non-repeatable challenge-response to the authentication system;
obtaining a proposed response provided by the user and sent from the authentication system; and
sending an indication of success or failure to the authentication system based on comparing the proposed response against an expected response, wherein the expected response provided in the non-repeatable challenge-response as a particular response along with other improper responses and providing the user authenticated access to an online system based on the indication.