Account recovery using identity assurance scoring system
Techniques are provided for account recovery using an identity assurance scoring system. One method comprises providing multiple available identity assurance techniques, each assigned a corresponding identity assurance value indicating a level of assurance for the corresponding available identity assurance technique; in response to a user request to obtain access to a protected resource following a loss incident of a user authenticator: receiving, from the user, authentication information associated with the available identity assurance techniques; aggregating the corresponding assigned identity assurance values for the received available identity assurance techniques to determine an aggregate identity assurance value; determining if the aggregate identity assurance value satisfies a predefined identity assurance level criteria; and evaluating the user request to access the protected resource based on the determining. The corresponding assigned identity assurance value of a given available identity assurance technique is optionally modified based on the available identity assurance techniques that have already been performed.
1. A method, comprising:
providing a plurality of available identity assurance techniques, wherein the plurality of available identity assurance techniques are assigned respective identity assurance values each indicating a level of assurance for the corresponding available identity assurance technique;
performing the following steps, using at least one processing device, in response to a user request to obtain access to a protected resource following a loss incident of a user authenticator:
receiving, from the user, authentication information associated with at least two selected identity assurance techniques of the plurality of available identity assurance techniques;
determining whether there is an overlap between the received authentication information associated with the at least two selected identity assurance techniques;
modifying the identity assurance value associated with at least one of the selected identity assurance techniques upon determining there is an overlap between the received authentication information;
aggregating the corresponding assigned identity assurance values for each of the at least two selected identity assurance techniques to determine an aggregate identity assurance value;
determining whether the aggregate identity assurance value satisfies a predefined identity assurance level criteria; and
evaluating the user request to access the protected resource based on the determination of whether the aggregate identity assurance value satisfies a predefined identity assurance level criteria.
2. The method of claim 1 , wherein the plurality of available identity assurance techniques comprises one or more of at least one user authenticator technique, at least one user identity verification technique and at least one identity evidence validation technique.
3. The method of claim 1 , wherein the loss incident comprises one or more of loss, theft, damage, replacement and compromise of the user authenticator.
4. The method of claim 1 , wherein the corresponding assigned identity assurance value comprises one or more of a corresponding weight and a corresponding score.
5. The method of claim 1 , wherein the receiving step further comprises the user selecting one or more available identity assurance techniques to perform one or more of user identity proofing and user authentication until the user satisfies the predefined identity assurance level criteria.
6. The method of claim 1 , wherein the receiving, aggregating and determining steps are performed iteratively until the user satisfies the predefined identity assurance level criteria.
7. The method of claim 1 , wherein the predefined identity assurance level criteria is based on an identity assurance value assigned to the user authenticator associated with the loss incident.
8. The method of claim 1 , wherein the user enrolls a selection of the plurality of available identity assurance techniques to be used for recovery after satisfying a specified enrollment authentication assurance level.
9. A system, comprising:
a memory; and
at least one processing device, coupled to the memory, operative to implement the following steps:
providing a plurality of available identity assurance techniques, wherein the plurality of available identity assurance techniques are assigned respective identity assurance values each indicating a level of assurance for the corresponding available identity assurance technique;
performing the following steps, in response to a user request to obtain access to a protected resource following a loss incident of a user authenticator:
receiving, from the user, authentication information associated with at least two selected identity assurance techniques of the plurality of available identity assurance techniques;
determining whether there is an overlap between the received authentication information associated with the at least two selected identity assurance techniques;
modifying the identity assurance value associated with at least one of the selected identity assurance techniques upon determining there is an overlap between the received authentication information;
aggregating the corresponding assigned identity assurance values for each of the at least two selected identity assurance techniques to determine an aggregate identity assurance value;
determining whether the aggregate identity assurance value satisfies a predefined identity assurance level criteria; and
evaluating the user request to access the protected resource based on the determination of whether the aggregate identity assurance value satisfies a predefined identity assurance level criteria.
10. The system of claim 9 , wherein the receiving step further comprises the user selecting one or more plurality of the available identity assurance techniques to perform one or more of user identity proofing and user authentication until the user satisfies the predefined identity assurance level criteria.
11. The system of claim 9 , wherein the receiving, aggregating and determining steps are performed iteratively until the user satisfies the predefined identity assurance level criteria.
12. The system of claim 9 , wherein the predefined identity assurance level criteria is based on an identity assurance value assigned to the user authenticator associated with the loss incident.
13. The system of claim 9 , wherein the user enrolls a selection of the plurality of available identity assurance techniques to be used for recovery after satisfying a specified enrollment authentication assurance level.
14. A computer program product, comprising a non-transitory tangible machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:
providing a plurality of available identity assurance techniques, wherein the plurality of available identity assurance techniques are assigned respective identity assurance values each indicating a level of assurance for the corresponding available identity assurance technique;
performing the following steps, in response to a user request to obtain access to a protected resource following a loss incident of a user authenticator:
receiving, from the user, authentication information associated with at least two selected identity assurance techniques of the plurality of available identity assurance techniques;
determining whether there is an overlap between the received authentication information associated with the at least two selected identity assurance techniques;
modifying the identity assurance value associated with at least one of the selected identity assurance techniques upon determining there is an overlap between the received authentication information;
aggregating the corresponding assigned identity assurance values for each of the at least two selected identity assurance techniques to determine an aggregate identity assurance value;
determining whether the aggregate identity assurance value satisfies a predefined identity assurance level criteria; and
evaluating the user request to access the protected resource based on the determination of whether the aggregate identity assurance value satisfies a predefined identity assurance level criteria.
15. The computer program product of claim 14 , wherein the receiving step further comprises the user selecting one or more available identity assurance techniques to perform one or more of user identity proofing and user authentication until the user satisfies the predefined identity assurance level criteria.
16. The computer program product of claim 14 , wherein the receiving, aggregating and determining steps are performed iteratively until the user satisfies the predefined identity assurance level criteria.
17. The computer program product of claim 14 , wherein the predefined identity assurance level criteria is based on an identity assurance value assigned to the user authenticator associated with the loss incident.