Methods and systems for leveraging transactions to dynamically authenticate a user
A system and method for authenticating a candidate user accessing a host computing device as an authentic user is provided. The host computing device is in communication with an authenticating computing device. The method includes receiving, by the authenticating computing device, a request to authenticate the candidate user as an authentic user. The authentication request includes a user identifier. The method also includes retrieving, by the authenticating computing device, transaction data including payment transactions performed by the authentic user based on the user identifier. The method also includes generating, by the authenticating computing device, a challenge question and a correct answer based on the transaction data associated with the authentic user, and transmitting the challenge question for display on a candidate user computing device used by the candidate user.
1. A computer-implemented method for authenticating a request by a candidate user to access a host computing device, the host computing device in communication with an authenticating computing device, said method comprising:
receiving, by the authenticating computing device, an authentication request for accessing data stored on the host computing device, wherein the authentication request includes at least one of a media access control (MAC) address and an Internet protocol (IP) address of a user device associated with the candidate user;
retrieving, by the authenticating computing device from a database, transaction data associated with the at least one of the MAC address and the IP address, wherein the transaction data comprises a plurality of records each corresponding to one of a plurality of previously completed payment transactions;
generating, by the authenticating computing device, a challenge question and a correct answer to the challenge question based on the retrieved transaction data; and
transmitting, by the authenticating computing device, the challenge question and the correct answer to the host computing device without exposing the transaction data to the host computing device.
2. The method of claim 1 further comprising:
generating, by the authenticating computing device, the challenge question before receiving the authentication request; and
storing, by the authenticating computing device, the challenge question within the database.
3. The method of claim 2 further comprising:
generating, by the authenticating computing device, the correct answer to the challenge question before receiving the authentication request; and
storing, by the authenticating computing device, the correct answer within the database.
4. The method of claim 1 further comprising generating, by the authenticating computing device, the challenge question in response to the authentication request.
5. The method of claim 4 further comprising generating, by the authenticating computing device, the correct answer to the challenge question in response to the authentication request.
6. The method of claim 1 further comprising generating, by the authenticating computing device, the challenge question based on the transaction data from a predefined period of time, wherein the predefined period of time is defined by at least one of a level of security and an ease of use for the candidate user.
7. The method of claim 1 further comprising:
generating, by the authenticating computing device, at least one incorrect answer to the challenge question by comparison to the transaction data; and
transmitting, by the authenticating computing device to the host computing device, the at least one incorrect answer along with the challenge question and the correct answer.
8. An authenticating computing device for authenticating a request by a candidate user to access a host computing device, the authenticating computing device comprising a memory and a processor coupled to the memory, the processor configured to:
receive an authentication request for accessing data stored on the host computing device, wherein the authentication request includes at least one of a media access control (MAC) address and an Internet protocol (IP) address of a user device associated with the candidate user;
retrieve, from a database, transaction data associated with the at least one of the MAC address and the IP address, wherein the transaction data comprises a plurality of records each corresponding to one of a plurality of previously completed payment transactions;
generate a challenge question and a correct answer to the challenge question based on the retrieved transaction data; and
transmit the challenge question and the correct answer to the host computing device without exposing the transaction data to the host computing device.
9. The authenticating computing device of claim 8 further configured to:
generate the challenge question before receiving the authentication request; and
store the challenge question within the database.
10. The authenticating computing device of claim 9 further configured to:
generate the correct answer to the challenge question before receiving the authentication request; and
store the correct answer within the database.
11. The authenticating computing device of claim 8 further configured to generate the challenge question in response to the authentication request.
12. The authenticating computing device of claim 11 further configured to generate the correct answer to the challenge question in response to the authentication request.
13. The authenticating computing device of claim 8 further configured to generate the challenge question based on the transaction data from a predefined period of time, wherein the predefined period of time is defined by at least one of a level of security and an ease of use for the candidate user.
14. The authenticating computing device of claim 8 further configured to:
generate at least one incorrect answer to the challenge question by comparison to the transaction data; and
transmit to the host computing device the at least one incorrect answer along with the challenge question and the correct answer.
15. A non-transitory computer readable storage medium having computer-executable instructions embodied thereon for authenticating a request by a candidate user to access a host computing device, wherein when executed by at least one processor, the computer-executable instructions cause the at least one processor to:
receive an authentication request for accessing data stored on the host computing device, wherein the authentication request includes at least one of a media access control (MAC) address and an Internet protocol (IP) address of a user device associated with the candidate user;
retrieve, from a database, transaction data associated with the at least one of the MAC address and the IP address, wherein the transaction data comprises a plurality of records each corresponding to one of a plurality of previously completed payment transactions;
generate a challenge question and a correct answer to the challenge question based on the retrieved transaction data; and
transmit the challenge question and the correct answer to the host computing device without exposing the transaction data to the host computing device.
16. The non-transitory computer readable storage medium of claim 15 , wherein the computer-executable instructions further cause the at least one processor to:
generate the challenge question before receiving the authentication request; and
store the challenge question within the database.
17. The non-transitory computer readable storage medium of claim 16 , wherein the computer-executable instructions further cause the at least one processor to:
generate the correct answer to the challenge question before receiving the authentication request; and
store the correct answer within the database.
18. The non-transitory computer readable storage medium of claim 15 , wherein the computer-executable instructions further cause the at least one processor to generate the challenge question in response to the authentication request.
19. The non-transitory computer readable storage medium of claim 18 , wherein the computer-executable instructions further cause the at least one processor to generate the correct answer to the challenge question in response to the authentication request.
20. The non-transitory computer readable storage medium of claim 15 , wherein the computer-executable instructions further cause the at least one processor to generate the challenge question based on the transaction data from a predefined period of time, wherein the predefined period of time is defined by at least one of a level of security and an ease of use for the candidate user.
21. The non-transitory computer readable storage medium of claim 15 , wherein the computer-executable instructions further cause the at least one processor to:
generate at least one incorrect answer to the challenge question by comparison to the transaction data; and
transmit to the host computing device the at least one incorrect answer along with the challenge question and the correct answer.