Multi-factor secure operation authentication
A user makes a request from a requesting device for access to a secure operation associated with a network-based service. A first biometric authentication is processed for the request and at least one second scope-based authentication is processed for the request based on an analysis of a physical environment for the requesting device. A determination is made based on at least the first biometric authentication and the scope-based authentication whether the secure operation can be: processed on behalf of the user by the network-based service, not processed at all, or processed only if requested from a specific medium/channel associated with a specific device, which may or may not be the requesting device.
1. A method, comprising:
receiving a request from a user to initiate a secure operation via a first channel;
performing a first-factor authentication of the user based at least in part on biometric data received from the user;
performing a second-factor authentication at least in part by evaluating a physical environment associated with the user;
wherein performing the second-factor authentication further includes:
scanning for at least on wireless device within the physical environment and comparing at least one detected device from the scanning against a list of authorized devices;
determining based at least in part on results of the first-factor authentication and the second-factor authentication that a second channel different from the first channel is to be used for the secure operation; and
directing the user to request the secure operation via the second channel.
2. The method of claim 1 , wherein determining that the second channel is to be used for the secure operation comprises determining that the first channel would not provide a threshold level of security for performing the secure operation.
3. The method of claim 1 , wherein performing the first-factor authentication comprises analyzing a voice print of the user and comparing it to a pre-stored voice print in a secure database.
4. The method of claim 1 , further comprising:
receiving a confirmation from the user via the second channel before processing the secure operation.
5. The method of claim 1 , wherein the secure operation is a financial transaction, and the first channel is a voice command provided through a voice-enabled device.
6. The method of claim 1 , wherein the second channel is a graphical user interface of a mobile application requiring user interaction to confirm the secure operation.
7. The method of claim 1 , wherein determining that the second channel is to be used for the secure operation further comprises applying a machine learning algorithm to assess a risk associated with the first channel.
8. The method of claim 1 , wherein the first channel is an automated telephone system and the second channel is a secure web portal accessed via a computing device.
9. The method of claim 1 , further comprising:
logging the request and any subsequent channel modification from the first channel to the second channel in an audit trail for security compliance monitoring.
10. The method of claim 1 , wherein the performing the first-factor authentication further comprises determining a geolocation of a device operated by the user at a time associated with the request and comparing the geolocation to a pre-determined authorized location for the user.
11. The method of claim 1 , wherein the performing the second-factor authentication further comprises monitoring for environmental an audio cue indicative of a potential security threat in a vicinity of the user and adjusting an authentication requirement based on a detected presence of the audio cue.
12. A method, comprising:
receiving a request from a user to perform a secure operation via a first communication channel;
authenticating an identity of the user based at least in part on biometric input provided by the user;
determining a security level of a current environment of the user based at least in part on one or more environmental factors associated with the current environment;
determining that the first communication channel fails to provide a minimum security threshold for performing the secure operation based at least in part on a result of the authenticating and the security level; and
instructing the user to continue the request for the secure operation through a second communication channel different from the first communication channel;
wherein the one or more environmental factors include a presence of a Wi-Fi-enabled device;
wherein determining the security level of the current environment further includes checking the Wi-Fi-enabled device against a pre-approved list of devices associated with a profile of the user.
13. The method of claim 12 , wherein the biometric input comprises retinal scan input, and wherein authenticating the identity of the user comprises comparing the retinal scan input against a database of authorized user retinal patterns.
14. The method of claim 12 , wherein the second communication channel is selected from a group consisting of a secure messaging service, an encrypted email, and a dedicated mobile application interface.
15. The method of claim 12 , further comprising:
generating a password that the user must enter on the second communication channel to proceed with the secure operation.
16. The method of claim 12 , wherein the instructing further comprises providing the user with a visual or an auditory cue through a device operated by the user to facilitate switching to the second communication channel.
17. The method of claim 16 , wherein determining the security level of the current environment comprises detecting network security settings of a device operated by the user, and wherein determining that the first communication channel fails to provide the minimum security threshold for performing the secure operation comprises determining that the network security settings do not meet predefined security criteria.
18. A system, comprising:
a processor;
a memory storing instructions that, when executed by the processor, cause the system to:
receive a request from a user to initiate a secure operation via a first communication medium;
perform a first-factor authentication at least in part by analyzing biometric data associated with the user;
perform a second-factor authentication at least in part by evaluating a physical environment from which the request was initiated;
wherein performing the second-factor authentication further includes:
scan for at least on wireless device within the physical environment and comparing at least one detected device against a list of authorized devices
determine, based at least in part on a first outcome of the first-factor authentication and a second outcome of the second-factor authentication whether the first communication medium is secure for proceeding with the secure operation; and
redirect the user to a second communication medium for completing the request for the secure operation when the first communication medium is determined to be insecure, wherein the second communication medium is distinct from the first communication medium.
19. The system of claim 18 , wherein the instructions further cause the system to:
determine, during the second-factor authentication, that an unknown device is present in the physical environment based at least in part on analyzing a history of devices detected within the physical environment to determine that the unknown device is not associated with a profile of the user; and
generate a security alert based at least in part on a presence of the unknown device in the physical environment, wherein the security alert prompts the user to confirm a presence of the unknown device before proceeding with the redirection to the second communication medium.