Dynamic trust model for authenticating a user

1. A method for authenticating a user, comprising:

determining, by computer, a trust level for the user after a first elapsed time, wherein the trust level is a function of the first elapsed time since the user previously provided authentication information, wherein the trust level decays as a function of the first elapsed time, and wherein a higher trust level is associated with a slower rate of decay of the trust level;

receiving notice of an identified security threat that affects multiple users;

determining a new rate of decay of the trust level based on the identified security threat;

determining a new trust level after a second elapsed time since receiving notice of the identified security threat, wherein the new trust level is obtained by multiplying the second elapsed time with the new rate of decay of the trust level;

calculating a transaction risk level based on a type of user transaction performed by the user; and

requesting additional authentication information from the user when the transaction risk level exceeds the new trust level.

2. The method of claim 1 , wherein, prior to receiving notice regarding the security threat, a rate of decay of the trust level is based on characteristics of the authentication information the user previously provided.

3. The method of claim 2 , wherein a magnitude of the rate of decay is greater than a pre-determined value if the authentication information includes a user identifier.

4. The method of claim 3 , wherein the user identifier includes a password and/or a username.

5. The method of claim 2 , wherein a magnitude of the rate of decay is smaller than a pre-determined value if the authentication information includes a physical token.

6. The method of claim 1 , wherein, prior to receiving notice regarding the security threat, a rate of decay of the trust level is based on a user location.

7. The method of claim 6 , wherein the user location is determined based on a network address.

8. The method of claim 6 , wherein a magnitude of the rate of decay is increased if the user location is different than during a previous user transaction.

9. The method of claim 1 , wherein the security threat includes an attempted ‘phishing’ attack on account information associated with at least one of the multiple users.

10. The method of claim 1 , wherein the trust level is increased when the user provides the additional authentication information.

11. The method of claim 10 , wherein the increase in the trust level is less than a pre-determined value if the authentication information includes a user identifier.

12. The method of claim 11 , wherein the user identifier includes a password and/or a username.

13. The method of claim 10 , wherein the increase in the trust level is greater than a pre-determined value if the authentication information includes a physical token.

14. The method of claim 1 , further comprising terminating a user session if the trust level is less than a pre-determined threshold.

15. The method of claim 1 , wherein the transaction risk level is based on a user-account history.

16. A non-transitory computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform a method for authenticating and authorizing a user, the method comprising:

determining a trust level for a user after a first elapsed time, wherein the trust level is a function of the first elapsed time since the user previously provided authentication information, wherein the trust level decays as a function of the first elapsed time, and wherein a higher trust level is associated with a slower rate of decay of the trust level;

receiving notice of an identified security threat that affects multiple users; determining a new rate of decay of the trust level based on the identified security threat;

determining a new trust level after a second elapsed time since receiving notice of the identified security threat, wherein the new trust level is obtained by multiplying the second elapsed time with the new rate of decay of the trust level;

calculating a transaction risk level based on a type of user transaction performed by the user; and

requesting additional authentication information from the user when the transactional risk level exceeds the new trust level.

17. The non-transitory computer-readable storage medium of claim 16 , wherein the trust level is increased when the user provides the additional authentication information.

18. A computer system, comprising:

a processor;

memory; and

a program module, wherein the program module is stored in the memory and configured to be executed by the processor, the program module including:

instructions for determining a trust level for a user after a first elapsed time, wherein the trust level is a function of the first elapsed time since the user previously provided authentication information, wherein the trust level decays as a function of the first elapsed time, and wherein a higher trust level is associated with a slower rate of decay of the trust level;

instructions for receiving notice of an identified security threat that affects multiple users;

instructions for determining a new rate of decay of the trust level based on the identified security threat;

instructions for determining a new trust level after a second elapsed time since receiving notice of the identified security threat, wherein the new trust level is obtained by multiplying the second elapsed time with the new rate of decay of the trust level;

instructions for calculating a transaction risk level based on a type of user transaction performed by the user; and

instructions for requesting additional authentication information from the user when the transactional risk level exceeds the new trust level.

19. The computer system of claim 18 , wherein the trust level is increased when the user provides the additional authentication information.