Interactive authentication

1. A computer-implemented method for authenticating an end user, comprising:

receiving a valid authentication credential associated with a digital identity, the valid authentication credential received from the end user at an input device in association with a login attempt;

determining whether an identification token is received with the valid authentication credential;

identifying the identification token as a token included in a list of valid tokens associated with the digital identity at an authentication system in response to the determination that the identification token is received with the valid authentication credential;

determining, in response to the identification token being identified as included in the list of valid tokens, whether a lockout period associated with the identification token in the list of valid tokens has expired;

authenticating the end user associated with the login attempt in response to the determination that the lockout period has expired;

determining, in response to the determination that the identification token is not received, whether a lockout period associated with the digital identity has expired;

generating, in response to the determination that the lockout period associated with the digital identity has not expired, a new identification token associated with the current lockout period;

adding the new identification token in the list of valid tokens associated with the digital identity; and

rejecting the authentication of the end user associated with the login attempt.

2. The computer-implemented method of claim 1 , further comprising:

determining, in response to the determination that the identification token is not received, that the lockout period associated with the digital identity has expired; and

authenticating the end user associated with the login attempt in response to the determination that the lockout period associated with the digital identity which has expired.

3. The computer-implemented method of claim 1 , further comprising:

determining, in response to the determination that the identification token is not included in the list of valid tokens associated with the digital identity, whether the lockout period associated with the digital identity has expired; and

authenticating the end user associated with the login attempt in response to the determination that the lockout period associated with the digital identity which has expired.

4. The computer-implemented method of claim 3 , further comprising:

adding the identification token to the list of valid tokens in response to the lockout period associated with the digital identity having not expired; and

rejecting the end user associated with the login attempt.

5. The computer-implemented method of claim 1 , further comprising rejecting the authentication of the end user associated with the login attempt in response to the determination that the lockout period associated with the identification token in the list of valid tokens which has not expired.

6. The computer-implemented method of claim 1 , wherein authenticating the end user associated with the login attempt comprising granting the login attempt.

7. The computer-implemented method of claim 1 , wherein the identification token is automatically provided by the input device at the login attempt.

8. The computer-implemented method of claim 1 , wherein multiple digital identities are associated with the authentication system, and wherein each digital identity is associated with a corresponding list of valid tokens.

9. A system of one or more computers configured to perform operations for authenticating end users comprising:

receiving a valid authentication credential associated with a digital identity, the valid authentication credential received from an end user at an input device in association with a login attempt;

determining whether an identification token is received with the valid authentication credential;

identifying the identification token as a token included in a list of valid tokens associated with the digital identity at an authentication system in response to the determination that the identification token is received;

determining, in response to the identification token being identified as included in the list of valid tokens, whether a lockout period associated with the identification token in the list of valid tokens has expired;

authenticating the end user associated with the login attempt in response to the determination that the lockout period has expired;

determining, in response to the determination that the identification token is not received, whether a lockout period associated with the digital identity has expired;

generating, in response to the determination that the lockout period associated with the digital identity has not expired, a new identification token associated with the current lockout period;

adding the new identification token in the list of valid tokens associated with the digital identity; and

rejecting the authentication of the end user associated with the login attempt.

10. The system of claim 9 , further configured to perform operations comprising determining, in response to the determination that the identification token is not received, that the lockout period associated with the digital identity has expired; and

authenticating the end user associated with the login attempt in response to the determination that the lockout period associated with the digital identity which has expired.

11. The system of claim 9 , further configured to perform operations comprising:

determining, in response to the determination that the identification token is not included in the list of valid tokens associated with the digital identity, whether the lockout period associated with the digital identity has expired; and

authenticating the end user associated with the login attempt in response to the determination that the lockout period associated with the digital identity has expired.

12. The system of claim 11 , further configured to perform operations comprising:

adding the new identification token to the list of valid tokens in response to the lockout period associated with the digital identity having not expired; and

rejecting the end user associated with the login attempt.

13. The system of claim 9 , further configured to perform operations comprising:

rejecting the authentication of the end user associated with the login attempt in response to the determination that the lockout period associated with the identification token in the list of valid tokens which has not expired.

14. A non-transitory computer-readable medium encoded with a computer program, the program comprising instructions that when executed by one or more computers cause the one or more computers to perform operations for authenticating an end user comprising:

receiving a valid authentication credential associated with a digital identity, the valid authentication credential received from the end user at an input device in association with a login attempt;

determining whether an identification token is received with the valid authentication credential;

identifying the identification token as a token included in a list of valid tokens associated with the digital identity at an authentication system in response to the determination that the identification token is received;

determining, in response to the identification token being identified as included in the list of valid tokens, whether a lockout period associated with the identification token in the list of valid tokens has expired;

authenticating the end user associated with the login attempt in response to the determination that the lockout period has expired;

determining, in response to the determination that the identification token is not received, whether a lockout period associated with the digital identity has expired;

generating, in response to the determination that the lockout period associated with the digital identity has not expired, a new identification token associated with the current lockout period;

adding the new identification token in the list of valid tokens associated with the digital identity; and

rejecting the authentication of the end user associated with the login attempt.