Identification (ID) proofing and risk engine integration system and method
The system and method disclosed performs entity authentication through identification proofing. A relying party such as a corporation or other type of entity having a secure website, computer network and secure facility working a risk engine can determine the authenticity, validation and verification during registration of a user entity. The identification proofing is integrated with a risk engine. The risk engine is capable of using bio-behavior based information which may be continuously monitored.
1. A method for identity proofing a user entity for allowing for secure access comprising:
in a resolution step, capturing registration information of the user entity at a relying party and monitoring the user entity by the risk engine during an active session;
in a first part of a validation step, determining by the risk engine whether the user entity is not a threat actor by reviewing a plurality of egocentric and allocentric factors and if an abnormality is detected, notifying the relying party to terminate the active session;
in a second part of the validation step, reviewing by the risk engine evidence submitted by the user entity and comparing the evidence to an internal database to determine whether the owner of the identity is the user entity and whether the user entity is a claimed registered identity or a new identity;
in a verification step, if the user entity is the claimed registered identity, the risk engine will continuously capture contextual and behavioral factors of the user entity at the smart data hub to develop a bio-behavioral model of the user entity through machine learning;
in the verification step, if the user entity is the new identity, obtaining the user entity contact information from at least one of a plurality of third party identity aggregators and contacting the user entity to obtain a confirmation that the user entity is attempting to register with the relying party and if the user entity is not new, the risk engine already has the contact information for the user entity and contacts the user entity directly through a predetermined out of band method; and
sending a risk score from the risk engine to the relying party a classification of the risk determining that the user entity is or is not a threat actor.
2. The method of claim 1 wherein the egocentric and allocentric factors include at least one of the following: whether the user entity lied about key parameters; whether there is a lack of a device or browser fingerprint from the user entity device detected; whether a software service or expected java script is missing; the user entity device has a bad reputation; whether the user entity device is a rooted device; and the user entity is blacklisted.
3. The method of claim 1 , wherein identity evidence provided by the user entity includes at least one of the group including: an email address; a driver license; a national identity card; a passport; a digital identity; a knowledge based authentication (KBA); a third party social identity; a facial recognition; and fingerprint scans.
4. The method of claim 1 , wherein the classification is unacceptable, weak, fair, strong or superior.
5. The method of claim 1 , wherein the plurality of third party identity aggregators are partners with the risk engine.
6. The method of claim 1 , further comprising:
when the registration attempt is received of the user entity from the relying party at the risk engine;
contact a user entity device to collect recent contextual and behavioral data of the user entity from the user entity device;
receive the recent contextual and behavioral data of the user entity at the risk engine;
send the recent contextual and behavioral data of the user entity to the smart data hub;
retrieve a bio-behavioral model of the user entity and update with the recent contextual and behavioral data of the user entity to form an updated bio-behavioral model of the user entity;
compare allocentric and egocentric factors of a transaction request with the update bio-behavioral model of the user entity to determine the level of abnormalities associated with the transaction request and determine a risk score; and
send the risk score back to the risk engine.
7. The method of claim 1 , wherein transaction request allocentric and egocentric factors include at least one of the group consisting of:
a user entity device model, a user entity device hardware configuration, a user entity device operating system, user entity device applications, a user entity device web browser version, a service set identifier (SSID) of the network WiFi, network information, object classes transferred, screen size, font size, language, user entity habits, speed and style of user entity keyboard entry, mouse strokes, screen touch, adjacent companion mobile device in proximity, biobehavioral data derived from the user entity, walking gait of the user entity, trusted locations of the user entity, haptic-tactic factors derived from hardware sensors embedded inside the device, specialized sensor data captured by the hardware, ambient noise, temperature, discrete movement and location of the mobile device, exercise habits of the user entity, user entity location, and user entity driving, transactions on a mobile device user entity behavior analytics (UBA) services, identification authorization and proofing, secure data access, short message service (SMS), and location based service (LBS) functions.