International Business Machines Corporation

Scott M Andrews

Christopher John Hockings

David Paul Moore

Codur Sreedhar Pranam

Trevor Scott Norvill

Leo Michael Farrell

Anthony B Ferguson

Leigh Doddy

Sumana Srinath Narasipur

John T Robertson

Philip Alan John Nye

Timothy J Ashton

Moshe Kagan

In a method for authenticating a user, a processor receives a login request for an application. A processor directs the login request to a collection page. The collection page may include an authentication script. A processor receives a risk assessment based on an identity authenticated through the authentication script. A processor grants a level of access to the application based on the risk assessment.

Injecting risk assessment in user authentication

A computer-implemented system and method include a rate-limiting server. The server receives a request from a client and uses an early stage process to search for a rate-limiting token bucket (TB) using metadata associated with the request. Responsive to finding the TB using the first metadata, a response operation is performed. Responsive to not finding the TB using the first metadata, a late stage process is used to search for the rate-limiting TB using server-side session data associated with the request. Responsive to not finding the TB using the session data, the TB is created and associated with at least two search indexes comprising the first metadata associated with the request and the session data. Finally, the response operation is performed that comprises transmitting a determined response to the client.

Increasing efficiency to rate limiting

A policy enforcement point includes fraud prevention information associated with devices and/or users which is collected from: (i) many cloud fraud services located in the cloud; and/or (ii) authorization processing of users and/or devices. The policy enforcement point is consulted when a user/device undergoes authorization processing for a transaction with an application (for example, an application that serves protected content such as financial records, email, etc.). Fraud prevention information is added to session data, associated with the attempted authorization to the application, for the user/device as the user/device proceeds its attempted authorization to the application. In some cases, the authorization to the application may be refused based on the data added to the session data by the policy enforcement point or the policy enforcement point will propagate fraud prevention information to the application to make the decision.

Propagating fraud awareness to hosted applications

A first user request may be received to access a particular resource. A first authentication credential from a first client device may be received based on a first authentication challenge being issued to a user of the first client device. A second client device of the user may be notified to prompt the user to provide a second authentication credential to complete at least a second authentication challenge. The access to the particular resource may require at least successfully completing the first authentication challenge on the first client device and the second authentication challenge on the second client device.

Multifactor authentication processing using two or more devices

An electronically authenticated internet voice connection can be initiated on an institution's website. Authentication of the customer's identity can be determined based upon already established credentials, such as a username and password. Upon verifying the identity of the customer, the institution's web server can generate and transmit a unique identifier to the customer's browser. The unique identifier can be an encrypted identifier used to authenticate the customer when establishing a subsequent voice connection.

Growing community of inventors

Carrara, Australia

Scott M Andrews