Authentication of a requested action for account security

Abstract

A system and method for authentication of a requested action for account security are provided. The method may include receiving notification of the requested action associated with an account. The method may include transmitting an end-user prompt to a prompt endpoint associated with the account. The method may include receiving a response message including an end-user response which may indicate approval of the requested action from the prompt endpoint and which includes data points collected from the prompt endpoint. The method may include processing the collected data points to determine an updated authentication activity requirement, which may include a requirement to decline or further verify the requested action despite the end-user response message indicating approval of the action.

Description

[0001] AUTHENTICATION OF A REQUESTED ACTION FOR ACCOUNT SECURITY

[0002] CROSS-REFERENCE TO RELATED APPLICATION

[0003] This application claims priority from South African provisional patent application number 2024 / 07045 filed on 13 September 2024, which is incorporated by reference herein.

[0004] FIELD

[0005] This disclosure relates to account security and, in particular, to authentication of a requested action associated with an account.

[0006] BACKGROUND

[0007] Authentication of digital online activity, such as logging into an online account, or the like, is performed routinely. A requested action may be an approval type action associated with digital online activity to allow a process to continue, such as to login to an account, or to approve a transaction. Oftentimes, an end-user is prompted for their approval of the requested action, such as via a message to an endpoint which asks them to approve or decline the requested action. If the end-user responds to the prompt in the affirmative, then the requested action is allowed to continue.

[0008] While such authentication has led to security improvements, malicious actors have devised means to overcome such security measures. Social engineering attacks are a means to convince the end-user that the prompt should be approved when, in fact, a fraudulent action is taking place. Due to the nature of the end-user prompt method, it is not possible to know whether the response to the prompt of the requested action was illegitimately influenced.

[0009] There accordingly remains scope for improvement.

[0010] The preceding discussion of the background is intended only to facilitate an understanding of the present disclosure. It should be appreciated that the discussion is not an acknowledgment or admission that any of the material referred to was part of the common general knowledge in the art as at the priority date of the application.

[0011] SUMMARY In accordance with an aspect of the disclosure there is provided a computer-implemented method for authentication of a requested action for account security comprising: receiving notification of a requested action associated with an account, the action being initiated using an initiating endpoint; in response to determining, based on initial data points associated with the requested action, an initial authentication activity requirement which requires an end-user response, transmitting an end-user prompt to a prompt endpoint associated with the account; receiving, from the prompt endpoint, a response message including the end-user response which indicates approval of the requested action and which includes data points collected from the prompt endpoint; and, processing the collected data points to determine an updated authentication activity requirement, wherein the updated authentication activity requirement includes a requirement to decline or further verify the requested action despite the end-user response message indicating approval of the action.

[0012] The method may include, receiving the initial data points from the initiating endpoint and, in response to receiving the notification of the requested action, processing the initial data points associated with the requested action to determine the initial authentication activity requirement. Each of the initial and updated authentication activity requirements may be determined from requirements including: a requirement to approve the requested action without authentication activity; a requirement to decline the requested activity; a requirement to delay initiation of the requested action; a requirement to request an end-user response; a requirement to request enduser proximity confirmation; a requirement to refer the requested action to a security investigation; or, a requirement to silently collect data points.

[0013] The requirement to further verify the requested action may initiate a proximity-based authentication to confirm that the prompt endpoint is physically proximate the initiating endpoint. The requirement to further verify the requested action may include requiring further end-user participation or delaying initiation of the requested action. The initiating endpoint and the prompt endpoint may be provided in a single computing device or in different user computing devices.

[0014] The prompt endpoint may be a registered endpoint having previously been registered with or against the account. An endpoint application may execute on the prompt endpoint and may be configured to collect the data points in response to receiving the end-user prompt. The endpoint application may be configured to collect the data points over a period of time, including over a period of time commencing when the end-user prompt is received and terminating when the enduser response is input. The prompt endpoint may be an out-of-band endpoint.

[0015] The collected data points, which may be predefined data points, may include one or more of the group of: a microphone active / inaccessible indicator; internet protocol (IP) address; geographic location obtained from a geographical location element; endpoint application version; operating system version; endpoint details (such as make, model or the like); an endpoint identifier; endpoint cell tower data information; endpoint uptime, and the like.

[0016] Processing the collected data points may include processing the collected data points in the context of the initial data points associated with the requested action. Processing the collected data points in the context of the initial data points associated with the requested action may include one or both of: comparing an IP address of the initiating endpoint with an IP address received from the prompt endpoint; and, comparing a geographical location of the initiating endpoint with a geographical location of the prompt endpoint. Processing the collected data points may include comparing the collected data points against expected patterns determined for the collected data points based on one or both of previously collected data points and the initial data points associated with the requested action.

[0017] The method for authentication of a requested action for account security may further include, conducted at the initiating endpoint, the steps of: obtaining a set of initial data points at the initiating endpoint; compiling a set of requested action details; generating a requested action notification using the initial data points and requested action details; and, transmitting the requested action notification to the authentication service.

[0018] The method of authentication of a requested action for account security may further include, conducted at the prompt endpoint, the steps of: receiving an end-user response request from the authentication service; outputting the prompt to the end-user; obtaining an end-user response from the end-user prompt; collecting a predefined list of data points at the prompt endpoint over a period of time; and, transmitting a response message comprising the end-user response and collected data points, to the authentication service.

[0019] The end-user prompt may cause the prompt endpoint to collect data points in response to receiving the end-user prompt.

[0020] In accordance with a further aspect of the disclosure there is provided a system for authentication of a requested action for account security, the system comprising: a non-transitory computer- readable storage medium; and one or more processors coupled to the non-transitory computer- readable storage medium, wherein the non-transitory computer-readable storage medium comprises program instructions that, when executed on the one or more processors, cause the system to perform operations comprising: receiving notification of a requested action associated with an account, the action being initiated using an initiating endpoint; in response to determining, based on initial data points associated with the requested action, an initial authentication activity requirement which requires an end-user response, transmitting an end-user prompt to a prompt endpoint associated with the account; receiving, from the prompt endpoint, a response message including the end-user response which indicates approval of the requested action and which includes data points collected from the prompt endpoint; and, processing the collected data points to determine an updated authentication activity requirement, wherein the updated authentication activity requirement includes a requirement to decline or further verify the requested action despite the end-user response message indicating approval of the action.

[0021] The system may include a computing device providing the initiating endpoint, comprising: an initiating endpoint non-transitory computer-readable storage medium; and one or more initiating endpoint processors coupled to the initiating endpoint non-transitory computer-readable storage medium, wherein the initiating endpoint non-transitory computer-readable storage medium comprises program instructions that, when executed on the one or more initiating endpoint processors, cause the initiating endpoint to perform operations comprising: obtaining a set of initial data points at the initiating endpoint; compiling a set of requested action details; generating a requested action notification using the initial data points and requested action details; and, transmitting the requested action notification to an authentication service.

[0022] The system may include a computing device providing the prompt endpoint, comprising: a prompt endpoint non-transitory computer-readable storage medium; and one or more prompt endpoint processors coupled to the prompt endpoint non-transitory computer-readable storage medium, wherein the prompt endpoint non-transitory computer-readable storage medium comprises program instructions that, when executed on the one or more prompt endpoint processors, cause the prompt endpoint to perform operations comprising: receiving an end-user response request from the authentication service; outputting the end-user prompt to the end-user; obtaining an enduser response from the end-user prompt; collecting a predefined list of data points at the prompt endpoint over a period of time; and, transmitting, to the authentication service, a response message comprising the end-user response and collected data points.

[0023] The system may include an endpoint application executing on the prompt endpoint and configured to collect the data points in response to receiving the end-user prompt. The endpoint application is configured to collect the data points over a period of time, including over a period of time commencing when the end-user prompt is received and terminating when the end-user response is input. In accordance with a further aspect of the disclosure there is provided a system for authentication of a requested action for account security, the system including a memory for storing computer- readable program code and a processor for executing the computer-readable program code, the system comprising: a requested action notification receiving component for receiving notification of a requested action associated with an account, the action being initiated using an initiating endpoint; a prompt transmitting component for transmitting, in response to determining, based on initial data points associated with the requested action, an initial authentication activity requirement which requires an end-user response, an end-user prompt to a prompt endpoint associated with the account; a response message receiving component for receiving, from the prompt endpoint, a response message including the end-user response which indicates approval of the requested action and which includes data points collected from the prompt endpoint; and, a data point processing component for processing the collected data points to determine an updated authentication activity requirement, wherein the updated authentication activity requirement includes a requirement to decline or further verify the requested action despite the end-user response message indicating approval of the action.

[0024] The system may include: an initial data point receiving component for receiving the initial data points from the initiating endpoint and, an initial data point processing component for processing in response to receiving the notification of the requested action, the initial data points associated with the requested action to determine an initial authentication activity requirement.

[0025] The system may include: a proximity-based authentication component for carrying out a proximitybased authentication to confirm that the prompt endpoint is physically proximate the initiating endpoint.

[0026] The data point processing component may be configured to process the collected data points in the context of the initial data points associated with the requested action. The data point processing component may include an address comparing component for comparing an IP address of a computing device from which the requested action originates with an IP address received from the endpoint. The data point processing component may include a geographical comparing component for comparing a geographical location of a computing device from which the requested action originates with a geographical location of the endpoint. The data point processing component may include a pattern comparing component for comparing the collected data points against expected patterns determined for the collected data points based on one or both of previously collected data points and the data points associated with the requested action.

[0027] The system may include a prompt endpoint, comprising: a message transmitting and receiving component for transmitting a response message and receiving an end-user response request, a prompt output component for outputting a prompt at the prompt endpoint, a response component for collection a response to a prompt, and a data point collecting component for collecting data points at the prompt endpoint.

[0028] The prompt endpoint may be a registered endpoint having previously been registered with or against the account. An endpoint application may execute on the prompt endpoint. The endpoint application may be configured to collect the data points over a period of time, including over a period of time commencing when the end-user prompt is received and terminating when the enduser response is input. The prompt endpoint may be an out-of-band endpoint (requested action does not originate from the endpoint).

[0029] The system may further include an initiating endpoint, comprising: data point collecting component for collecting data points at the initiating endpoint; a requested action details compiling component for compiling a set of details for the requested action notification; a requested action generating component for generating a requested action, and a requested action transmitting component for transmitting the requested action to an authentication service.

[0030] The initiating endpoint and the prompt endpoint may be provided in a single computing device or in different user computing devices.

[0031] In accordance with a further aspect of the disclosure there is provided a computer program product for authentication of a requested action for account security, the computer program product comprising a computer-readable medium having stored computer-readable program code for performing the steps of: receiving notification of a requested action associated with an account, the action being initiated using an initiating endpoint; in response to determining, based on initial data points associated with the requested action, an initial authentication activity requirement which requires an end-user response, transmitting an end-user prompt to a prompt endpoint associated with the account; receiving, from the prompt endpoint, a response message including the end-user response which indicates approval of the requested action and which includes data points collected from the prompt endpoint; and, processing the collected data points to determine an updated authentication activity requirement, wherein the updated authentication activity requirement includes a requirement to decline or further verify the requested action despite the end-user response message indicating approval of the action.

[0032] A computer program product for authentication of a requested action, the computer program product comprising a computer-readable medium having stored computer-readable program code for performing, at an initiating endpoint, the steps of: obtaining a set of initial data points at the initiating endpoint; compiling a set of requested action details; generating a requested action notification using the initial data points and requested action details; and, transmitting the requested action notification to the authentication service.

[0033] A computer program product for authentication of a requested action, the computer program product comprising a computer-readable medium having stored computer-readable program code for performing, at a prompt endpoint, the steps of: receiving an end-user response request from the authentication service; outputting the prompt to the end-user; obtaining an end-user response from the end-user prompt; collecting a predefined list of data points at the prompt endpoint over a period of time; and, transmitting a response message comprising the end-user response and collected data points, to the authentication service.

[0034] Further features provide for the computer-readable medium to be a non-transitory computer- readable medium and for the computer-readable program code to be executable by a processing circuit.

[0035] Embodiments of the technology will now be described, by way of example only, with reference to the accompanying drawings.

[0036] BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In the drawings:

[0038] Figure 1 A is a schematic diagram which illustrates an example system for authentication of a requested action for account security according to aspects of the present disclosure;

[0039] Figure 1 B is schematic diagram which illustrates an example system for authentication of a requested action for account security according to aspects of the present disclosure;

[0040] Figure 2A is a schematic diagram which illustrates an example prompt used to obtain an end-user response;

[0041] Figure 2B is a schematic diagram which illustrates another example prompt used to obtain an end-user response; Figure 2C is decision tree which illustrates an example set of actions of an authentication activity requirement determined by an authentication service;

[0042] Figure 3 is a flow diagram which illustrates an example method for authentication of a requested action between an authentication service and a prompt endpoint;

[0043] Figure 4A is a schematic diagram which illustrates example system components of an initiating endpoint;

[0044] Figure 4B is a schematic diagram which illustrates example system components of an authentication service server;

[0045] Figure 4C is a schematic diagram which illustrates example system components of a prompt endpoint; and,

[0046] Figure 5 illustrates an example of a computing device in which various aspects of the disclosure may be implemented.

[0047] DETAILED DESCRIPTION WITH REFERENCE TO THE DRAWINGS

[0048] A system and method for authentication of a requested action for account security are provided. Figure 1 A is a schematic diagram which illustrates an example system for authentication of a requested action for account security according to aspects of the present disclosure. The system may include a plurality of end-user endpoints 1 1.1 - 11 .3.

[0049] Each endpoint may be provided by a distinct computing device (such as mobile phones, tablet computers, wearable computing devices, augmented reality computing devices, laptop computers, desktop computers or the like) or may be provided by different applications executing on the same computing device (e.g., a web browser and an authentication application, or the like). One or more of the endpoints may be configured to request actions against or relative to an enduser account 12 maintained for or associated with the end-user. Example actions that may be requested include logging into the account, transacting against or interacting with the account, accessing the account (or data elements stored in association with the account) or the like. Example accounts include financial accounts (bank accounts), email accounts, social media accounts, enterprise accounts (such as CRM systems), or the like. The system may include an authentication service 120 which provides a service for authenticating requested actions initiated against (or affecting) the end-user account 12. The requested actions may be initiated from or via an end-user endpoint (termed an “initiating endpoint” herein). The authentication service may be provided by a third party to an entity maintaining the end-user account. The authentication service may provide an authentication policy advisor (APA) 14 configured to determine an authentication policy or an authentication activity requirement for a requested action. The APA may be configured to determine the authentication activity requirement based on an analysis of one or more signals associated with the requested action.

[0050] Such signals may include or may be in the form of data points which may be collected from one or more endpoints and / or which may be associated with and / or obtained from the requested action. The APA may for example interface with a risk gateway 16 and a feature space 18 to determine the authentication policy for the requested action. The gateway may in turn interface with a digital activity velocity engine 20 which is configured to analyse data points to determine or extract from the data points: features, expected patterns, behavioural characteristics or the like. The gateway may further interface with other components for determining security risk associated with expected actions. The digital velocity engine may for example receive data points from a data point collector 22 configured to collect the data points from one or more sources. The data point collector may for example be configured to collect data points from the one or more enduser endpoints and / or other sources 24 (e.g., including attributes of or metadata relating to the requested action). The data point collector may collect the data points on an ongoing basis for the digital activity velocity engine to build up, generate or maintain a data point profile (representing expected data point patterns or behaviour) over time.

[0051] Example authentication activity requirements include any one or more of: approve the requested action without performing further authentication activity; decline the requested action without performing further authentication activity; delay initiation of the requested action (e.g. for a predetermined period of time); request an end-user response (such as end-user approval or rejection of the requested action, end-user input on or feedback relating to the requested action, or the like); verify proximity of the initiating and a secondary endpoint (including physical proximity); refer the requested action to a security investigation; collect further / additional data points from a secondary endpoint; request a liveness of selfie check by the end-user operating an endpoint (including the initiating endpoint or a secondary endpoint); and the like. In some cases, multiple authentication activities may be required.

[0052] Different authentication activity requirements may be associated with different security risk scores determined by the gateway and / or APA. For example, a very high security risk score, indicating unacceptable security risk, may require the requested action to be declined without further authentication activity. A very low security risk, indicating little to no risk of account or endpoint compromise, may require the requested action to be approved without further authentication activity. In some examples, multiple authentication activities may be performed before the requested action is either approved or declined. In some examples, an authentication activity requirement determined based on initial data points may be revised in response to collection of further / additional data points (e.g., from a secondary endpoint). The further / additional data points may be a set of predefined data points.

[0053] In some examples, the APA determines the authentication activity requirement for a requested action based on an analysis of signals available at the time of the requested action. Signals may also be referred to as data points. Such data points may include data points collected during generation or initiation of the requested action and / or data points stored in a data points database. In some examples, based on an analysis of the available data points, the APA determines an authentication activity requirement that requires collection of further / additional data points from a secondary endpoint associated with the end-user. The secondary endpoint may for example be a mobile phone or tablet computer having an authentication application installed and executing thereon. The secondary endpoint may be an out-of-band endpoint, in that it is a different endpoint from which the requested activity is initiated. In this manner, the APA is configured to enrich the data point analysis by collecting data points from a secondary device which is not initially involved in the requested action. In some examples, the authentication activity requirement to collect additional / further data points is associated with (or included in) a requirement for: an end-user response; proximity verification; liveness or selfie check, or the like. In some examples, the additional / further data points may be requested silently (e.g., without the end-user / operator of the secondary endpoint being aware of the collection).

[0054] Data points collected at or from an endpoint may include any one or more of the group of: microphone usage information (such as a microphone active indicator, a microphone inaccessible indicator, or the like); camera usage information; network information (such as one or more of: IP address, MAC address, Wi-Fi SSID, cell tower data, information Bluetooth radio identifier, or the like); geographic location information (e.g., obtained from a geographical location element and / or from an IP address); endpoint application information (such as application version, application usage information (number of times the application is launched, usage patterns, date of first installation, and the like)); endpoint information (such as make, model, operating system version, unique identifier, whether connected to power source, uptime and the like); end-user interaction information (e.g. behavioural features), contextual information (e.g. active phone call); and the like. The APA therefore determines an authentication policy selected to best mitigate against security risk without unduly increasing end-user friction encountered in requesting actions against the enduser account.

[0055] A system and method for authentication of a requested action for account security by an authentication service are thus provided. Digital online activity may frequently require the approval or refusal of a request that is sent to a digital service. Such digital online activity may include registering or creating online accounts with a service, logging into said accounts, or performing online transactions to name a few. The request associated with the digital online activity may be a request to create an account, login to an account, or perform a transaction.

[0056] The approval or refusal of requests made during digital online activity may include a multi-factor authentication (MFA) request. The MFA request may be a request where a message is sent to a legitimate end-user associated with the digital online activity, to further authenticate the digital activity. In the MFA request, the end-user may approve the request to allow the digital activity to continue, or refuse the request. Typically, the MFA request is sent to a different device from where the digital activity is initiated to provide an additional layer of security, making it harder for bad actors to disrupt the process and steal valuable information from a legitimate user.

[0057] However, bad actors may make use of other techniques to circumvent the MFA request. Such circumventions may include compromising the device that receives the MFA request by obtaining the device, or by compromising the legitimate end-user such that they may be unaware that they are compromised and approve an MFA request when they should not.

[0058] An end-user may conduct digital online activity at an initiating endpoint. The activity may cause a requested action to be generated at the initiating endpoint. In an example, the digital activity may be an end-user logging in to an account using a username and a password. In another example, the digital activity may be a user performing an online transaction. During this process, an MFA request may be generated and sent to the end-user.

[0059] Before the MFA request can be performed, it is usually required that an MFA method or device has been registered to be an authorised method or device. The registration of the method or device may be for an end-user account or the like. An example of registering the MFA method may be registering a mobile device number against the end-user account, such that a unique one- time-pin (OTP) can be sent to the mobile device with the pre-registered mobile device number when the requested action is initiated. In a second example, a device with a specific application installed on the device may be registered against the end-user account. The application may receive a notification to perform the authentication of the requested action.

[0060] When the requested action is initiated at the initiating endpoint, the initiating endpoint may send a requested action notification to an authentication service. The authentication service may have a database of previous requested actions and associated data points with the end-user or enduser account. The authentication service may determine if a prompt, which may form part of the MFA request, is to be sent to a secondary endpoint (which in such circumstances may be referred to as a “prompt endpoint”). The prompt endpoint may be an endpoint registered to the end-user account.

[0061] In order to improve account security during MFA request events, a set of pre-defined data points may be collected from both the endpoint devices. The data points collected from these devices during an MFA request event, including data points collected during previous MFA events, or data points collected during fixed and / or non-fixed data collection periods, may be stored in a database of previous data points.

[0062] The authentication service may determine that data points from another endpoint are required to authenticate the requested action. The authentication service may for example silently collect data points from another endpoint or the authentication service may send the prompt to the prompt endpoint in the form of an end-user response request which causes the endpoint to collect data points. The response request may in this manner cause data points to be collected at the prompt endpoint. The prompt endpoint may display the prompt to the end-user, where the enduser may respond to the prompt in the form of a prompt response. The end-user’s prompt response may be sent back to the authentication service along with the collected data points. The collected data points may be separate from (or in addition to) the end-user prompt response. For example, the end-user may be unaware of the data point collection.

[0063] The authentication service may determine an updated authentication activity requirement based on the collected data points and the prompt response (if one was requested). In some examples, the end-user prompt may be used to silently collect data points from the prompt endpoint. In other examples, the data points are collected silently without prompting the end-user. The data points may comprise information indicating whether the end-user account has been compromised. Such a prompt may be a proximity-based prompt to determine if the prompt endpoint is proximate the initiating endpoint. In another example, the prompt may ask the end-user to enter in a code, answer a question, enter a biometric parameter (such as a face or fingerprint), or the like. The updated authentication activity may ignore (or under-weigh) the prompt response and use only (or over-weigh) the collected data points associated with the prompt endpoint in determining if the requested action should proceed or not. This may seem counterintuitive as the end-user may, in some circumstances, indicate their approval of the requested action. The collected data points may be usable in determining if the end-user and / or end-user account / endpoint is potentially compromised and if the prompt should be ignored entirely, or even determine an updated authentication activity requirement opposite to the prompt response.

[0064] An example embodiment of a system for authentication of a requested action for account security is shown in Figure 1 B. The digital online activity may commence at the initiating endpoint 102. A requested action associated with the digital activity may be initiated at an initiating endpoint 102. The requested action may be associated with initial data points. The initial data points may include any one or more of the group of: data points obtained from or otherwise associated with the requested action (such as requested action meta data, details of one or more entities associated with the requested action, requested action details, and the like) and one or more data points collected from the initiating endpoint (such as microphone usage information; camera usage information; network information; geographic location information; endpoint application information; endpoint information; end-user interaction information; contextual information; and, the like).

[0065] The authentication service 120 may be a service to determine if a requested action should proceed. The authentication service 120 may determine an authentication activity requirement 122. The authentication activity requirement 122 determined from the requested action from the initiating endpoint 102 may be an initial authentication activity requirement. Any further authentication activity requirement may be an updated authentication activity requirement. The authentication service 120 may include or have access to an authentication database 124. The authentication database 124 may store one or both of the initial and updated authentication activity requirements 122. The authentication database 124 may store authentication activity requirements related to previous requested actions of the same initiating endpoint 102. The authentication database 124 may store authentication activity requirements related to previous requested actions of the same end-user or end-user account. The authentication service 120 may include or have access to a data point database 125, which may store one or more previous data points 126.

[0066] The authentication service 120 may be configured to receive the requested action notification 106 from the initiating endpoint 102. The authentication service 120 may also be configured to receive the initial data points 104 from the initiating endpoint 102. Based on the initial data points 104, the authentication service 120 may determine the authentication activity requirement 122. The authentication activity requirement 122 may specify if and what further authentication activity may be required to process the requested action.

[0067] The authentication service may generate an end-user response request 132. The end-user response request 132 may include an end-user prompt 151. The end-user prompt 151 may include information required to display the prompt at the prompting endpoint 150. The end-user prompt 151 may include information required for the end-user to respond to the prompt.

[0068] Both the prompt endpoint 150 and the initiating endpoint 102 may be computing devices. The prompt endpoint 150 may be a different device to the initiating endpoint 102. The prompt endpoint 150 may be an out-of-band endpoint in that the requested action does not originate from it. For example, the initiating endpoint 102 may be a laptop, and the prompt endpoint 150 may be a mobile device. The mobile device (or an application executing thereon) may be associated with an account and configured to receive an end-user response request 132. Alternatively, the initiating endpoint 102 and the prompt endpoint 150 may be provided in a single computing device. For example, the initiating endpoint 102 and the prompt endpoint 150 may be provided by the same mobile device, on which the requested action is generated within a first application and the prompt may be sent to a second application running on the same device.

[0069] The prompt endpoint 150 may be a registered endpoint having previously been registered with or against the end-user account. When the authentication service 120 requires an end-user response, the authentication service 120 is able to send the end-user response request to the correct prompt endpoint 150.

[0070] The prompt endpoint 150 may be configured to receive the end-user response request 132. The prompt endpoint 150 may collect data points available on the endpoint 150. The collected data points 154 may be collected during a period from when the end-user response request 132 is received. The collected data points 154 may be a set of data points continuously collected at the prompt endpoint 150 and are bundled into a set of data points when the end-user response request 132 is received.

[0071] The collected data points 154 may include any one or more of the group of: microphone usage information; camera usage information; network information; geographic location information; endpoint application information; endpoint information; end-user interaction information; contextual information; and, the like. The prompt endpoint 150 may be able to display a prompt to the end-user for a response. The end-user of the prompt endpoint may be a different end-user of the initiating endpoint. This may be the case in a commercial setting where a different end-user has oversight over the MFA requests for additional security.

[0072] The prompt may be an action approval request prompt 160, which may display the response options to the end-user. The response options may be to authorize 162 or decline 164 the requested action. The response to the prompt may be arranged into the end-user response 152.

[0073] Figures 2A and 2B show two example prompts which may be output at the prompt endpoint 150. Figure 2A shows an example embodiment of prompt wording that may be used at the prompt, such as approval 162 of the requested action or refusal 164 of the requested action. The action approval request prompt 161 may include a response text box 166 as shown in the example of Figure 2B, in which the end-user may input a phrase or word as a response to the prompt. The prompt may comprise both the approval / refusal prompt and the text box prompt.

[0074] The end-user prompt 151 may be a prompt requiring the end-user to respond to the prompt.

[0075] The prompt endpoint 150 may generate a response message 134 to be transmitted to the authentication service 120. The response message 134 may include the end-user response and / or the collected data points 154. The configuration of the response message 134 may depend on if the authentication activity requirement requires a prompt only, collected data points only, or both.

[0076] The authentication service 120 may be configured to receive the response message 134 from the prompt endpoint 150. The authentication service 120 may process the response message 134, including either of or both of the end-user response 152 and the collected data points 154, to determine an updated authentication activity requirement. The updated authentication activity requirement may be implemented and / or stored in the authentication database 124.

[0077] The data points database 125 may store the initial data points 104 and / or the collected data points 154 associated with the requested action. The data points database 125 may store the initial data points 104 and / or the collected data points 154 associated with initiating endpoint 102. The data points database 125 may store the initial data points 104 and / or the collected data points 154 in association with the end-user or end-user account. In this manner, the data points (initial data points and / or collected data points) may be linked to the end-user and / or end-user account. Figure 2C illustrates an example embodiment of a list 200 of authentication activity requirements 122, which may apply to the initial authentication activity requirement and the updated authentication activity requirement. The authentication activity requirement 122 may include a requirement to decline 201 the requested action. The authentication activity requirement may include a requirement to further verify the requested action, despite the end-user response message indicating approval of the action.

[0078] The initial authentication activity requirement may determine one or more of a plurality of requirements. The authentication activity requirement 122 may determine that no further action is required and that the requested action may be approved 202 without an authentication activity. The authentication activity may determine that no further action is required and that the requested action may be declined 201 without an authentication activity.

[0079] The authentication activity requirement 122 may determine that further action is required. The authentication activity requirement 122 may determine that the requested action is to be delayed 205. The authentication activity may be a delay 205 only without further intervention, or a delay pending further intervention.

[0080] The authentication activity requirement 122 may determine that the requested action requires further end-user participation. Further end-user participation may include requiring an end-user response 203. The end-user response may include transmitting a prompt to a prompt endpoint 150.

[0081] The authentication activity requirement 122 may determine that the requested action requires an end-user proximity 204 check be initiated. The end-user proximity 204 check may confirm that the prompt endpoint 150 is physically proximate to the initiating endpoint 102. This may include a response text box 166 type end-user response, wherein information provided at the initiating endpoint 102 must be input at the prompt endpoint 150, or vice versa. The information provided at one of the endpoints may include any one or more of: letters, number, or a quick response (QR) code.

[0082] The authentication activity requirement 122 may determine that the requested action be referred for security investigation 206. The investigation may be to determine if fraudulent activity is taking place in relation to the requested action, at any one of the endpoints, or with the end-user.

[0083] The authentication activity requirement 122 may determine that the requested action requires silent data point collection 207. Silent data point collection 207 does not prompt the prompt endpoint 150 with a prompt, but only collects the data points (which may be predefined data points) and transmits these to the authentication service 120.

[0084] A computer implemented method for authentication of a requested action for account security may begin at the initiating endpoint 102. An end-user may initiate a requested action at the initiating endpoint. The requested action may be associated with initial data points. For example, the initiating endpoint 102 may collect a set of initial data points associated with the requested action at the initiating endpoint 102. In some cases, initial data points associated with the requested action may be retrieved from other sources, such as a data points data base, end-user account or the like. In some examples, initial data points are extracted from the requested action and / or from metadata associated with the requested action. The initial data points may be from a predefined list of data points. The initiating endpoint may compile a set of requested action details. These details may be information regarding the requested action. By way of example, the requested action details may be a username, password, account number, transaction details, or the like.

[0085] The initiating endpoint 102 may generate a requested action notification. The requested action notification may include the initial data points and requested action details. Once the requested action notification has been generated, the notification may be transmitted to the authentication service 120.

[0086] A swim-lane diagram of an example embodiment of a computer implemented method for authentication of a requested action for account security is provided in the swim-lane flow diagram of Figure 3 in which respective swim-lanes delineate operations or steps performed by respective devices or entities.

[0087] The authentication service 120 may receive 301 a requested action notification 106 from the initiating endpoint 102. The authentication service may additionally receive and / or retrieve initial data points associated with the requested action notification 106. The initial data points may be received from the initiating endpoint 102 and / or may be retrieved from other sources.

[0088] The authentication service may process 302 the initial data points associated with the requested action notification 106. The authentication service 120 may determine 303, based on processing of the initial data points, an initial authentication activity requirement.

[0089] The authentication service may determine 304 whether the initial authentication activity requirement requires an end-user response. If no end-user response is required 315, the authentication may proceed without requiring an end-user response and simply approve or deny the requested action based on the initial data points. If an end-user response is required, the authentication service may transmit 305 the end-user response request to the prompt endpoint 150. The end-user response request may include the end-user prompt.

[0090] The response may be in the form of an end-user prompt, requiring a response to the prompt by the end-user at the prompt endpoint 150. In other examples, the initial authentication activity requirement may require other authentication activities to be conducted, for example: a silent data point collection, a proximity verification, a delay of the requested action, a referral for security investigation, or the like.

[0091] The prompt endpoint 150 may receive 306 the end-user response request from the authentication service 120. Receiving the end-user response request may initiate the collection of data points at the prompt endpoint 150. The prompt endpoint 150 may begin collecting data points, or it may gather already pre-collected data points that were stored on the prompt endpoint 150 before receiving the end-user response request.

[0092] The prompt endpoint 150 may output 308 the end-user prompt at the prompt endpoint. The prompt may be an approval or refusal prompt as shown in an example embodiment in Figure 2A. The prompt may be a text box prompt as shown in an example embodiment in Figure 2B. The text box prompt may for example ask the user a question, request feedback, or the like.

[0093] The prompt endpoint 150 may receive 309 input of the end-user response from the prompt. In the case of a text box prompt, the end-user response may be a response to the question, may be in the form of feedback, or the like. In the case of an approval or refusal prompt, the end-user response may be activation or selection of either the approval or refusal graphical icon.

[0094] The prompt endpoint may collect 307 data points from the prompt endpoint. The collected data points may be a selected from a predefined list of data points. The data points may have been collected over a period of time commencing when the end-user response request or end-user prompt was received. The prompt endpoint may terminate collecting data points when the enduser response is input. Alternatively, the prompt endpoint may continuously or periodically collect data points. The prompt endpoint may store the collected data points even when no requested action has been initiated at the initiation endpoint. The end-user response request may trigger the gathering and transmitting of the collected data points once an end-user response request has been received. The prompt endpoint 150 may gather the end-user response and the collected data points and format theses into a response message 134. The prompt endpoint may transmit 310 the response message, including the collected data points, to the authentication service 120.

[0095] The authentication service 120 may receive 311 the response message, including the collected data points.

[0096] The authentication service 120 may process 312 the collected data points. The data points may be processed in the context of the initial data points associated with the requested action. Processing the collected data points in the context of the initial data points associated with the requested action may include one or both of: comparing an internet protocol (IP) address of a computing device from which the requested action originates with an IP address received from the endpoint from which the collected data was received; comparing a geographical location of a computing device from which the requested action originates with a geographical location of the endpoint from which the collected data was received. Such computing device where the requested action originates may be the initiating endpoint 102. Such endpoint from which the collected data was received may be the prompt endpoint 150.

[0097] Previously collected data points may be used to determine expected patterns. Other data points, including the initial data points associated with the requested action, may be used to determine expected patterns. Processing the collected data points may include comparing the collected data points against expected patterns.

[0098] The authentication service 120 may determine 313 an updated authentication activity requirement. The authentication service may use the processed collected data points 154 (or an output generated by processing the collected data points), together with the end-user response 152 to determine the updated authentication activity requirement. The authentication service 120 may, in some scenarios (e.g., based on the output generated by processing the collected data points) ignore the response from the end-user response in determining the updated authentication activity requirement. This may for example be if the output indicates a high risk factor associated with the requested activity. This may for example be by virtue of one or more red flags present in the collected data points (e.g. microphone active / not available), and / or by virtue of a discrepancy between the collected data points and the expected patterns, or the like. The authentication service 120 in some scenarios may, counter intuitively, decline the requested action even if an approval of the requested action was the end-user response.

[0099] The authentication service may implement 314 the updated authentication activity requirement. The updated authentication activity requirement may require that a further prompt for an end-user response is required. The updated authentication activity requirement may require that the requested action be referred for security investigations. The updated authentication activity requirement may require an end-user proximity check. The updated authentication activity requirement may require a delay in the requested action. The updated authentication activity requirement may require further silent data point collection.

[0100] The authentication service 120 may thus act based on or in accordance with the updated authentication activity requirement to further process the requested action. If the requirement is a refusal, the requested action may be refused. If the requirement is an approval, the requested action is permitted or allowed to be performed.

[0101] Schematic diagrams of an example system for authentication of a requested action for account security are shown in Figures 4A, 4B and 5.

[0102] Figure 4A shows an example system including a computing device 401 providing or in the form of an initiating endpoint 102. The computing device 401 may include a processor 409 for executing the functions of components described below, which may be provided by hardware or by software units executing on the computing device 401 . The software units may be stored in a memory component 408 and instructions may be provided to the processor 409 to carry out the functionality of the described components. In some cases, for example in a cloud computing implementation, software units arranged to manage and / or process data on behalf of the computing device 401 may be provided remotely. Some or all of the components may be provided by a software application downloadable onto and executable on the computing device 401 .

[0103] The computing device 401 may include an initial endpoint application 418. The initial endpoint application 418 may be an application with which an end-user interacts in the process of initiating a requested action. The initial endpoint application 418 may provide or cause generation of the requested action notification, which may further include the initial data points 104 and / or the requested action details 417. The initial data points 104 may be initiating endpoint data points 415 related to the initiating endpoint 102.

[0104] The computing device 401 may include multiple components for carrying out the functionality of the initiating endpoint 102. The computing device 401 may include a data point obtaining component 402 arranged to obtain data points on the endpoint. The initiating endpoint data points 415 may be data points obtained before the requested action is initiated. The initiating endpoint data points 415 may be data points obtained only once the requested action has been initiated. The data points may be stored as initial data points 104. The data points obtained at the initiating endpoint may form part of a larger set of initial data points which are used to determine an initial authentication activity requirement.

[0105] The computing device 401 may include a requested action details compiling component 403 arranged to compile a requested action details 417 (or at least a subset of requested action details), which may be details associated with the requested action.

[0106] The computing device 401 may include a requested action generating component 404 arranged to generate the requested action notification 106. The requested action notification may include the initial data points 104 and requested action details 417 which may include the details and initial data points associated with the requested action. The computing device 401 may include a requested action transmitting component 405 arranged to transmit the requested action notification to the authentication service 120.

[0107] Figure 4B shows an example embodiment of a system including the authentication service 120. The authentication service may be hosted on an authentication service server 460. The authentication service server 460 may include a processor 461 and a memory component 462 for executing the functions of components described below, which may be provided by hardware or by software units executing on the authentication service server 460.

[0108] The authentication service 120 may include a requested action notification receiving component 471 arranged to receive notification of a requested action from the initiating endpoint 102. The notification may include information associated with an account, such as an end-user account. Additionally, the authentication service 120 may include a response message receiving component 474 arranged to receive a response message from the prompt endpoint 150. The response message may include the end-user response which may indicate either approval of or refusal to approve the requested action. The end-user response may include data points collected at the prompt endpoint 150.

[0109] A data point receiving component 472 may be arranged to receive data points from the initiating endpoint 102 or the prompt endpoint 150. The data point receiving component 472 may be arranged into an initial data point receiving component and a collected data point receiving component.

[0110] The data point receiving component 472 may also be arranged to receive or extract data points from the requested action notification receiving component 471 if the data points are packaged into the requested action notification. The data point receiving component 472 may also be arranged to receive or extract data points from the response message receiving component 474 if the data points are packaged into the response message.

[0111] The authentication service 120 may include an authentication activity requirement determining component 473 arranged to determine an authentication activity requirement using the end-user prompt response and / or collected data points from the initiating endpoint and / or collected data points from the prompt endpoint.

[0112] The authentication service 120 may include a prompt generating component 477 arranged to generate an end-user prompt. The prompt generating component 477 may configure the prompt into a format suitable for transmission to the prompt endpoint 150.

[0113] The authentication service 120 may include a prompt transmitting component 475 arranged to transmit an authentication activity requirement to the prompt endpoint 150. Additionally, the prompt transmitting component 475 may be arranged to transmit an end-user prompt. The transmitted authentication activity requirement and / or end-user prompt may be associated with an account associated with an end-user.

[0114] The authentication service 120 may include a proximity based authentication component 476 arranged to carry out a proximity-based authentication step to confirm that the prompt endpoint is physically proximate the initiating endpoint. In an example, the proximity based authentication component 476 may generate a unique code that may be transmitted to the initiating endpoint 102 or the prompt endpoint 150 in order to be made accessible to the end-user. The end-user may then input the code into either one of the other of the initiating endpoint 102 or the prompt endpoint 150.

[0115] The authentication service 120 may include a data point processing component 480 arranged to process data points received from the initiating endpoint 102 and / or the prompt endpoint 150. The processed data points may be provided to the authentication activity requirement determining component 473.

[0116] The data point processing component 480 may include processing the collected data points in the context of the initial data points associated with the requested action. The data point processing component 480 may further include an address comparing component 481 , a geographical comparing component 482, and a pattern comparing component 483. The address comparing component 481 may be arranged to compare an IP address of a computing device from which the requested action originates, such as the initiating endpoint 102, with an IP address received from the prompt endpoint 150.

[0117] The geographical comparing component 482 may be arranged to compare a geographical location of a computing device from which the requested action originates, such as the initiating endpoint 102, with a geographical location of the endpoint.

[0118] The pattern comparing component 483 may be arranged to compare the collected data points, from the initiating endpoint 102 and / or the prompt endpoint 150, against expected patterns determined for the collected data points based on one or both of previously collected data points and the initial data points associated with the requested action.

[0119] Figure 4C shows an example system including a computing device 451 providing or in the form of the prompt endpoint 150. The computing device 451 may include a processor 452 and a memory component 454 for executing the functions of components described below, which may be provided by hardware or by software units executing on the computing device 451 .

[0120] The computing device 451 may include a prompt endpoint application 422. The prompt endpoint application 422 may be an application with which an end-user interacts in the process of responding to an end-user prompt. The prompt endpoint application 422 may be arranged to execute on the computing device 451. The prompt endpoint application 422 may collect data points in response to receiving the end-user prompt. The collected data points may be predefined data points. The prompt endpoint application 422 may be arranged to collect the data points over a period of time.

[0121] The prompt endpoint application 422 may be include components to obtain and transmit the enduser response 152 and collected data points 154.

[0122] The computing device 451 may include a message transmitting and receiving component 424 arranged to transmit a response message to the authentication service 120. The message transmitting and receiving component 424 may further be arranged to receive an end-user response request from the authentication service 120.

[0123] The computing device 451 may include a prompt output component 426 arranged to output a prompt output at the prompt endpoint 150. The prompt output component 426 may obtain the end-user prompt 151 from the message transmitting and receiving component 424. The prompt output may be a prompt that is displayed to the end-user on a display via a graphical user interface (GUI). The prompt output may be configured to not display anything to the end-user when silently collecting data points.

[0124] The computing device 451 may include a proximity based authentication component 428 arranged to carry out a proximity-based authentication step to confirm that the prompt endpoint 150 is physically proximate the initiating endpoint 102. The proximity based authentication component 428 may be arranged to receive a proximity response via a GUI.

[0125] The computing device 451 may include a response component 430 arranged to obtain the enduser response 152 to the prompt when the response is input into the prompt endpoint 150. The response component 430 may format the prompt response for further transmission to the message transmitting and receiving component 424.

[0126] The computing device 451 may include a data point collecting component 432 arranged to collect data points at the prompt endpoint 150 and store them as collected data points 154. The data point collecting component 432 may constantly or periodically collect data points even when an end-user response request has not been transmitted to the prompt endpoint 150. The prompt endpoint application 422 may constantly trigger the data point collecting component 432 to collect data points from the prompt endpoint data points 440. Alternatively, the data point collecting component 432 may collect data points only during the time period from when an end-user response request has been received at the prompt endpoint 150 until the end-user response is input into the prompt endpoint 150.

[0127] Prompt endpoint data points 440 may include data points acquired from sensors 442, log files 444, and / or configuration files 446. The data points may be collected by the data point collecting component 432.

[0128] All data generated or available within a component in the prompt endpoint application 422 may be accessible by any other component within the application 422.

[0129] In one example, a requested action may be associated with a particular geographic location (e.g., the requested action may relate to a transaction for a product or service occurring in a particular country and / or or an amount in a particular currency of that country). Data points collected from a secondary endpoint in response to initiation of the requested action may indicate a geographic location of a particular country. If the country associated with the requested action and the country associated with the collected data points is the same, the requested action may be allowed to proceed. Otherwise, the requested action may be refused. This may be despite receiving an enduser approval of the requested action.

[0130] In another example, a requested action may be initiated from an endpoint using an application being a web browser. Initial data points may indicate the browser version; the IP address; the geographic location of the endpoint. Data points collected from a secondary endpoint (such as predefined data points) in response to initiation of the requested action may include a geographic location. If the geographic location associated with the requested action and the geographic location associated with the collected data points is the same, the requested action may be allowed to proceed. Otherwise, the requested action may be refused. This may be despite receiving an end-user approval of the requested action.

[0131] In another example, an end-user response may be received which indicates end-user approval of a requested action. However, data points collected from a secondary endpoint in response to initiation of the requested action may include microphone information indicating that the microphone of the endpoint is active or not available (indicating the end-user is on a call at the time of the data point collection). Such an indication may indicate that the end-user is being manipulated into inputting an approval of the requested action by a fraudster who is on the phone to the end-user. In such a case, the requested action may be refused, despite the end-user approval thereof. This may be despite receiving an end-user approval of the requested action.

[0132] Therefore, the consent or approval of the end-user is potentially less important than the data points that may be collected. In this manner, the end-user may be protected from manipulation by ignoring their consent or approval in circumstances where the data points indicate risky behaviour.

[0133] Aspects of the present disclosure trigger a challenge (e.g., in the form of a response request) to collect endpoint data points, and not only an end-user response. These data points may then be input into a further risk evaluation. Although the challenge may collect end-user feedback in some cases in the form of approval, that approval (if collected) may be ignored based on an evaluation of the data points. In this manner, the end-user may be protected from manipulation by ignoring their approval in circumstances where the signals indicate risky behaviour. In this manner, aspects of the present disclosure may go further than simply “making sure the end-user approves” and may instead infer whether “the end-user knows what they are doing”. For example, end-user approval may be ignored when it is inferred that the end-user is being duped. Contrary to trends currently prevalent, which typically keep adding further steps required to be taken by the end-user when a risk score is high, aspects of the present disclosure look beyond end-user approval for example by collecting further data points and weighing these more heavily than the actual response from the end-user. In other words, instead of just making sure that the end-user has been asked, the present disclosure makes sure that the end-user knows what they are doing. Thus, end-user approval may actually be ignored if the system determines that the end-user is compromised, or if they are being “duped”. In some examples, a challenge is presented for additional risk data points, rather than (or disguised as) end-user approval.

[0134] Figure 5 illustrates an example of a computing device 500 in which various aspects of the disclosure may be implemented. The computing device 500 may be embodied as any form of data processing device including a personal computing device (e.g. laptop or desktop computer), a server computer (which may be self-contained, physically distributed over a number of locations), a client computer, or a communication device, such as a mobile phone (e.g. cellular telephone), satellite phone, tablet computer, personal digital assistant or the like. Different embodiments of the computing device may dictate the inclusion or exclusion of various components or subsystems described below.

[0135] The computing device 500 may be suitable for storing and executing computer program code. The various participants and elements in the previously described system diagrams may use any suitable number of subsystems or components of the computing device 500 to facilitate the functions described herein. The computing device 500 may include subsystems or components interconnected via a communication infrastructure 505 (for example, a communications bus, a network, etc.). The computing device 500 may include one or more processors 510 and at least one memory component in the form of computer-readable media. The one or more processors 510 may include one or more of: CPUs, graphical processing units (GPUs), microprocessors, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs) and the like. In some configurations, a number of processors may be provided and may be arranged to carry out calculations simultaneously. In some implementations various subsystems or components of the computing device 500 may be distributed over a number of physical locations (e.g. in a distributed, cluster or cloud-based computing configuration) and appropriate software units may be arranged to manage and / or process data on behalf of remote devices.

[0136] The memory components may include system memory 515, which may include read only memory (ROM) and random access memory (RAM). A basic input / output system (BIOS) may be stored in ROM. System software may be stored in the system memory 515 including operating system software. The memory components may also include secondary memory 520. The secondary memory 520 may include a fixed disk 521 , such as a hard disk drive, and, optionally, one or more storage interfaces 522 for interfacing with storage components 523, such as removable storage components (e.g. magnetic tape, optical disk, flash memory drive, external hard drive, removable memory chip, etc.), network attached storage components (e.g. NAS drives), remote storage components (e.g. cloud-based storage) or the like.

[0137] The computing device 500 may include an external communications interface 530 for operation of the computing device 500 in a networked environment enabling transfer of data between multiple computing devices 500 and / or the Internet. Data transferred via the external communications interface 530 may be in the form of signals, which may be electronic, electromagnetic, optical, radio, or other types of signal. The external communications interface 530 may enable communication of data between the computing device 500 and other computing devices including servers and external storage facilities. Web services may be accessible by and / or from the computing device 500 via the communications interface 530.

[0138] The external communications interface 530 may be configured for connection to wireless communication channels (e.g., a cellular telephone network, wireless local area network (e.g. using Wi-Fi™), satellite-phone network, Satellite Internet Network, etc.) and may include an associated wireless transfer element, such as an antenna and associated circuitry. The external communications interface 530 may include a subscriber identity module (SIM) in the form of an integrated circuit that stores an international mobile subscriber identity and the related key used to identify and authenticate a subscriber using the computing device 500. One or more subscriber identity modules may be removable from or embedded in the computing device 500.

[0139] The computer-readable media in the form of the various memory components may provide storage of computer-executable instructions, data structures, program modules, software units and other data. A computer program product may be provided by a computer-readable medium having stored computer-readable program code executable by the central processor 510. A computer program product may be provided by a non-transient or non-transitory computer- readable medium, or may be provided via a signal or other transient or transitory means via the communications interface 530.

[0140] Interconnection via the communication infrastructure 505 allows the one or more processors 510 to communicate with each subsystem or component and to control the execution of instructions from the memory components, as well as the exchange of information between subsystems or components. Peripherals (such as printers, scanners, cameras, or the like) and input / output (I / O) devices (such as a mouse, touchpad, keyboard, microphone, touch-sensitive display, input buttons, speakers and the like) may couple to or be integrally formed with the computing device 500 either directly or via an I / O controller 535. One or more displays 545 (which may be touch- sensitive displays) may be coupled to or integrally formed with the computing device 500 via a display or video adapter 540.

[0141] The computing device 500 may include a geographical location element 555 which is arranged to determine the geographical location of the computing device 500. The geographical location element 555 may for example be implemented by way of a global positioning system (GPS), or similar, receiver module. In some implementations the geographical location element 555 may implement an indoor positioning system, using for example communication channels such as cellular telephone or Wi-Fi™ networks and / or beacons (e.g. Bluetooth™ Low Energy (BLE) beacons, iBeacons™, etc.) to determine or approximate the geographical location of the computing device 500. In some implementations, the geographical location element 555 may implement inertial navigation to track and determine the geographical location of the communication device using an initial set point and inertial measurement data.

[0142] The foregoing description has been presented for the purpose of illustration; it is not intended to be exhaustive or to limit the technology to the precise forms disclosed. Persons skilled in the relevant art can appreciate that many modifications and variations are possible in light of the above disclosure.

[0143] Any of the steps, operations, components or processes described herein may be performed or implemented with one or more hardware or software units, alone or in combination with other devices. Components or devices configured or arranged to perform described functions or operations may be so arranged or configured through computer-implemented instructions which implement or carry out the described functions, algorithms, or methods. The computer- implemented instructions may be provided by hardware or software units. In one embodiment, a software unit is implemented with a computer program product comprising a non-transient or non- transitory computer-readable medium containing computer program code, which can be executed by a processor for performing any or all of the steps, operations, or processes described. Software units or functions described in this application may be implemented as computer program code using any suitable computer language such as, for example, Java™, C++, or Perl™ using, for example, conventional or object-oriented techniques. The computer program code may be stored as a series of instructions, or commands on a non-transitory computer-readable medium, such as a random access memory (RAM), a read-only memory (ROM), a magnetic medium such as a hard-drive, or an optical medium such as a CD-ROM. Any such computer-readable medium may also reside on or within a single computational apparatus, and may be present on or within different computational apparatuses within a system or network. Flowchart illustrations and block diagrams of methods, systems, and computer program products according to embodiments are used herein. Each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, may provide functions which may be implemented by computer readable program instructions. In some alternative implementations, the functions identified by the blocks may take place in a different order to that shown in the flowchart illustrations.

[0144] Some portions of this description describe the examples in terms of algorithms and symbolic representations of operations on information. These algorithmic descriptions and representations, such as accompanying flow diagrams, are commonly used by those skilled in the data processing arts to convey the substance of their work effectively to others skilled in the art. These operations, while described functionally, computationally, or logically, are understood to be implemented by computer programs or equivalent electrical circuits, microcode, or the like. The described operations may be embodied in software, firmware, hardware, or any combinations thereof.

[0145] The language used in the specification has been principally selected for readability and instructional purposes, and it may not have been selected to delineate or circumscribe the inventive subject matter. It is therefore intended that the scope of the present disclosure be limited not by this detailed description, but rather by any claims that issue on an application based hereon. Accordingly, the present disclosure is intended to be illustrative, but not limiting, of the scope of any accompanying claims.

[0146] Finally, throughout the specification and any accompanying claims, unless the context requires otherwise, the word ‘comprise’ or variations such as ‘comprises’ or ‘comprising’ will be understood to imply the inclusion of a stated integer or group of integers but not the exclusion of any other integer or group of integers.

Claims

CLAIMS1. A computer-implemented method for authentication of a requested action for account security, comprising: receiving notification of a requested action associated with an account, the action being initiated using an initiating endpoint; in response to determining, based on initial data points associated with the requested action, an initial authentication activity requirement which requires an end-user response, transmitting an end-user prompt to a prompt endpoint associated with the account; receiving, from the prompt endpoint, a response message including the end-user response which indicates approval of the requested action and which includes data points collected from the prompt endpoint; and, processing the collected data points to determine an updated authentication activity requirement, wherein the updated authentication activity requirement includes a requirement to decline or further verify the requested action despite the end-user response message indicating approval of the action.

2. The method of claim 1 , including receiving the initial data points from the initiating endpoint and, in response to receiving the notification of the requested action, processing the initial data points associated with the requested action to determine the initial authentication activity requirement.

3. The method of claim 1 or 2, wherein the initial and updated authentication activity requirements are determined from requirements including: a requirement to approve the requested action without authentication activity; a requirement to decline the requested activity; a requirement to delay initiation of the requested action; a requirement to request an end-user response; a requirement to request end-user proximity confirmation; a requirement to refer the requested action to a security investigation; or, a requirement to silently collect data points.

4. The method of any one of the preceding claims, wherein the requirement to further verify the requested action initiates a proximity-based authentication to confirm that the prompt endpoint is physically proximate the initiating endpoint.

5. The method of any one of the preceding claims, wherein the requirement to further verify the requested action includes requiring further end-user participation or delaying initiation of the requested action.

6. The method of any one of the preceding claims, wherein the initiating endpoint and the prompt endpoint are provided in a single computing device or in different user computing devices.

7. The method of any one of the preceding claims, wherein the prompt endpoint is a registered endpoint having previously been registered with or against the account.

8. The method of any one of the preceding claims, wherein the prompt endpoint is an out-of- band endpoint.

9. The method of any one of the preceding claims, wherein the collected data points include any one or more of the group of: a microphone active / inaccessible indicator; internet protocol (IP) address; geographic location obtained from a geographical location element; endpoint application version; operating system version; endpoint details; an endpoint identifier; endpoint cell tower data information; endpoint uptime, and the like.

10. The method of any one of the preceding claims, wherein processing the collected data points includes processing the collected data points in the context of the initial data points associated with the requested action.1 1 . The method of claim 10, wherein processing the collected data points in the context of the initial data points associated with the requested action includes one or both of: comparing an IP address of the initiating endpoint with an IP address received from the prompt endpoint; and, comparing a geographical location of the initiating endpoint with a geographical location of the prompt endpoint.

12. The method of any one of the preceding claims, wherein processing the collected data points includes comparing the collected data points against expected patterns determined for the collected data points based on one or both of previously collected data points and the initial data points associated with the requested action.

13. The method of any one of the preceding claims, wherein the end-user prompt causes the prompt endpoint to collect data points in response to receiving the end-user prompt.

14. A system for authentication of a requested action for account security, the system comprising: a non-transitory computer-readable storage medium; and one or more processors coupled to the non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium comprises program instructions that, when executed on theone or more processors, cause the system to perform operations comprising: receiving notification of a requested action associated with an account, the action being initiated using an initiating endpoint; in response to determining, based on initial data points associated with the requested action, an initial authentication activity requirement which requires an end-user response, transmitting an end-user prompt to a prompt endpoint associated with the account; receiving, from the prompt endpoint, a response message including the end-user response which indicates approval of the requested action and which includes data points collected from the prompt endpoint; and, processing the collected data points to determine an updated authentication activity requirement, wherein the updated authentication activity requirement includes a requirement to decline or further verify the requested action despite the end-user response message indicating approval of the action.

15. The system of 14, including a computing device providing the initiating endpoint, comprising: an initiating endpoint non-transitory computer-readable storage medium; and one or more initiating endpoint processors coupled to the initiating endpoint non-transitory computer- readable storage medium, wherein the initiating endpoint non-transitory computer-readable storage medium comprises program instructions that, when executed on the one or more initiating endpoint processors, cause the initiating endpoint to perform operations comprising: obtaining a set of initial data points at the initiating endpoint; compiling a set of requested action details; generating a requested action notification using the initial data points and requested action details; and, transmitting the requested action notification to an authentication service.

16. The system of 15, including a computing device providing the prompt endpoint, comprising: a prompt endpoint non-transitory computer-readable storage medium; and one or more prompt endpoint processors coupled to the prompt endpoint non-transitory computer- readable storage medium, wherein the prompt endpoint non-transitory computer-readable storage medium comprises program instructions that, when executed on the one or more prompt endpoint processors, cause the prompt endpoint to perform operations comprising: receiving an end-user response request from the authentication service; outputting the end-user prompt to the end-user; obtaining an end-user response from the end-user prompt; collecting a predefined list of data points at the prompt endpoint over a period of time; and, transmitting, to the authentication service, a response message comprising the end-userresponse and collected data points.

17. The system of claim 16, including an endpoint application executing on the prompt endpoint and configured to collect the data points in response to receiving the end-user prompt.

18. The system of claim 17, wherein the endpoint application is configured to collect the data points over a period of time, including over a period of time commencing when the end-user prompt is received and terminating when the end-user response is input.

19. A computer program product for authentication of a requested action for account security, the computer program product comprising a computer-readable medium having stored computer- readable program code for performing the steps of: receiving notification of a requested action associated with an account, the action being initiated using an initiating endpoint; in response to determining, based on initial data points associated with the requested action, an initial authentication activity requirement which requires an end-user response, transmitting an end-user prompt to a prompt endpoint associated with the account; receiving, from the prompt endpoint, a response message including the end-user response which indicates approval of the requested action, and which includes data points collected from the prompt endpoint; and, processing the collected data points to determine an updated authentication activity requirement, wherein the updated authentication activity requirement includes a requirement to decline or further verify the requested action despite the end-user response message indicating approval of the action.

Images