Patent ID: 8806591
Filing Date: 2014-08-12
Classification: G06F

Abstract:
1. A system comprising: a computer server having a processor and a memory, the server configured to: receive an authentication request that identifies one or more authentication form factors, and for each form factor identified, further identifies at least one parameter; generate a risk score for the authentication request using the parameter, the risk score being based at least in part on a complexity associated with each of the one or more authentication form factors and on an upper bound on a number of guesses that an attacker may make to recover a token before the attacker is locked out from additional attacks, the upper bound based on a lockout time and at least one of a token lifetime, an attempt number, or lockout strikes, the lockout time being a time period for which a lockout will apply; provide the risk score to a requester; and when the upper bound is based on the lockout time, token lifetime and lockout strikes, compute the upper bound by dividing a product of the token lifetime and the lockout strikes by the lockout time.