Systems and methods for completing multi-factor authentication via mobile devices

The disclosed computer-implemented method for completing multi-factor authentication via mobile devices may include (1) identifying a request to communicate with a user's mobile device to complete multi-factor authentication of the user to an online service, (2) determining that authentication notifications are disabled for attempts made by the user to login to the online service, (3) preventing an authentication notification from being displayed on the user's mobile device, (4) receiving an out-of-band authentication communication from a mobile device, (5) determining that the mobile device that sent the out-of-band authentication communication is the user's mobile device and is therefore trusted to complete the multi-factor authentication of the user to the online service, and (6) enabling the user to login to the online service and automatically receive future notification. Various other methods, systems, and computer-readable media are also disclosed.

BACKGROUND

Security is often described as a continuum between convenience and safety. A system that requires ten layers of authentication may be very difficult to attack, but it may also be so inconvenient that it will never be used. At the opposite end, a system with no means of authentication or authorization is highly convenient for users but also highly insecure. Many systems now offer an option for two factor authentication, which requires an additional piece of information beyond or in place of the traditional username and password combination. Some two factor authentication systems may involve additional devices such as mobile phones and tablets. These two factor authentication systems may ask the user to enter a code sent to a mobile device or to take an action on the mobile device that is then transmitted back to an authentication server to complete the login process.

One downside of two factor authentication systems that involve mobile devices is that repeated illegitimate login attempts by malicious third parties may cause a flood of notifications to the mobile device, annoying users. Some traditional systems may allow a user to block notifications from being pushed to their mobile device. However, in these systems the user may be unaware that notifications are now being blocked and may become frustrated by the failure of their subsequent login attempts. Accordingly, the instant disclosure identifies and addresses a need for additional and improved systems and methods for completing multi-factor authentication via mobile devices.

SUMMARY

As will be described in greater detail below, the instant disclosure describes various systems and methods for completing multi-factor authentication via mobile devices by determining that authentication notifications are blocked for a mobile device, receiving a manually triggered communication from the mobile device confirming the authentication, and enabling completion of the multi-factor authentication process after receiving the communication from the mobile device. The systems described herein may also re-enable authentication notifications for the mobile device in response to receiving the manually triggered communication.

In one example, a computer-implemented method for completing multi-factor authentication via mobile devices may include (1) identifying a request to communicate with a user's mobile device to complete multi-factor authentication of the user to an online service, (2) determining that authentication notifications are disabled for attempts made by the user to login to the online service, (3) in response to determining that authentication notifications are disabled, preventing an authentication notification from being displayed on the user's mobile device, (4) receiving an out-of-band authentication communication from a mobile device, (5) determining that the mobile device that sent the out-of-band authentication communication is the user's mobile device and is therefore trusted to complete the multi-factor authentication of the user to the online service, and (6) in response to determining that the out-of-band authentication communication was received from a device trusted to complete the multi-factor authentication of the user to the online service, enabling the user to login to the online service.

In some examples, enabling the user to login to the online service may include enabling authentication notifications for attempts made by the user to login to the online service. Additionally or alternatively, the computer-implemented method may further include enabling authentication notifications for attempts made by the user to login to the online service in response to receiving a request from the user via the user's mobile device to enable authentication notifications.

In one embodiment, the computer-implemented method may further include displaying, at a web browser used by the user to initiate the multifactor authentication, a message that indicates that authentication notifications are disabled for attempts made by the user to login to the online service. For example, the message may be displayed on the login page of the online service. In some examples, the message may include instructions for the user to complete an out-of-band authentication action using a trusted device.

In some embodiments, preventing the authentication notification from being displayed on the mobile device may include queuing the authentication notification. In some examples, the computer-implemented method may further include expiring the queued authentication notification based on (1) receiving an additional authentication notification from the online service and/or (2) exceeding a predetermined time threshold for holding authentication notifications in the queue.

In one embodiment, the computer-implemented method may further include disabling authentication notifications for attempts made by the user to login to the online service in response to receiving a number of authentication requests from the online service that exceeds a predetermined threshold for authentication requests. Additionally or alternatively, the computer-implemented method may further include disabling authentication notifications for attempts made by the user to login to the online service in response to receiving a request from the user's mobile device to disable authentication notifications for the online service.

In one embodiment, the computer-implemented method may further include (1) identifying an additional request to communicate with the user's mobile device to complete multi-factor authentication of the user to the online service, (2) determining that authentication notifications are enabled for attempts made by the user to login to the online service, (3) in response to determining that authentication notifications are enabled, sending an authentication notification to the user's mobile device for display on the user's mobile device, (4) receiving an authentication communication from the user's mobile device sent in response to the authentication notification, and (5) in response to determining that the authentication communication was sent in response to the authentication notification, enabling the user to login to the online service.

In some examples, enabling the user to login to the online service may include automatically completing the multi-factor authentication of the user to the online service in response to receiving the out-of-band authentication communication from the mobile device and determining that the out-of-band authentication communication was received from a device that is trusted to complete the multi-factor authentication. In one embodiment, the out-of-band authentication communication from the mobile device may include a communication sent from an application on the mobile device that is associated with the multi-factor authentication of the user to the online service, and the out-of-band authentication communication may be sent in response to the user accessing the application on the mobile device.

In one embodiment, a system for implementing the above-described method may include (1) an identification module, stored in memory, that identifies a request to communicate with a user's mobile device to complete multi-factor authentication of the user to an online service, (2) a notification determination module, stored in memory, that determines that authentication notifications are disabled for attempts made by the user to login to the online service, (3) a prevention module, stored in memory, that prevents, in response to determining that authentication notifications are disabled, an authentication notification from being displayed on the user's mobile device, (4) a receiving module, stored in memory, that receives an out-of-band authentication communication from a mobile device, (5) a device determination module, stored in memory, that determines that the mobile device that sent the out-of-band authentication communication is the user's mobile device and is therefore trusted to complete the multi-factor authentication of the user to the online service, (6) an enabling module, stored in memory, that, in response to determining that the out-of-band authentication communication was received from a device trusted to complete the multi-factor authentication of the user to the online service, enables the user to login to the online service, and (7) at least one physical processor configured to execute the identification module, the notification determination module, the prevention module, the receiving module, the device determination module, and the enabling module.

In some examples, the above-described method may be encoded as computer-readable instructions on a non-transitory computer-readable medium. For example, a computer-readable medium may include one or more computer-executable instructions that, when executed by at least one processor of a computing device, may cause the computing device to (1) identify a request to communicate with a user's mobile device to complete multi-factor authentication of the user to an online service, (2) determine that authentication notifications are disabled for attempts made by the user to login to the online service, (3) prevent, in response to determining that authentication notifications are disabled, an authentication notification from being displayed on the user's mobile device, (4) receive an out-of-band authentication communication from a mobile device, (5) determine that the mobile device that sent the out-of-band authentication communication is the user's mobile device and is therefore trusted to complete the multi-factor authentication of the user to the online service, and (6) in response to determining that the out-of-band authentication communication was received from a device trusted to complete the multi-factor authentication of the user to the online service, enable the user to login to the online service.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

The present disclosure is generally directed to systems and methods for completing multi-factor authentication via mobile devices. As will be explained in greater detail below, by completing the multi-factor authentication process after receiving an out-of-band communication from a mobile device, the systems described herein may enable a user to complete a login process via their mobile device despite authentication notifications being turned off for the mobile device. Additionally, the systems described herein may re-enable authentication notifications for the mobile device after a successful authentication is completed, allowing a user to more conveniently complete future logins. The systems described herein may also display a message indicating the status of authentication notifications in a browser during the login process, informing the user that they must send an out-of-band communication and increasing the convenience and transparency of the multi-factor authentication process.

The following will provide, with reference toFIGS. 1, 2, and 4, detailed descriptions of exemplary systems for completing multi-factor authentication via mobile devices. Detailed descriptions of corresponding computer-implemented methods will also be provided in connection withFIGS. 3 and 5. In addition, detailed descriptions of an exemplary computing system and network architecture capable of implementing one or more of the embodiments described herein will be provided in connection withFIGS. 6 and 7, respectively.

FIG. 1is a block diagram of exemplary system100for completing multi-factor authentication via mobile devices. As illustrated in this figure, exemplary system100may include one or more modules102for performing one or more tasks. For example, and as will be explained in greater detail below, exemplary system100may include an identification module104that may identify a request to communicate with a user's mobile device to complete multi-factor authentication of the user to an online service. Exemplary system100may additionally include a notification determination module106that may determine that authentication notifications are disabled for attempts made by the user to login to the online service. Exemplary system100may also include a prevention module108that may prevent, in response to determining that authentication notifications are disabled, an authentication notification from being displayed on the user's mobile device.

Exemplary system100may additionally include a receiving module110that may receive an out-of-band authentication communication from a mobile device. Exemplary system100may also include a device determination module112that may determine that the mobile device that sent the out-of-band authentication communication may be the user's mobile device and may therefore be trusted to complete the multi-factor authentication of the user to the online service. Exemplary system100may additionally include an enabling module114that may, in response to determining that the out-of-band authentication communication was received from a device designated to complete the multi-factor authentication of the user to the online service, enable the user to login to the online service. Although illustrated as separate elements, one or more of modules102inFIG. 1may represent portions of a single module or application.

Exemplary system100inFIG. 1may be implemented in a variety of ways. For example, all or a portion of exemplary system100may represent portions of exemplary system200inFIG. 2. As shown inFIG. 2, system200may include a computing system202in communication with a mobile device206via a network204. In one example, computing system202may be programmed with one or more of modules. Additionally or alternatively, mobile device206may be programmed with one or more of modules102.

In one embodiment, one or more of modules102fromFIG. 1may, when executed by at least one processor of computing system202and/or mobile device206, enable computing system202and/or mobile device206to complete multi-factor authentication via mobile devices. For example, and as will be described in greater detail below, identification module104may identify a request to communicate with a user's mobile device206to complete multi-factor authentication210of user208to an online service212. Next, notification determination module106may determine that authentication notifications are disabled for attempts made by user208to login to online service212. Prevention module108may prevent, in response to determining that authentication notifications are disabled, an authentication notification214from being displayed on user's mobile device206.

Despite authentication notification214being prevented, receiving module110may receive an authentication communication216from a mobile device218(e.g., the user may perform an action on mobile device218that triggers transmission of authentication communication216). Device determination module112may determine that mobile device218that sent authentication communication216is user's mobile device206and is therefore trusted to complete multi-factor authentication210of user208to online service212. Finally, enabling module114may, in response to determining that authentication communication216was received from a device trusted to complete multi-factor authentication210of user208to online service212, enable user208to login to online service212.

Computing system202generally represents any type or form of computing device or group of connected computing devices capable of reading computer-executable instructions. In some examples, computing system202may represent systems hosted on a variety of computing devices. For example, computing system202may include authentication servers and/or systems configured to process multi-factor authentication attempts, push notification systems configured to send notifications to mobile devices, and/or online services. Examples devices that may make up computing system202include, without limitation, laptops, tablets, desktops, servers, application servers, database servers, embedded systems, gaming consoles, combinations of one or more of the same, exemplary computing system610inFIG. 6, or any other suitable computing device.

Mobile device206generally represents any type or form of portable computing device capable of reading computer-executable instructions. Examples of mobile device206include, without limitation, laptops, tablets, e-readers, cellular phones, smart phones, Personal Digital Assistants (PDAs), wearable devices (e.g., smart watches, smart glasses, etc.), and/or combinations of one or more of the same. In some embodiments, mobile device206may include an application that provides an interface allowing a user to initiate an out-of-band authentication to receiving module110. Other out-of-band communication methods may be also used from mobile device206.

FIG. 3is a flow diagram of an exemplary computer-implemented method300for completing multi-factor authentication via mobile devices. The steps shown inFIG. 3may be performed by any suitable computer-executable code and/or computing system. In some embodiments, the steps shown inFIG. 3may be performed by one or more of the components of system100inFIG. 1, system200inFIG. 2, computing system610inFIG. 6, and/or portions of exemplary network architecture700inFIG. 7.

As illustrated inFIG. 3, at step302one or more of the systems described herein may identify a request to communicate with a user's mobile device to complete multi-factor authentication of the user to an online service. For example, at step302identification module104may, as part of computing system202inFIG. 2, identify a request to communicate with user's mobile device206to complete multi-factor authentication210of user208to online service212.

The term “request,” as used herein, generally refers to any communication sent from a computing device to another computing device. In some examples, a request may be sent from a mobile device to an online service. In other examples, a request may be sent from an online service to an authentication system as part of a multi-factor authentication. Additionally or alternatively, a request may be sent by an authentication server to a mobile push service. In one example, a request may be sent by an online service indicating that an authentication system should initiate a multi-factor authentication process.

The term “multi-factor authentication,” as used herein, generally refers to any type of authentication process that involves more than one factor. In some embodiments, a multi-factor authentication process may involve multiple computing devices. For example, a multi-factor authentication process launched from a desktop computer may require a user to supply a username and/or password and may also require the user to authorize the login attempt from an additional device linked to their user account in order to log in.

The term “online service,” as used herein, generally refers to any service provided via a network, such as the Internet, an enterprise network, a wide area network, a local area network, etc. An online service may include, without limitation, a website, a news feed, an application programming interface, a file server, a messaging application, a location service, and/or any other application that may send data via the Internet.

Identification module104may identify the request in a variety of ways and/or contexts. For example, identification module104may be part of an authentication service that is configured to send a request to communicate with a user's mobile device. In another example, identification module104may be part of a mobile push service that may receive a request. In some examples, identification module104may be part of an online service configured to handle authentication for the online service. Additionally or alternatively, identification module104may intercept a request generated by a service of which identification module104is not a part.

At step304one or more of the systems described herein may determine that authentication notifications are disabled for attempts made by the user to login to the online service. For example, at step304notification determination module106may, as part of computing system202inFIG. 2, determine that authentication notifications are disabled for attempts made by user208to login to online service212.

The term “authentication notification,” as used herein, generally refers to any message designed to alert a user that an authentication attempt with their credentials is taking place. For example, an authentication notification may be sent to a mobile device in response to a login attempt on another device. In some embodiments, an authentication notification may be part of a multi-factor authentication and/or may inform a user that further action on their part is required to complete an authentication process. For example, an authentication notification may provide a user with a code to enter into a login form and/or allow a user to click a button to send a message to the authentication service.

In some examples, an authentication notification may be triggered by an illegitimate authentication attempt. For example, a malicious actor may make repeated authentication attempts to a user's account in an attempt to brute force the account credentials. In this example, a user may receive numerous authentication notifications due to the repeated authentication attempts.

Notification determination module106may determine that authentication notifications are disabled in a variety of ways and/or contexts. For example, notification determination module106may include a flag and/or switch that may be set to “on” to allow notifications and to “off” to block notifications. In some examples, notification determination module106may be part of a notification push service.

In some embodiments, notification determination module106may maintain individual switches for each online service that uses the notification system. For example, an online shopping service may have the authentication notification switch set to off while an online banking service may have the authentication notification switch set to on. Additionally or alternatively, notification determination module106may maintain individual switches on a per-device basis. For example, notifications may be disabled for a user's mobile phone but enabled for the user's tablet.

In one embodiment, the systems described herein may include a display module that displays, at a web browser used by the user to initiate the multifactor authentication, a message that indicates that authentication notifications are disabled for attempts made by the user to login to the online service. In some examples, the message may include instructions for the user to complete an out-of-band communication. In some embodiments, the systems described herein may send a message to the online service indicating that a message should be displayed to the user. Additionally or alternatively, the systems described herein may include an authentication system for the online service.

In some examples, the message may inform the user that authentications are disabled for a specific mobile device and/or may inform the user of how to continue the authentication process. In one example, the message may appear in the same web browser window that the user is using to log in to the online service. In another example, the message may appear in a pop-up window generated by the online service and/or the authentication service.

At step306one or more of the systems described herein may prevent, in response to determining that authentication notifications are disabled, an authentication notification from being displayed on the user's mobile device. For example, at step306prevention module108may, as part of computing system202inFIG. 2, prevent, in response to determining that authentication notifications are disabled, authentication notification214from being displayed on user's mobile device206.

Prevention module108may prevent the authentication notification from being displayed in a variety of ways and/or contexts. In one embodiment, prevention module108may be a part of a notification push service that may be responsible for sending authentication notifications and may prevent the authentication notification by not generating and/or not sending the authentication notification. In some embodiments, prevention module108may prevent an authentication notification by refraining from instructing a push service to send the authentication notification. In another embodiment, prevention module108may not be a part of a notification push service and may intercept an authentication notification sent by a notification push service. Additionally or alternatively, prevention module108may intercept and/or block a notification request sent by an authentication service to a notification push service.

In some examples, prevention module108may prevent the authentication notification from being displayed on the mobile device by queuing the authentication notification. In some embodiments, prevention module108may store the authentication notification in a queue at the authentication server. In another embodiment, prevention module108may store the authentication notification in a queue at the notification push service. Additionally or alternatively, prevention module108may store the authentication notification in a queue in an application on the mobile device. In some embodiments, prevention module108may queue a request that triggers an authentication notification in place of or in addition to queuing the authentication notification itself.

In some examples, systems described herein may include an expiring module that expires the queued authentication notification based on receiving an additional authentication notification from the online service and/or exceeding a predetermined time threshold for holding authentication notifications in the queue. For example, the systems described herein may hold only one authentication notification from a given online service in a queue at once and therefore may immediately expire a queued authentication notification after receiving an additional authentication notification from the same service. Additionally or alternatively, the systems described herein may expire authentication notifications after a preset time limit, such as three minutes, fifteen minutes, one hour, or one day.

At step308one or more of the systems described herein may receive an out-of-band authentication communication from a mobile device. For example, at step308receiving module110may, as part of computing system202inFIG. 2, receive an authentication communication216from mobile device218.

The term “out-of-band authentication communication,” as used herein, generally refers to any communication sent to an authentication server by a mobile device that does not directly respond to a communication sent successfully to the mobile device from the authentication server. For example, an authentication server may normally send an authentication notification to a mobile device but the authentication notification may be prevented (i.e., the authentication server may refrain from sending the notification). In this example, a user of the mobile device may manually confirm authentication via a user interface in an application in the mobile device, thereby sending or triggering an out-of-band authentication communication from the mobile device to the authentication server.

Receiving module110may receive the out-of-band authentication communication in a variety of ways. For example, receiving module110may be part of an authentication server and may receive a message directed to the authentication server by an authentication application on a mobile device.

In some embodiments, a user may send the out-of-band communication from the mobile device by enabling authentication notifications from an authentication application on the mobile device and then interacting with a queued authentication notification sent to the mobile device in response to authentication notifications being re-enabled. Additionally or alternatively, an out-of-band communication may be automatically triggered when a user opens and/or accesses an application associated with the authentication process (e.g., an application associated with the online service, an application used to perform multifactor authentication, etc.).

At step310one or more of the systems described herein may determine that the mobile device that sent the out-of-band authentication communication is the user's mobile device and is therefore trusted to complete the multi-factor authentication of the user to the online service. For example, at step310device determination module112may, as part of computing system202inFIG. 2, determine that the mobile device that sent authentication communication216is mobile device206and is therefore trusted to complete multi-factor authentication210of user208to online service212.

Device determination module112may determine that the mobile device that sent the authentication notification is trusted in a variety of ways. For example, device determination module112may match the mobile device against a list of mobile device trusted to complete multi-factor authentication operations for the user. In some examples, device determination module112may use a device identifier to determine that the mobile device that sent the authentication communication is the same mobile device to which an authentication notification would have been sent if authentication notifications were enabled. Additionally or alternatively, device determination module112may identify a token in the authentication communication that indicates that the mobile device sending the authentication communication is trusted.

At step312one or more of the systems described herein may, in response to determining that the out-of-band authentication communication was received from a device trusted to complete the multi-factor authentication of the user to the online service, enable the user to login to the online service. For example, at step312enabling module114may, as part of computing system202inFIG. 2and in response to determining that authentication communication216was received from a device designated to complete multi-factor authentication210of user208to online service212, enable user208to login to online service212.

Enabling module114may enable the user to login to the online service in a variety of ways. In some examples, enabling module114may enable the user to login to the online service by automatically completing the multi-factor authentication of the user to the online service in response to receiving the out-of-band authentication communication from the mobile device and determining that the out-of-band authentication communication was received from a device that is trusted to complete the multi-factor authentication. In these examples, receiving an authentication communication from a mobile device may be the last step of the login process.

In one embodiment, the out-of-band authentication communication from the mobile device may include a communication sent from an application on the mobile device that is associated with the multi-factor authentication of the user to the online service and the out-of-band authentication communication may be sent in response to the user accessing the application on the mobile device. For example, a user may be attempting to login to a website that may display a message informing the user that authentication notifications for the website are disabled and/or that the user may need to access an authentication application on a mobile device to complete the login process. In this example, the user may then access the authentication application and may use the authentication application to send an authentication communication. In one embodiment, a user may send an authentication communication with a one-click hot key set in a mobile device.

In some embodiments, the systems described herein may include and/or communicate with a user's computing device, a user's mobile device, an authentication server, a push service, and/or a website.FIG. 4is a block diagram of an exemplary computing system400for completing multi-factor authentication via mobile devices. As illustrated inFIG. 4, a user404may be associated with both a user's computing device402and a user's mobile device406. User404may use computing device402(e.g., a desktop computer, a laptop computer, an additional mobile device such as a tablet, etc.) to attempt to login to a website408. Website408may have multi-factor authentication enabled and may communicate with an authentication server410. Authentication server410may send a notification push request to a push service412.

In some examples, authentication server410may determine the notification status for the user's mobile device406and/or may send a message to website408instructing website408to display the notification status to user404. If authentication notifications are enabled, push service414may send an authentication notification to mobile device406. User404may then approve the authentication attempt via mobile device406and mobile device406may transmit that information to authentication server410. Authentication server410may then send a message to website408indicating that the multi-factor authentication process has been successfully completed.

The systems described herein may enable and/or disable authentication notifications sent to a mobile device on behalf of an online service in a variety of ways.FIG. 5is a flow diagram of an exemplary method for enabling or disabling authentication notifications while completing multi-factor authentication via mobile devices. As illustrated inFIG. 5, at step502, authentication notifications may be enabled. From there, authentication notifications may be disabled in several ways.

At step504, a user may manually disable authentication notifications. In some examples, systems described herein may disable authentication notifications for attempts made by the user to login to the online service in response to receiving a request from the user's mobile device to disable authentication notifications for the online service. For example, a user may access an authentication application on a mobile device and may change a setting on the authentication application to disable authentication notifications for the mobile device.

Additionally or alternatively, as shown at step506, authentication may be automatically disabled due to rate-limiting. In one embodiment, the systems described herein may disable authentication notifications for attempts made by the user to login to the online service in response to receiving a number of authentication requests from the online service that exceeds a predetermined threshold for authentication requests. In some examples, a predetermined threshold for authentication requests from an online service may be a fixed number such as three, five, or ten. In other examples, a predetermined threshold may also be based on a time component. For example, five authentication requests in the span of ten minutes may trigger the systems described herein to disable authentication notifications while five authentication requests in the span of a day may not affect whether notifications are enabled.

Additionally or alternatively, a user may disable authentication notifications in a variety of other ways such as changing a setting in an online service via a browser and/or contacting a customer service representative. In some embodiments, authentication notifications may be disabled by a disabling module configured to disable authentication notifications in any or all of the ways described above.

At step508, regardless of what method was used to disable authentication notifications, authentication notifications may be disabled. Authentication notifications may be re-enabled in any of a variety of ways.

At step510, a user may manually enable authentication notifications via a mobile device. In some examples, systems described herein may enable authentication notifications for attempts made by the user to login to the online service in response to receiving a request from the user via the user's mobile device to enable authentication notifications. For example, a user may change a setting in an authentication application on a mobile device to enable authentication notifications for the mobile device from an online service.

At step512, authentication notifications may be automatically enabled due to a successful authentication from the mobile device. In some embodiments, enabling module114may enable the user to login to the online service and may also enable authentication notifications for attempts made by the user to login to the online service. In some examples, enabling module114may always enable authentication notifications to a mobile device from an online service as a result of a successful login to the online service via the mobile device.

Additionally or alternatively, a user may enable authentication notifications in a variety of other ways such as changing a setting in an online service via a browser and/or contacting a customer service representative.

At step514, authentication notifications may be re-enabled. From there, the process may repeat and authentication notifications may be disabled and/or re-enabled any number of times in any manner.

If authentication notifications are enabled, the multi-factor authentication process may proceed differently than if authentication notifications are disabled. In one embodiment, systems described herein may perform the following steps: (1) identifying an additional request to communicate with the user's mobile device to complete multi-factor authentication of the user to the online service, (2) determining that authentication notifications are enabled for attempts made by the user to login to the online service, (3) in response to determining that authentication notifications are enabled, sending an authentication notification to the user's mobile device for display on the user's mobile device, (4) receiving an authentication communication from the user's mobile device sent in response to the authentication notification, and (5) in response to determining that the authentication communication was sent in response to the authentication notification, enabling the user to login to the online service.

As explained above in connection with method300, the systems described herein may complete multi-factor authentication via mobile devices while allowing users greater control of whether or not authentication notifications are sent to their mobile devices. A user may initiate a login attempt for a website from a computing device and may see a message indicating the status of authentication notifications from the website. If authentication notifications are disabled, a user may enable them from an application on their mobile device. If an authentication notification was blocked and held in a queue, it may be sent to the mobile device once authentication notifications are enabled. A user may then respond to an authentication notification on their mobile device and/or may complete the login process via an application on their mobile device. In some examples, authentication notifications for the mobile device may be automatically re-enabled if a user completes the authentication process via the mobile device without manually re-enabling authentication notifications. By displaying the status of authentication notifications to users via the browser and allowing users to enable and disable authentication notifications from mobile devices, the systems described herein may allow users to more conveniently and transparently manage authentication notifications while avoiding being spammed by unwanted notifications, thus increasing the convenience of multi-factor authentication systems.

As detailed above, computing system610and/or one or more components of network architecture700may perform and/or be a means for performing, either alone or in combination with other elements, one or more steps of an exemplary method for completing multi-factor authentication via mobile devices.

In addition, one or more of the modules described herein may transform data, physical devices, and/or representations of physical devices from one form to another. For example, one or more of the modules recited herein may receive authentication notification request data to be transformed, transform the authentication notification request data, output a result of the transformation to a notification push service, use the result of the transformation to determine whether to send or queue an authentication notification, and store the result of the transformation to a queue. Additionally or alternatively, one or more of the modules recited herein may transform a processor, volatile memory, non-volatile memory, and/or any other portion of a physical computing device from one form to another by executing on the computing device, storing data on the computing device, and/or otherwise interacting with the computing device.