Preventing unauthorized access to secure information systems using dynamic, multi-device authentication

Systems for dynamically authenticating users are provided. A system may receive a request to access functionality. In response to the received request, an authentication grid may be dynamically generated. The authentication grid may include a plurality of fields, each identifiable by a field identifier, and including one or more characters that may be used to authenticate a user. The authentication grid may be transmitted to a computing device of a user. A character for authentication may be identified by the system. In some arrangements, the system may generate a request for user input including a character appearing in the authentication grid. The user may identify the field and input the character appearing in the field. The system may receive the requested character and may compare it to the identified character for authentication. If the received character and the identified character match, functionality may be enabled. If a match does not exist, functionality may be disabled.

BACKGROUND

Aspects of the disclosure relate to electrical computers and systems. In particular, one or more aspects of the disclosure relate to using dynamic, multi-device authentication to prevent unauthorized access to secure information systems and functionality associated therewith.

Protecting privacy of information and ensure secure information remains secure is of the utmost interest to most people and businesses today. However, unauthorized users continue to develop new ways to obtain unauthorized access to information. Conventional authentication systems rely on static information, such as credentials, biometric data, and the like, to authenticate users. Such static information is more easily obtained or falsified by unauthorized actors. In addition, conventional systems often rely on a single device, single level of authentication, or the like, when authenticating a user. These conventional arrangements may not provide sufficient security for certain types of information. Accordingly, dynamic authentication using multiple devices may be advantageous in securing information and providing secure access to different types of functionality.

SUMMARY

Aspects of the disclosure provide effective, efficient, scalable, and convenient technical solutions that address and overcome the technical problems associated with preventing unauthorized access to secure information systems and functionality associated therewith.

In some examples, a system, computing platform, or the like, may receive a request to access functionality. In response to the received request, an authentication grid may be dynamically generated. The authentication grid may include a plurality of fields, each field identifiable by a column header and a row header, and each field including one or more characters that may be used to authenticate a user. The generated authentication grid may be transmitted to and displayed on a computing device of a user.

In some examples, a character for authentication may be identified, generated, or the like, by the system. The character for authentication may be included in a field of the authentication grid upon generating the authentication grid, or may be identified from the authentication grid after generation.

In some arrangements, the system, computing platform, or the like, may generate an instruction or request for user input that may be transmitted to a computing device of the user. The instruction or request may include a request for user input including a character appearing in the authentication grid. The instruction or request may include a column header and a row header, a field identifier, or the like, identifying a field including the character that is being requested. Accordingly, the user may identify the field and input the character appearing in the field.

In some examples, the system, computing platform, and the like, may receive the user input including the requested character and may compare it to the identified character for authentication. If the received character and the identified character match, functionality may be enabled and a user may be provided access to the enabled functionality. If a match does not exist, functionality may be disabled and/or a user may be preventing from accessing functionality.

DETAILED DESCRIPTION

Some aspects of the disclosure relate to using dynamic authentication to prevent unauthorized access to secure information systems and functionality associated therewith.

As mentioned above, protecting information and from unauthorized access is important to individuals and businesses. Conventional systems and arrangements for authentication often rely on static data such as credentials including a username and password, personal identification number, biometric data, and the like, that may be falsified by unauthorized users. Accordingly, use of dynamic authentication may provide increased security of information and functionality associated with various systems.

As discussed herein, a user may be provided with a dynamically generated authentication grid. In some examples, the authentication grid may be presented to a user upon opening an application executing on a mobile device, upon request of a user or other entity, upon logging into a system such as an online system, or the like. The authentication grid may include a plurality of fields. Each field may include a field identifier, or may be identifier by a column header and a row header, and may include data such as a character, string of characters, or the like, that may be used to authenticate a user.

Accordingly, if a user attempts to access different types of functionality (e.g., execute a transaction or event, make a withdrawal, or the like), the user may be prompted to input data from one or more fields of the authentication grid. Accordingly, the user may once again be authenticated to the system by providing a character from one or more fields that may be compared to an identified character that may be used for authentication. If a match exists, the user may be authenticated and the functionality may be enabled for the user. If a match does not exist, the functionality may be disabled and/or a request for additional authenticating information may be transmitted to the user.

These and various other arrangements will be discussed more fully below.

FIGS. 1A and 1Bdepict an illustrative computing environment for implementing and using a system for dynamic authentication in accordance with one or more aspects described herein. Referring toFIG. 1A, computing environment100may include one or more computing devices and/or other computing systems. For example, computing environment100may include a dynamic authentication computing platform110, a first event processing channel computer system120, a second event processing channel computer system130, a first local user computing device150, a second local user computing device155, a first remote user computing device170, and a second remote user computing device175.

Dynamic authentication computing platform110may be configured to provide dynamic authentication functions. In some examples, a request to access functionality may be received. In some examples, the request may be received via a mobile device of a user (e.g., remote user computing device170,175). The request may be received via one or more channels, such as a mobile application executing on the mobile device, an online application, or via an associate computing device, such as via a customer service support center, automated assistance kiosk, or the like. In some examples, the one or more channels may be supported by one or more event processing channel computer systems120,130. The request may be transmitted to the dynamic authentication computing platform110and an authentication grid may be dynamically generated. The authentication grid may be transmitted to one or more devices, such as the mobile device of the user, a computing device associated with a customer service associate, or the like.

In some examples, the dynamic authentication computing platform110may generate a request for user input. The request may include a request for identification of a character displayed in the authentication grid (e.g., on the mobile device of the user, or the like). The request may include a row header identifier and a column header identifier associated with a particular field within the authentication grid. The request may be transmitted to another device, such as the mobile device of the user.

The user may then provide user input including a character displayed in the authentication grid in a field corresponding to the row header identifier and column header identifier in the request. The received user input, including the character, may be transmitted to the dynamic authentication computing platform110and may be compared to a pre-generated authentication character. If the characters match, the user may be authenticated and functionality may be enabled and accessible to the user. If the characters do not match, the functionality may be disabled, additional requests for authenticating information may be requested, or the like.

Event processing channel computer system120and event processing channel computer system130may be computer systems configured to provide functionality to a user via one or more channels. For instance, the event processing channel computer system120,130may include computer systems associated with providing functionality associated with a mobile application executing on a mobile device of a user. In another example, the event processing channel computer system120,130may include computer systems associated with providing functionality via an online application. In yet another example, the event processing channel computer system120,130may include computer systems associated with providing functionality via a call center (e.g., a customer service associate computing device and associated devices, or the like), an automated teller machine (ATM), an automated service kiosk, a video assistance terminal, and the like. Although two event processing channel computer systems120,130are shown inFIG. 1A, more or fewer event processing channel systems may be included without departing from the invention. Accordingly, in some examples, each channel (e.g., mobile, online, call center, or the like) may be associated with its own respective computer system. In other examples, more than one channel may be supported by a particular event processing channel computer system120,130.

Local user computing device150,155and remote user computing device170,175may be configured to communicate with and/or connect to one or more computing devices or systems shown inFIG. 1A. For instance, local user computing device150,155may communicate with one or more computing systems or devices via network190, while remote user computing device170,175may communicate with one or more computing systems or devices via network195. In some examples, local user computing device150,155may be used to control aspects associated with generating the authentication grid (e.g., frequency, number of uses before deletion, and the like), with deleting the authentication grid, and the like.

The remote user computing devices170,175may be used to communicate with, for example, dynamic authentication computing platform110, transmit requests for functionality access, display the generated authentication grid, receive user input associated with a character in a specified field of the authentication grid, display notifications, execute commands or instructions from the dynamic authentication computing platform110, and the like.

In one or more arrangements event processing channel computer system120, event processing channel computer system130, local user computing device150, local user computing device155, remote user computing device170, and/or remote user computing device175may be any type of computing device or combination of devices capable of performing the particular functions described herein. For example, event processing channel computer system120, event processing channel computer system130, local user computing device150, local user computing device155, remote user computing device170, and/or remote user computing device175may, in some instances, be and/or include server computers, desktop computers, laptop computers, tablet computers, smart phones, or the like that may include one or more processors, memories, communication interfaces, storage devices, and/or other components. As noted above, and as illustrated in greater detail below, any and/or all of event processing channel computer system120, event processing channel computer system130, local user computing device150, local user computing device155, remote user computing device170, and/or remote user computing device175may, in some instances, be special-purpose computing devices configured to perform specific functions.

Computing environment100also may include one or more computing platforms. For example, and as noted above, computing environment100may include dynamic authentication computing platform110. As illustrated in greater detail below, dynamic authentication computing platform110may include one or more computing devices configured to perform one or more of the functions described herein. For example, dynamic authentication computing platform110may include one or more computers (e.g., laptop computers, desktop computers, servers, server blades, or the like).

As mentioned above, computing environment100also may include one or more networks, which may interconnect one or more of dynamic authentication computing platform110, event processing channel computer system120, event processing channel computer system130, local user computing device150, local user computing device155, remote user computing device170, and/or remote user computing device175. For example, computing environment100may include private network190and public network195. Private network190and/or public network195may include one or more sub-networks (e.g., Local Area Networks (LANs), Wide Area Networks (WANs), or the like). Private network190may be associated with a particular organization (e.g., a corporation, financial institution, educational institution, governmental institution, or the like) and may interconnect one or more computing devices associated with the organization. For example, dynamic authentication computing platform110, event processing channel computer system120, event processing channel computer system130, local user computing device150, and local user computing device155, may be associated with an organization (e.g., a financial institution), and private network190may be associated with and/or operated by the organization, and may include one or more networks (e.g., LANs, WANs, virtual private networks (VPNs), or the like) that interconnect dynamic authentication computing platform110, event processing channel computer system120, event processing channel computer system, local user computing device150, and local user computing device155, and one or more other computing devices and/or computer systems that are used by, operated by, and/or otherwise associated with the organization. Public network195may connect private network190and/or one or more computing devices connected thereto (e.g., dynamic authentication computing platform110, event processing channel computer system120, event processing channel computer system130, local user computing device150, local user computing device155) with one or more networks and/or computing devices that are not associated with the organization. For example remote user computing device170and/or remote user computing device175might not be associated with an organization that operates private network190(e.g., because remote user computing device170and remote user computing device175may be owned, operated, and/or serviced by one or more entities different from the organization that operates private network190, such as one or more customers of the organization, public or government entities, and/or vendors of the organization, rather than being owned and/or operated by the organization itself or an employee or affiliate of the organization), and public network195may include one or more networks (e.g., the internet) that connect remote user computing device170and remote user computing device175to private network190and/or one or more computing devices connected thereto (e.g., dynamic authentication platform110, event processing channel computer system120, event processing channel computer system130, local user computing device150, local user computing device155).

Referring toFIG. 1B, dynamic authentication computing platform110may include one or more processors111, memory112, and communication interface113. A data bus may interconnect processor(s)111, memory112, and communication interface113. Communication interface113may be a network interface configured to support communication between dynamic authentication computing platform110and one or more networks (e.g., private network190, public network195, or the like). Memory112may include one or more program modules having instructions that when executed by processor(s)111cause dynamic authentication computing platform110to perform one or more functions described herein and/or one or more databases that may store and/or otherwise maintain information which may be used by such program modules and/or processor(s)111. In some instances, the one or more program modules and/or databases may be stored by and/or maintained in different memory units of dynamic authentication computing platform110and/or by different computing devices that may form and/or otherwise make up dynamic authentication computing platform110.

For example, memory112may have, store, and/or include a functionality request module112a. Functionality request module112amay store instructions and/or data that may cause or enable the dynamic authentication computing platform110to receive a request to access functionality. The request may be received from a mobile device of a user (e.g., one or more of remote user computing devices170,175), may be received from one or more of the event processing channel computer systems120,130, or the like. In some examples, the request for access to functionality may include a user opening a mobile application executing on a mobile device. In other examples, the request for access to functionality may include a user accessing a website associated with online functionality, a user initiating activity at an ATM or automated service kiosk, a call to a call center associate, and the like.

The dynamic authentication computer platform110may further have, store and/or include a dynamic authentication grid generation module112b. The dynamic authentication grid generation module112bmay store instructions and/or data that may cause or enable the dynamic authentication computing platform110to generate an authentication grid. In some examples, the authentication grid may be generated automatically in response to the request for access to functionality (e.g., in response to a user opening a mobile application, in response to a user accessing a website providing online functionality, or the like). In other examples, the authentication grid may be generated on-demand. For instance, a user may request generation of an authentication grid. In another example, one or more predetermined types of events (e.g., withdrawals greater than a predetermined threshold, opening or closing account, or the like) may trigger generation of an authentication grid.

The dynamic authentication grid generation module112bmay further transmit the authentication grid to a computing device. For instance, the dynamic authentication grid generation module112bmay transmit the authentication grid to a mobile device of a user (e.g., remote user computing device170,175) and may cause the authentication grid to be displayed on the mobile device. In another example, the authentication grid may be transmitted to a user device and a service associate device to enable the service associate to confirm user input received from the user device.

The authentication grid may be any desired size. For instance, the authentication grid may be thirteen (13) columns by two rows, thereby creating twenty six (26) fields in which characters may be displayed. In another example, the authentication grid may be three (3) columns by three (3) rows, thereby creating a grid of nine (9) fields in which characters may be displayed. In still another example, the grid may be ten (10) rows by three (3) columns, thereby creating thirty (30) fields in which characters may be displayed.

In some examples, each column and row of the authentication grid may include a header. For instance, the columns may include headers such as “column 1, column 2, . . . ” and the rows may include headers such as “row 1, row 2, . . . ” In another example, the columns may each include a letter, e.g., “A, B, C, . . . ” and the rows may each be labeled with a number, e.g., “1, 2, 3 . . . ” In still other examples, each field (e.g., an intersection of a row and column) may include an identifier. For instance, each field may be labeled with a letter and each field may including a corresponding number, word, or other character, that may be used to authentication a user. Various other header labels may be used without departing from the invention.

As discussed, the intersection of each row and column may include a field having a character arranged therein. Each field may be identifiable by its respective row header and column header, by a single field identifier, or the like. The characters may include one or more numbers, letters, symbols, words, or the like. In some examples, the fields may be populated with characters in a randomly selected patterns. In some examples, the fields may be populated with characters of the same type (e.g., all letters, all numbers, or the like) or with characters of different types (e.g., some fields may include numbers while others include letters or combinations thereof).

In some arrangements, the authentication grid may be used one time and then deleted. For instance, upon receiving user input including data from a generated authentication grid, the dynamic authentication computing platform110may transmit a signal or command to delete the grid. If one or more additional events or functionality are requested, a second, different authentication grid may be dynamically generated.

In other examples, an authentication grid may be available for use during a user session. For instance, upon requesting access to functionality, a user session may be initiated (e.g., communication may be established between one or more devices to provide functionality). Upon ending the user session (e.g., by exiting the mobile application, online application, or the like), authentication grid may be deleted. However, during the user session, the authentication grid may be used more than one time to authenticate a user to authorize various functionality to be executed. In still other examples, the generated authentication grid may be deleted after expiration of a predetermined time period.

Dynamic authentication computing platform110may further have, store and/or include an instruction generation module112c. Instruction generation module112cmay store instructions and/or data that may cause or enable the dynamic authentication computing platform110to generate instructions to be transmitted to a user for authenticating the user with the authentication grid. For instance, the instruction generation module112cmay identify a field including a character that may be used to authenticate the user. Accordingly, the instruction generation module112cmay generate an instruction requesting a user to provide user input including the character in the identified field. The instruction may identify the field using a row header and column header associated with the particular field, using the unique field identifier associated with the field, or the like. In some examples, the instruction may be transmitted to, for instance, a mobile device of the user (e.g., remote user computing device170,175) and may be displayed on the device. The instructions may be displayed via a mobile application executing on the device, via email, short message service (SMS), or the like.

Dynamic authentication computing platform110may further have, store and/or include an authentication module112d. The authentication module112dmay store instructions and/or data that may cause or enable the dynamic authentication computing platform110to receive user input including a requested character or plurality of characters (e.g., data in the generated authentication grid from a field or plurality of fields identified by row header and column header, field identifier, or the like, in instructions transmitted to a user) and may compare the received character or plurality of characters to a pre-generated authentication character or plurality of characters. In some examples, the pre-generated authentication character or plurality of characters may be identified by the instruction generation module112cand may be selected at random from the generated authentication grid. In some examples, the pre-generated character or plurality of characters may be generated separately from the authentication grid and may be inserted into the authentication grid (e.g., in one or more randomly selected fields) when the authentication grid is generated.

If the received character or plurality of characters matches the pre-generated character, the authentication module112dmay authenticate the user, enable functionality or the like. If the received character does not match the pre-generated character, the user might not be authenticated, functionality may be disabled, additional information may be requested, or the like.

The dynamic authentication computing platform110may further have, store and/or include an authentication grid deletion module112e. The authentication grid deletion module112emay store instructions and/or data that may cause or enable the dynamic authentication computing platform110to generate and transmit a signal, instruction or command to delete an authentication grid. For instance, upon occurrence of a triggering event (e.g., use of the authentication grid in one-time use scenarios, end of a user session, expiration of a predetermined time period, or the like), the authentication grid deletion module112emay generate an instruction or command and may transmit the instruction or command to a device displaying the authentication grid. The instruction or command may include an instruction to delete the authentication grid. Upon being received by the device, the instruction or command may be automatically executed and the authentication grid may be deleted from the device.

Dynamic authentication computing platform110may further have, store and/or include a notification generation module112f. The notification generation module112fmay store instructions and/or data that may cause or enable the dynamic authentication computing platform110to generate and transmit one or more notifications to a computing device (e.g., mobile device of a user, ATM, automated service kiosk, computing device of a call center associate, or the like). The notifications may include information related to whether the user was authenticated, functionality available to the user based on the authentication, additional information that may be requested to authenticate the user, and the like.

FIGS. 2A-2Edepict an illustrative event sequence for implementing and using dynamic authentication functions in accordance with one or more aspects described herein. The events shown in the illustrative event sequence are merely one example sequence and additional events may be added, or events may be omitted, without departing from the invention.

Referring toFIG. 2A, at step201, a request to access functionality may be received. For instance, the request to access functionality may be received by, for example, a remote user computing device170,175, such as a mobile device or other computing device of a user. In some examples, the request to access functionality may be received from the event processing channel computer system120,130, directly (e.g., in situations in which a user requests functionality via a call center or other service associate).

At step202, the request to access functionality may be transmitted to, for instance, one or more event processing channel computer systems120,130. In some examples, the request to access functionality may include opening an application executing on a mobile device. Upon opening the application, a notification may be transmitted to one or more event processing channel systems associated with providing functionality via the mobile application.

At step203, the event processing channel computer system120,130, may generate a request to activate dynamic authentication. For instance, a user may have a first level of authentication upon requesting access to functionality. For instance, a user may be logged into an application executing on the mobile device. However, additional authentication may be requested prior to providing any functionality, providing particular functionality, or the like. In those examples, the event processing channel computer system120,130may generate a request to activate dynamic authentication. At step204, the request to activate dynamic authentication may be transmitted to the dynamic authentication computing platform110.

At step205, the dynamic authentication computing platform110may receive the request to activate dynamic authentication functions and, in response, may activate or enable dynamic authentication functions. Upon activation of the dynamic authentication functions, an authentication grid may be dynamically generated in step206.

With reference toFIG. 2B, at step207, the dynamically generated authentication grid may be transmitted to one or more computing devices, such as remote user computing device170,175(e.g., a mobile device or other computing device of the user). In some examples, the dynamically generated authentication grid may also be transmitted to one or more computing devices within an event processing channel computer system120,130, as in step208. For instance, if the request to access functionality was received via, for example, a call center, a service associate computing device used to assist the user via phone may receive the dynamically generated authentication grid, in addition to the user device receiving the authentication grid.

In step209, the dynamic authentication grid may be displayed on the remote user computing device170,175. In some examples, the process of receiving the request to access functionality may be transmitted upon startup (e.g., upon a user opening an application, starting up a device, or the like). In some arrangements, steps associated with requesting authentication functionality, generating an authentication grid, and the like, may be performed upon startup so that upon startup, the authentication grid may be automatically generated, transmitted to the device, and displayed to the user. In other examples, the authentication grid may be automatically generated and transmitted but displayed upon a triggering event, such as a request to access particular functionality, or the like. In still other examples, the authentication grid may be generated and transmitted upon request.

In some examples, the authentication grid may be displayed to the user as part of (e.g., a portion of) a user interface of an online application, mobile application, or the like. In other examples, the authentication grid may be displayed via email, SMS, or the like.

In step210, the dynamic authentication computing platform110may identify a character for use in dynamically authenticating a user. For instance, the dynamic authentication computing platform110may dynamically identify, from a plurality of characters, one or more characters for use in authenticating a user. In some examples, the step of identifying the character may be performed prior to the authentication grid being generated and the identified character may be randomly placed in a field in the authentication grid. Alternatively, the identified character may be identified from characters populating the fields of the generated authentication grid.

In step211, a request for user input providing an authenticating character may be generated. For instance, the request may including instructions requesting user input including a character visible to the user in the authentication grid. The request may identify the requested character by a row header and a column header, field identifier, or the like, associated with the field in which the character appears. In some examples, the request may only include the row header and column header or field identifier associated with the field in which the character appears.

In step212, the generated request for user input may be transmitted to the remote user computing device170,175(e.g., the computing device of the user).

With reference toFIG. 2C, at step213, the generated request may be displayed on the remote user computing device170,175. In step214, user input including the requested character may be received. In step215, the received user input including the requested character may be transmitted to the dynamic authentication computing platform110.

At step216, the received user input including the requested character may be compared to the identified character (e.g., in step210).

With reference toFIG. 2D, at step217, a result of the comparison may be generated. For instance, the result may indicate that a match occurred between the received character and the identified character. Alternatively, the result may indicate that no match occurred. If the result indicates that a match occurred, the user may be authenticated (e.g., either at a first authentication layer or a second or subsequent authentication layer) and, in step218, functionality may be enabled. In some examples, authenticating the user via the authentication grid may enable all functionality (e.g., all functionality may be disabled until the user is authenticated via the authentication grid, via another, additional authentication layer, or the like). In other examples, authenticating the user via the authenticating grid may enable certain functionality that is not accessible to the user (e.g., is disabled) unless the user is authenticated via the authentication grid. In some examples, certain types of events or functionality (e.g., high dollar value events, events that are prone to unauthorized activity, or the like) may require additional authentication via the authentication grid.

At step219, a signal, instruction or command to enable functionality may be generated and transmitted to an event processing channel computer system120,130. At step220, the signal, instruction or command may be received by the event processing channel computer system120,130and may be executed by the event processing channel computer system120,130to enable the functionality identified.

In step221, a notification may be generated including the result of the comparison and transmitted to the remote user computing device170,175. In step222, the notification including the result may be displayed on the remote user computing device170,175. In examples in which the result did not identify a match between the received character and the identified character, the notification may include an indication that functionality will remain disabled until the user is authenticated via the authentication grid, a request for additional authenticating information, or the like.

With reference toFIG. 2E, at step223, an instruction, command or signal to delete the generated authentication grid may be generated. For instance, upon occurrence of a triggering event, such as, with a single-use authentication grid, after one use, at the end of a user session, or the like, an instruction to delete the authentication grid may be generated. At step224, the generated instruction, command or signal may be transmitted to the remote user computing device170,175. At step225, the instruction, command or signal may be received and executed by the remote user computing device170,175, and the authentication grid may be deleted. In some examples, after the authentication grid has been deleted, if access to additional functionality is requested (e.g., in a same user session, in a different user session, or the like) a second, different authentication grid may be generated.

FIG. 3is a flow chart illustrating one example method of implementing dynamic authentication functions according to one or more aspects described herein. The processes illustrated inFIG. 3are merely some example processes and functions. The steps shown may be performed in a different order, more steps may be added, or one or more steps may be omitted without departing from the invention.

In step300, a request to access functionality may be received. As discussed above, the request may be received from a remote user computing device170,175, such as a mobile device of a user, laptop, tablet, or other user computing device. In some examples, the request may be received by an event processing channel computing device120,130. For instance, the request may be received via a call center associate computing device, an automated service kiosk, an ATM, or the like.

In some examples, the request to access functionality may including providing a first level of authentication information. For instance, a user may login to an online system using a username and password, personal identification number (PIN) or the like. In some arrangements, a user may be automatically authenticated by placing the request to access functionality from a particular device (e.g., by opening a mobile application executing on a mobile device of the user, the user may be automated authenticated at a first level of authentication because the device may be recognized).

At step302, an authentication grid may be dynamically generated. For instance, in response to receiving the request for functionality, an authentication grid may be generated. In some examples, the authentication grid may provide a first or only level of authentication. In other examples in which a first level of authentication has been established, the authentication grid and associated functions may provide a second level of authentication.

As discussed above, the authentication grid may include fields having a row header and column header labeling each field and/or a field identifier identifying each field. Row and column headers, as well as field identifiers, may include a number, letter, string of numbers or letters, or the like. Each field may contain one or more characters that may be used to authenticate a user. In some examples, the characters may be randomly generated and randomly placed within the authentication grid.

At step304, the authentication grid may be transmitted to the remote user computing device170,175. The authentication grid may be displayed to the user via the remote user computing device170,175.

At step306, a character for authentication may be pre-generated or identified. For instance, a character for authentication may be selected from the generated authentication grid. In another example, the character for authentication may be pre-generated and included in a field upon generation of the authentication grid.

At step308, a request for a character may be generated. The request for a character may include an instruction requesting user input including a character appearing in a particular field in the authentication grid. In some examples, the field may be identified by the row header and column header, field identifier, or the like, corresponding to the particular field.

At step310, the requested character may be received (e.g., from the remote user computing device170,175) and, in step312, may be compared to the identified character. At step314, a determination may be made as to whether the received character matches the identified character for authentication. If so, the user may be authenticated in step316and functionality may be enabled in step318. For instance, some or all functionality may be enabled and accessible to the user based on the authentication from the authentication grid.

If, in step314, the received character does not match the identified character, functionality may be disabled in step320. For instance, one or more functions that were enabled for the user may be disabled until further authentication is provided. In step322, additional authenticating information may be requested from the user.

FIG. 4illustrates one example user interface for use with dynamic authentication functions. The interface400includes an instruction to provide user input including a character identified by a field identifier. In the user interface400, the instruction includes a request to provide the character appearing in the fields associated with identifiers C, G, and M.

The authentication grid410may be displayed in interface400and may include a series of fields402including an identifier arranged above a character or other data that may be used for authentication. The user may identify the field or fields provided in the instructions and may input the character or characters appearing in that fields in fields404. In the example of interface400, the user has input characters23into the field associated with field C,91into the field associated with field G, and94into the field associated with field M. The user may then select “OK” option to transmit the user input to the dynamic authentication computing platform for comparison and authentication, or may select “CANCEL” option to return to a previous interface or exit the system.

FIG. 5illustrates another example user interface for use with dynamic authentication functions. The interface500includes an instruction to provide user input including a character identified by row header and column header. In the user interface500, the instruction includes a request to provide the character appearing in the field associated with row C, column 4.

The authentication grid510may be displayed in interface500and may include a series of fields formed from a plurality of rows504and columns502. The user may identify the field provided in the instructions and may input the character appearing in that field in field506. In the example of interface500, the user has input character Y8, as shown in field C4. The user may then select “OK” option to transmit the user input to the dynamic authentication computing platform for comparison and authentication, or may select “CANCEL” option to return to a previous interface or exit the system.

As discussed herein, the arrangements described provide for use of dynamic authentication to authenticate a user. In some examples, the dynamic authentication aspects described herein may be used as a first or only level of authentication. In other examples, the dynamic authentication aspects discussed herein may be used as a second or other additional level of authentication.

For instance, in some examples, certain types of functionality or requests meeting certain thresholds may require an additional layer or level of authentication. For example, high dollar value events or transactions, certain types of events such as opening or closing an account, and the like, may require additional authentication. Accordingly, the dynamic authentication aspects described herein may be used to provide this additional factor or layer of authentication.

In some examples, an authentication grid may be generated and displayed to a user, but no request for data from the authentication grid may be made because the type of functionality being requested might not meet criteria for using the authentication grid.

In some examples, the authentication grid may be generated and/or loaded during startup of a device, application, or the like. In other arrangements, the authentication grid may be loaded when an online application is opened, when a user is authenticated to a system, or the like. In still other arrangements, the authentication grid may be generated and/or loaded upon a user request (e.g., a call center associate may request use of an authentication grid to authenticate a caller). In some examples, the grid may be transmitted to a user via pre-registered information, such as email or SMS to an address or number provided by the user during a registration process. Accordingly, in some examples, the generated authentication grid may be transmitted as a push notification to a user.

In some arrangements, the authentication grid generated may be unique to each user, each application, or the like. As discussed herein, the authentication grid may be available for a single use, for multiple uses within a user session, for multiple user sessions, for a predetermined time period, or the like. Upon occurrence of a triggering event (e.g., single use, end of a user session, expiration of time period, or the like) the authentication grid may be deleted. In some examples, deletion of the authentication grid may cause a second, different authentication grid to be generated and provided to the user (e.g., the authentication grid may automatically regenerate including different characters or data in the fields). For instance, upon a user inputting the requested characters and clicking “ok” or “submit,” the authentication grid may be automatically deleted and/or may automatically regenerate with new data) In some examples, a user may request regeneration of an authentication grid. Accordingly, the authentication grids may rotate to aid in preventing unauthorized use of the authentication grid.

Although several aspects discussed herein are discussed in the context of an online or mobile application executing on a device, aspects described herein may be used with other channels of event processing, such as ATMs, automated service kiosks, call centers, and the like. For instance, upon initiating an event at an ATM, an authentication grid may be generated and transmitted to a mobile device pre-registered with the system. The mobile device may display the authentication grid to the user and the ATM may request user input including characters from particular fields in the authentication grid. The user may input the requested characters and the user input may be compared to identified characters to determine whether to authenticate the user. If so, functionality is enabled. If not, the user is prevented from accessing functionality (e.g., some or all available via the ATM).

In another example, call center computing devices may include a widget that may generate an authentication grid. A call center associate may then activate the widget to authenticate users calling in for service.

FIG. 6depicts an illustrative operating environment in which various aspects of the present disclosure may be implemented in accordance with one or more example embodiments. Referring toFIG. 6, computing system environment600may be used according to one or more illustrative embodiments. Computing system environment600is only one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality contained in the disclosure. Computing system environment600should not be interpreted as having any dependency or requirement relating to any one or combination of components shown in illustrative computing system environment600.

Computing system environment600may include dynamic authentication computing device601having processor603for controlling overall operation of dynamic authentication computing device601and its associated components, including Random Access Memory (RAM)605, Read-Only Memory (ROM)607, communications module609, and memory615. Dynamic authentication computing device601may include a variety of computer readable media. Computer readable media may be any available media that may be accessed by dynamic authentication computing device601, may be non-transitory, and may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, object code, data structures, program modules, or other data. Examples of computer readable media may include Random Access Memory (RAM), Read Only Memory (ROM), Electronically Erasable Programmable Read-Only Memory (EEPROM), flash memory or other memory technology, Compact Disk Read-Only Memory (CD-ROM), Digital Versatile Disk (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and that can be accessed by computing device601.

Software may be stored within memory615and/or storage to provide instructions to processor603for enabling dynamic authentication computing device601to perform various functions as discussed herein. For example, memory615may store software used by dynamic authentication computing device601, such as operating system617, application programs619, and associated database621. Also, some or all of the computer executable instructions for dynamic authentication computing device601may be embodied in hardware or firmware. Although not shown, RAM605may include one or more applications representing the application data stored in RAM605while dynamic authentication computing device601is on and corresponding software applications (e.g., software tasks) are running on dynamic authentication computing device601.

Communications module609may include a microphone, keypad, touch screen, and/or stylus through which a user of dynamic authentication computing device601may provide input, and may also include one or more of a speaker for providing audio output and a video display device for providing textual, audiovisual and/or graphical output. Computing system environment600may also include optical scanners (not shown).

Dynamic authentication computing device601may operate in a networked environment supporting connections to one or more remote computing devices, such as computing devices641and651. Computing devices641and651may be personal computing devices or servers that include any or all of the elements described above relative to dynamic authentication computing device601.

The network connections depicted inFIG. 6may include Local Area Network (LAN)625and Wide Area Network (WAN)629, as well as other networks. When used in a LAN networking environment, dynamic authentication computing device601may be connected to LAN625through a network interface or adapter in communications module609. When used in a WAN networking environment, dynamic authentication computing device601may include a modem in communications module609or other means for establishing communications over WAN629, such as network631(e.g., public network, private network, Internet, intranet, and the like). The network connections shown are illustrative and other means of establishing a communications link between the computing devices may be used. Various well-known protocols such as Transmission Control Protocol/Internet Protocol (TCP/IP), Ethernet, File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP) and the like may be used, and the system can be operated in a client-server configuration to permit a user to retrieve web pages from a web-based server. Any of various conventional web browsers can be used to display and manipulate data on web pages.

The disclosure is operational with numerous other computing system environments or configurations. Examples of computing systems, environments, and/or configurations that may be suitable for use with the disclosed embodiments include, but are not limited to, personal computers (PCs), server computers, hand-held or laptop devices, smart phones, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like and are configured to perform the functions described herein.

FIG. 7depicts an illustrative block diagram of workstations and servers that may be used to implement the processes and functions of certain aspects of the present disclosure in accordance with one or more example embodiments. Referring toFIG. 7, illustrative system700may be used for implementing example embodiments according to the present disclosure. As illustrated, system700may include one or more workstation computers701. Workstation701may be, for example, a desktop computer, a smartphone, a wireless device, a tablet computer, a laptop computer, and the like, configured to perform various processes described herein. Workstations701may be local or remote, and may be connected by one of communications links702to computer network703that is linked via communications link705to dynamic authentication server704. In system700, dynamic authentication server704may be a server, processor, computer, or data processing device, or combination of the same, configured to perform the functions and/or processes described herein. Server704may be used to receive requests to provide functionality, dynamically generate an authentication grid, receive user input including a character for authentication, determine whether the character matches a pre-generated character, authenticate a user, enable functionality, and the like.

Computer network703may be any suitable computer network including the Internet, an intranet, a Wide-Area Network (WAN), a Local-Area Network (LAN), a wireless network, a Digital Subscriber Line (DSL) network, a frame relay network, an Asynchronous Transfer Mode network, a Virtual Private Network (VPN), or any combination of any of the same. Communications links702and705may be communications links suitable for communicating between workstations701and dynamic authentication server704, such as network links, dial-up links, wireless links, hard-wired links, as well as network types developed in the future, and the like.

Aspects of the disclosure have been described in terms of illustrative embodiments thereof. Numerous other embodiments, modifications, and variations within the scope and spirit of the appended claims will occur to persons of ordinary skill in the art from a review of this disclosure. For example, one or more of the steps depicted in the illustrative figures may be performed in other than the recited order, one or more steps described with respect to one figure may be used in combination with one or more steps described with respect to another figure, and/or one or more depicted steps may be optional in accordance with aspects of the disclosure.