Patent ID: 8745401

Claim:
An authorization server comprising one or more computers configured to perform operations comprising: providing a user security key to a mobile device of a user; receiving one or more account security preferences, wherein the account security preferences are selected by the user from one or more options provided by the authorization server, wherein the account security preferences specify one or more first actions, one or more second actions, and the mobile device, and wherein the mobile device is specified to be used, with the user security key, to authorize the one or more first actions, and the mobile device and the user security key are not required to be used to authorize the one or more second actions, wherein the authorization server comprises one or more servers providing one or more services, wherein the one or more first actions and the one or more second actions are to be performed by the authorization server, and wherein the one or more first actions are classified as higher-risk actions requiring a higher level of authorization security and the one or more second actions are classified as lower-risk actions requiring a lower level of authorization security; receiving from a client device distinct from the mobile device a request from the user to perform an action; and determining, using the account security preferences, the action requires authorization using the mobile device and the user security key, and in response: generating a challenge token including a security signature matched to a service security key stored on the one or more computers of the authorization server, wherein the service security key is cryptographically matched to the user security key, and wherein the security signature is generated using the service security key and content of the challenge token; providing the challenge token to the mobile device; receiving an approval value from the client device; determining the approval value is valid in reference to the challenge token and the user security key previously provided to the mobile device and indicates approval to perform the action for the user; and performing the action in response to determining the approval value is valid.