User authentication based on user characteristic authentication rules

An authentication apparatus to authenticate a user requesting access to a restricted resource in a computer system comprising:

• an interface implemented on a programmable processing device of the computer system and configured to receive an indication of a user request to access the restricted resource, the request having associated a current user context defining one or more characteristics of the user;
• a receiver configured to receive a user selected authentication scheme from a set of authentication schemes for the current user context;
• a comparator implemented on a programmable processing device of the computer system and configured to compare the user selected authentication scheme with a set of user-specific rules, each rule indicating one or more authentication schemes for a user context as preferred authentication schemes;
• and
• an access controller implemented on a programmable processing device of the computer system and configured to permit access to the restricted resource based on the comparison so as to prevent access to the restricted resource when the rules indicate one or more authentication schemes other than the user selected authentication scheme are preferred for the current user context,
• wherein each rule in the set of user-specific rules is defined for the user context based on a learning process whereby preferred authentication schemes are identified by evaluating a probability that any user is authenticated by each authentication scheme, wherein the probability that any user is authenticated by each authentication scheme is a product of the frequency of use by any user and the rate of successful authentication for any user for the authentication scheme, and
• wherein one or more preferred authentication schemes for the requesting user in the user context are identified based on authentication schemes having a probability for the requesting user that differs from a probability for any user by at least a predetermined threshold.

A non-transitory computer readable medium for storing computer program code to, when loaded into a computer system and executed thereon, cause the computer system to authenticate a user for user access to a restricted resource in a computer system by:

• receiving, by one or more hardware processors, an indication of a user request to access the restricted resource, the request having associated a current user context defining one or more characteristics of the user;
• receiving, by the one or more hardware processors, a user selected authentication scheme from a set of authentication schemes for the current user context;
• comparing, by the one or more hardware processors, the user selected authentication scheme with a set of user-specific rules, each rule indicating one or more authentication schemes for a user context as preferred authentication schemes;
• and
• permitting, by the one or more hardware processors, access to the restricted resource based on the comparison so as to prevent access to the restricted resource when the rules indicate one or more authentication schemes other than the user selected authentication scheme are preferred for the current user context,
• wherein each rule in the set of user-specific rules is defined for the user context based on a learning process whereby preferred authentication schemes are identified by evaluating a probability that any user is authenticated by each authentication scheme, wherein the probability that any user is authenticated by each authentication scheme is a product of the frequency of use by any user and the rate of successful authentication for any user for the authentication scheme, and
• wherein one or more preferred authentication schemes for the requesting user in the user context are identified based on authentication schemes having a probability for the requesting user that differs from a probability for any user by at least a predetermined threshold.