Securing user-accessed applications in a distributed computing environment

A computer-implemented method of controlling access to a web-based application, the method comprising:

• receiving resource request information from an authorization control system, the resource request information including an identifier of the web-based application and an identifier of a first user received from a first user device,
• determining an access response based on the application request information and based on an entry in an access information feed, the access information feed comprising a list of attempts by the first user to access the first web-based application, the entry in the access information feed comprising an indication of when a most recent attempt to access the first web-based application was initiated by the first user;
• determining that the amount of time since the most recent attempt to access the first web-based application is longer than a specified threshold time;
• based on the determination, transmitting the access response to the authorization control system, the access response indicating that, because the first web-based application was not accessed by the first user for longer than the specified threshold time, a notification is to be sent to a second user device of the first user;
• receiving an access result from the authorization control system, the access result being based on a response from the second user device to the notification;
• and
• storing the access result in an access information feed system.

A computer-implemented method for determining an access response to provide to a first user device requesting access to a first web-based application over a network, the method comprising:

• receiving an authentication indication from an authentication service, the authentication indication being associated with a request by a first user device to access a protected service, the authentication indication being based on the request and an entry in an access information feed, the entry in the access information feed comprising a previously granted access for the first user device;
• when the authentication indication indicates successful authentication, requesting an access decision from an access determination service, the access determination service being configured to determine whether the amount of time since a most recent attempt to access the protected service is longer than a specified threshold time;
• upon determining that the protected service was not accessed by the first user device for longer than the specified threshold time, requesting that a notification system issue a notification to a second user device to perform a second authentication using the second user device;
• receiving a response to the notification from the second user device;
• and
• granting access to the protected service to the first user device.