Dynamic multi-factor authentication challenge generation

A computer system for dynamic multi-factor authentication challenge selection to control access to protected network resources, the computer system comprising:

• a bus system;
• a storage device connected to the bus system, wherein the storage device stores program instructions;
• and
• a processor connected to the bus system, wherein the processor executes the program instructions to:
• determine a risk associated with an operation to access a resource connected to a network that requires authentication of a user of a client device;
• identify a plurality of authentication methods, each respective authentication method associated with a level of security offsetting the risk and a computing cost associated with a respective authentication method;
• send, responsive to determining that a set of client-side selection factors maintained at the client device are needed to achieve a required confidence level in an identity of the user, a request for the set of client-side selection factors to the client device;
• receive the set of client-side selection factors of time and memory needed to capture a biometric sample by the client device in response to requesting the set of client-side selection factors from the client device;
• select a set of authentication methods from the plurality of authentication methods to send to the client device to achieve the required confidence level in the identity of the user based on a set of server-side selection factors maintained at the computer system and the set of client-side selection factors received by the computer system to minimize the risk and the computing cost associated with authenticating the operation to access the resource connected to the network;
• send the selected set of authentication methods to the client device;
• determine whether more authentication methods having an equivalent associated computing cost exist in an equivalence class associated with the selected set of authentication methods in response to determining that a confidence level in an identity of the user is less than a defined confidence level threshold based on a score corresponding to one or more responses received from the client device to the selected set of authentication methods, wherein the equivalence class is a group of interchangeable challenges having an equivalence relation between them to satisfy the set of client-side selection factors;
• determine that the authentication of the user was unsuccessful in response to determining that no more authentication methods having the equivalent associated computing cost exist in the equivalence class associated with the selected set of authentication methods;
• and
• deny access by the client device to the resource connected to the network based on the unsuccessful authentication of the user.

A computer program product for dynamic multi-factor authentication challenge selection to control access to protected network resources, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:

• determining, by the computer, a risk associated with an operation to access a resource connected to a network that requires authentication of a user of a client device;
• identifying, by the computer, a plurality of authentication methods, each respective authentication method associated with a level of security offsetting the risk and a computing cost associated with a respective authentication method;
• sending, by the computer responsive to the computer determining that a set of client-side selection factors maintained at the client device are needed to achieve a required confidence level in an identity of the user, a request for the set of client-side selection factors to the client device;
• responsive to the computer requesting the set of client-side selection factors from the client device, receiving, by the computer, the set of client-side selection factors of time and memory needed to capture a biometric sample by the client device;
• selecting, by the computer, a set of authentication methods from the plurality of authentication methods to send to the client device to achieve the required confidence level in the identity of the user based on a set of server-side selection factors maintained at the computer and the set of client-side selection factors received by the computer to minimize the risk and the computing cost associated with authenticating the operation to access the resource connected to the network;
• sending, by the computer, the selected set of authentication methods to the client device;
• responsive to the computer determining that a confidence level in an identity of the user is less than a defined confidence level threshold based on a score corresponding to one or more responses received from the client device to the selected set of authentication methods, determining, by the computer, whether more authentication methods having an equivalent associated computing cost exist in an equivalence class associated with the selected set of authentication methods, wherein the equivalence class is a group of interchangeable challenges having an equivalence relation between them to satisfy the set of client-side selection factors;
• responsive to the computer determining that no more authentication methods having the equivalent associated computing cost exist in the equivalence class associated with the selected set of authentication methods, determining, by the computer, that the authentication of the user was unsuccessful;
• and
• denying, by the computer, access by the client device to the resource connected to the network based on the unsuccessful authentication of the user.