Method for automatic possession-factor authentication

A method for performing authentication, the method comprising:

• receiving, via one or more communication networks, an implicit authentication request, wherein the implicit authentication request is generated by a service provider in response to an access request from an unauthorized device;
• responsive to receiving the implicit authentication request, accessing, by a remote computing server, implicit authentication data from a possession factor associated with an authorized user of the possession factor, the implicit authentication data comprising data that is automatically collected or automatically generated by the possession factor, without user intervention, and that relates to a calculated likelihood of the user performing one or more activities involving an operation and/or a usage of the possession factor, wherein the possession factor comprises one or more user authentication credentials;
• at the remote computing server:
• using only the implicit authentication data to determine a likelihood of possession of the possession factor by the authorized user based on a possession factor continuum that informs authentication requirements for authenticating the user, the possession factor continuum comprising a plurality of possession confidence thresholds, wherein each of the plurality of possession confidence thresholds corresponds to a different authentication requirement for authenticating the user, and wherein one or more of the possession confidence thresholds relate to unsuccessful access attempts;
• and
• automatically authenticate the authorized user if the determined likelihood of possession satisfies a possession confidence threshold of the possession factor continuum that enables implicit authentication of the user.

A method, the method comprising:

• performing an express authentication of an unauthorized device with a service provider, wherein the express authentication of the unauthorized device requires an express authentication response from a user associated with the unauthorized device;
• in response to a receipt of an indication from a service provider of a successful express authentication of the unauthorized device, initiating a secondary authentication of the user at a remote authentication service, the secondary authentication comprising an implicit authentication of the user, wherein the implicit authentication is based on implicit authentication data indicating a calculated likelihood that the user has a remote possession factor, wherein the implicit authentication of the user, if performed, is an automatic authentication of the user without an express authentication response from the user during the implicit authentication, wherein the possession factor comprises one or more user authentication credentials, and wherein the implicit authentication includes:
• at the remote authentication service:
• receiving, via one or more communication networks, the implicit authentication data from the remote possession factor;
• using the implicit authentication data to generate a likelihood of possession, wherein the likelihood of possession indicates a likelihood that the user possesses or does not possess the remote possession factor, and wherein the likelihood of possession relates at least to unsuccessful access attempts;
• and
• performing, by the remote authentication service, the automatic authentication of the unauthorized device if the likelihood of possession indicates the likelihood that the user possesses the remote possession factor, or
• performing, by the remote authentication service, an additional express authentication of the unauthorized device if the likelihood of possession indicates the likelihood that the user does not possess the remote possession factor.