Policy based adaptive identity proofing

A non-transitory computer readable storage medium storing instructions for performing a method for identity proofing, the method comprising:

• receiving a request from a user for a resource of a plurality of resources;
• retrieving user data associated with the user including:
• personal identifying information,
• global identity reputation data from a first service,
• identity proofing event data, and
• risk signal data from a second service,
• retrieving access criteria for the resource of the plurality of resources;
• generating based on the user data via a machine learning model that is trained using previously collected user data a set of dynamic rules for the user;
• determining an identity assurance strength of the user based on an application of the access criteria and the set of dynamic rules to the user data that includes at least:
• determining the retrieved personal identifying information matches personal identifying information associated with each identity proofing event in the identity proofing event data, wherein the identity proofing event data includes each successful and unsuccessful attempt of the user to access any resource;
• and
• determining valid identity proofing events and associated strengths from the valid identity proofing events based on
• eliminating one or more invalid identity proofing events from the identity proofing event data, the eliminating comprising:
• determining, from the identity proofing event data, an identity proofing event that exceeds a timeframe, and
• determining the user data includes the global identity reputation data and the risk signal;
• determining the identity assurance strength based on the valid identity proofing events and corresponding strengths from the valid identity proofing events;
• determining the identity assurance strength of the user is not adequate to access the resource;
• determining an identity proofing operation for the user to complete that is adapted to the user based on at least:
• an identity proofing method needed to satisfy the access criteria and the set of dynamic rules;
• a capability of a computing device associated with the user;
• a global identity reputation associated with the user;
• and
• a risk signal associated with the user;
• generating an updated identity assurance strength;
• determining that the updated identity assurance strength of the user is adequate to access the resource;
• and
• enabling access to the resource.

A system, comprising:

• a processor;
• and
• a memory storing instructions which when executed by the processor perform a method for identity proofing, the method comprising:
• receiving a request from a user for a resource of a plurality of resources;
• retrieving user data associated with the user including:
• personal identifying information,
• global identity reputation data from a first service,
• identity proofing event data, and
• risk signal data from a second service,
• retrieving access criteria for the resource of the plurality of resources;
• generating based on the user data via a machine learning model that is trained using previously collected user data a set of dynamic rules for the user;
• determining an identity assurance strength of the user based on an application of the access criteria and the set of dynamic rules to the user data that includes at least:
• determining the retrieved personal identifying information matches personal identifying information associated with each identity proofing event in the identity proofing event data, wherein the identity proofing event data includes each successful and unsuccessful attempt of the user to access any resource;
• and
• determining valid identity proofing events and associated strengths from the valid identity proofing events based on:
• eliminating one or more invalid identity proofing events from the identity proofing event data, the eliminating comprising:
• determining, from the identity proofing event data, an identity proofing event that exceeds a timeframe, and
• determining the user data includes the global identity reputation data the risk signal data;
• determining the identity assurance strength based on the valid identity proofing events and corresponding strengths from the valid identity proofing events;
• determining the identity assurance strength of the user is not adequate to access the resource;
• determining an identity proofing operation for the user to complete that is adapted to the user based on at least:
• an identity proofing method needed to satisfy the access criteria and the set of dynamic rules;
• a capability of a computing device associated with the user;
• a global identity reputation associated with the user;
• and
• a risk signal associated with the user;
• generating an updated identity assurance strength;
• determining that the updated identity assurance strength of the user is adequate to access the resource;
• and
• enabling access to the resource.