An authentication decisioning system comprising:
- a processing device;
- a non-transitory computer-readable medium included in or communicatively coupled to the processing device, the non-transitory computer-readable medium storing a data structure for storing user data records and instructions that are executable by the processing device to cause the authentication decisioning system to:
- receive, from an additional computing system, a request by a user device for verification of access to a secured electronic resource provided by the additional computing system, the request comprising a) input session data describing a session of the user device and b) a preliminary authentication token indicating verification of primary authentication credentials of the user device for accessing the secured electronic resource;
- determine an authentication challenge level for the user device for access to the secured electronic resource, the authentication challenge level indicating an evaluation of a user identity corresponding to the user device, wherein determining the authentication challenge level includes applying a passive-dimension decision model to one or more of the user device or the request, wherein applying the passive-dimension decision model comprises:
- analyzing one or more of identity characteristics associated with the user device or the request, or device characteristics associated with the user device or the request,
- comparing the input session data from the request with previously obtained reference data, and
- determining, based on the comparison of the input session data and the previously obtained reference data, whether the identity characteristics or the device characteristics are outside a norm for the user device;
- and
- communicate an access decision to one or more of the user device or the additional computing system, wherein the access decision is based on the authentication challenge level, and wherein the access decision includes one or more of:
- responsive to the authentication challenge level indicating a first evaluation of the user identity, authorizing access to the secured electronic resource by the user device without supplemental authentication,
- responsive to the authentication challenge level indicating a second evaluation of the user identity, denying access to the secured electronic resource by the user device, or
- responsive to the authentication challenge level indicating a third evaluation of the user identity, presenting a supplemental authentication challenge to the user device.