Dual-factor identification system and method with adaptive enrollment

A multi-factor identification method comprising:

• a storing at a storage device, an authentication information that includes a plurality of respective enrolled user dual factor identifiers that includes respective enrolled first factor identifiers and respective enrolled second factor identifiers;
• receiving an authentication request that includes respective first factor unique user-identification information of a user and respective second factor unique user-identification information of the user;
• producing a request first factor identifier and a request second factor identifier, based upon the respective received first factor unique user-identification information and the respective received second factor unique user-identification information;
• searching the authentication information for a match between the request first factor identifier and a respective enrolled first factor identifier and a match between the request second factor identifier and a respective enrolled second factor identifier;
• in response to finding a first match between the request first factor identifier and the respective enrolled first factor identifier and a second match between the request second factor identifier with the respective enrolled second factor identifier:
• send a signal indicating that the user is authenticated;
• identify a first confidence level for the first match and a second confidence level for the second match, wherein the first confidence level and the second confidence level are derived based on values of a distance metric and based at least in part on one of:
• a rate of false positives of observed unenrolled users who are authenticated and a rate of false negatives observed for enrolled users who are not authenticated;
• compare the first confidence level to the second confidence level;
• if it is determined that the first confidence level exceeds the second confidence level, update the respective second enrolled factor identifier with the request second factor identifier;
• if it is determined that the second confidence level exceeds the first confidence level, update the respective first enrolled factor identifier with the request first factor identifier;
• reduce authentication denials by using at least one of the updated first enrolled factor identifier or the updated second enrolled factor identifier to process a subsequent authentication request;
• and
• in response to not finding the first match or not finding the second match, send a signal indicating denial of access to the user.

A multi-factor identification system comprising:

• processing circuitry;
• and
• a memory system storing a storing authentication information that includes a plurality of respective enrolled user dual factor identifiers that include respective enrolled first factor identifiers and respective enrolled second factor identifiers, the memory system storing instructions which, when executed by the processing circuitry, cause the processing circuitry to perform operations comprising:
• receiving an authentication request that includes respective first factor unique user-identification information of a user and respective second factor unique user-identification information of the user;
• producing a request first factor identifier and a request second factor identifier, based upon the respective received first factor unique user-identification information and the respective received second factor biometric measurement;
• searching the authentication information for a match between the request first factor identifier and a respective enrolled first factor identifier and a match between the request second factor identifier and a respective enrolled second factor identifier;
• in response to finding a first match between the request first factor identifier and the respective enrolled first factor identifier and a second match between the request second factor identifier with the respective enrolled second factor identifier;
• send a signal indicating that the user is authenticated;
• identify a first confidence level for the first match and a second confidence level for the second match, wherein the first confidence level and the second confidence level are derived based on values of a distance metric and based at least in part on one of:
• a rate of false positives of observed unenrolled users who are authenticated and a rate of false negatives observed for enrolled users who are not authenticated;
• compare the first confidence level to the second confidence level;
• if it is determined that the first confidence level exceeds the second confidence level, update the respective second enrolled factor identifier with the request second factor identifier;
• if it is determined that the second confidence level exceeds the first confidence level, update the respective first enrolled factor identifier with the request first factor identifier;
• reduce authentication denials by using at least one of the updated first enrolled factor identifier or the updated second enrolled factor identifier to process a subsequent authentication request;
• and
• in response to not finding the first match or not finding the second match, send a signal indicating denial of access to the user.

A non-transitory machine-readable storage medium comprising instructions that, when executed by one or more processors of a machine, cause the machine to perform operations comprising:

• receiving an authentication request that includes respective first factor unique user-identification information of a user and respective second factor unique user-identification information of the user;
• producing a request first factor identifier and a request second factor identifier, based upon the respective received first factor unique user-identification information and the respective received second factor unique user-identification information;
• searching authentication information, stored in a memory device and that includes a plurality of respective enrolled user dual factor identifiers that include respective enrolled first factor identifiers and respective enrolled second factor identifiers, for a match between the request first factor identifier and a respective enrolled first factor identifier and a match between the request second factor identifier and a respective enrolled second factor identifier;
• in response to finding a match between the request first factor identifier and the respective enrolled first factor identifier and a match between the request second factor identifier with the respective enrolled second factor identifier;
• send a signal indicating that the user is authenticated;
• identify a first confidence level for the first match and a second confidence level for the second match, wherein the first confidence level and the second confidence level are derived based on values of a distance metric and based at least in part on one of:
• a rate of false positives of observed unenrolled users who are authenticated and a rate of false negatives observed for enrolled users who are not authenticated;
• compare the first confidence level to the second confidence level;
• if it is determined that the first confidence level exceeds the second confidence level, update the respective second enrolled factor identifier with the request second factor identifier;
• if it is determined that the second confidence level exceeds the first confidence level, update the respective first enrolled factor identifier with the request first factor identifier;
• reduce authentication denials by using at least one of the updated first enrolled factor identifier or the updated second enrolled factor identifier to process a subsequent authentication request;
• and
• in response to not finding the first match or not finding the second match, send a signal indicating denial of access to the user.