Method for automatic possession-factor authentication

A method comprising:

• obtaining, via one or more communication networks, an authentication request that initiates an implicit authentication process for a transaction involving authentication, wherein the authentication request is generated by a service provider in response to receipt of an access request from an unauthorized device, and wherein the implicit authentication process includes passively authenticating a user based on whether implicit authentication data obtained from a possession factor indicates a calculated likelihood that the user has possession of the possession factor, wherein the possession factor comprises a smartphone or a wearable electronic device that contains one or more user authentication credentials;
• obtaining, via the one or more communication networks from the possession factor, implicit authentication data, wherein the implicit authentication data comprises data indicative of user interactions with the smartphone or the wearable electronic device unrelated to authentication of the unauthorized device that does not explicitly indicate whether the possession factor is currently, or was recently, in possession of the user;
• using the implicit authentication data from the possession factor to determine a likelihood of possession of the possession factor by the user based on a possession factor continuum of a plurality of authentication requirements for authenticating the user, wherein, based on the implicit authentication data, the plurality of authentication requirements comprise at least one of:
• (1) performing automatic authentication of the transaction without intervention at the possession factor by the user,
• (2) performing user-interactive authentication based on transmitting a push notification to the possession factor, wherein the user-interactive authentication comprises a binary prompt for approval or denial of the transaction by the user,
• (3) performing additional authentication to verify an identity or authorization of the user attempting to perform the transaction, or
• (4) automatically denying authentication of the transaction;
• generating a likelihood of possession comprising generating a possession confidence score using the implicit authentication data and transaction request data provided with the authentication request, wherein the transaction request data comprises data exchanged as part of a transaction request initiating the transaction requiring authentication, and wherein the data exchanged comprises one or more of an originating service provider, an originating Internet Protocol (IP) address of the transaction request, a time of the transaction request, and details of a primary authentication for the transaction;
• and
• implicitly authenticating the user if the likelihood of possession satisfies a possession confidence threshold that enables implicit authentication of the user, wherein implicitly authenticating the user comprises using the implicit authentication data and the possession confidence score to determine whether to automatically authenticate the user.

One or more non-transitory computer readable media encoded with instructions that, when executed by a processor, cause the processor to perform operations including:

• obtaining, via one or more communication networks, an authentication request that initiates an implicit authentication process for a transaction involving authentication, wherein the authentication request is generated by a service provider, in response to receipt of an access request from an unauthorized device, and wherein the implicit authentication process includes passively authenticating a user based on whether implicit authentication data obtained from a possession factor indicates a calculated likelihood that the user has possession of the possession factor, wherein the possession factor comprises a smartphone or a wearable electronic device that contains one or more user authentication credentials;
• obtaining, via the one or more communication networks from the possession factor, implicit authentication data indicative of passive interactions of the user with the possession factor, wherein the implicit authentication data comprises data indicative of user interactions with the smartphone or the wearable electronic device unrelated to authentication of the unauthorized device that does not explicitly indicate whether the possession factor is currently, or was recently, in possession of the user;
• using the implicit authentication data from the possession factor to determine a likelihood of possession of the possession factor by the user based on a possession factor continuum of a plurality of authentication requirements for authenticating the user, wherein, based on the implicit authentication data, the plurality of authentication requirements comprise at least one of:
• (1) performing automatic authentication of the transaction without intervention at the possession factor by the user,
• (2) performing user-interactive authentication based on transmitting a push notification to the possession factor, wherein the user-interactive authentication comprises a binary prompt for approval or denial of the transaction by the user,
• (3) performing additional authentication to verify an identity or authorization of the user attempting to perform the transaction, or
• (4) automatically denying authentication of the transaction;
• generating a likelihood of possession comprising generating a possession confidence score using the implicit authentication data and transaction request data provided with the authentication request, wherein the transaction request data comprises data exchanged as part of a transaction request initiating the transaction requiring authentication, and wherein the data exchanged comprises one or more of an originating service provider, an originating Internet Protocol (IP) address of the transaction request, a time of the transaction request, and details of a primary authentication for the transaction;
• and;
• and
• implicitly authenticating the user if the likelihood of possession satisfies a possession confidence threshold that enables implicit authentication of the user, wherein implicitly authenticating the user comprises using the implicit authentication data and the possession confidence score to determine whether to automatically authenticate the user.