Incorporating risk-based decision in standard authentication and authorization systems

A system for authorizing a user device for access to protected services based on risk-based decisions, the system comprising:

• a resource server hosting an application that accesses protected services;
• a user device configured to communicate with the resource server to access the protected services;
• an authentication server providing an authentication service for the application that accesses the protected services, the authentication server is configured for performing an authentication process, the authentication process comprising:
• enrolling the user device with the application hosted by the application server;
• capturing attributes pertaining to a user of the user device and/or the user device;
• determining a risk of data security based on the attributes pertaining to the user and/or the user device;
• when the risk is an unacceptable risk, requiring additional authentication for access to the protected services;
• and
• when the risk is an acceptable risk, granting access to the protected services without requiring additional authentication.

A non-transitory computer readable storage device for providing an enhanced authentication process with risk-based decision making for granting and maintaining access to an application that accesses protected services, the non-transitory computer readable storage device having computer executable instructions for performing the steps of:

• enrolling a user and user device;
• capturing attributes pertaining to the user and/or the user device;
• determining a risk of data security based on the attributes pertaining to the user and/or the user device;
• when the risk is an unacceptable risk, requiring additional authentication for access to protected services;
• and
• when the risk is an acceptable risk, granting access to the protected services without requiring additional authentication.