System and Method for Authentication

A computer system comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the system to:
• receive an authentication request from an external device for authenticating an application on the external device;
• evaluate the authentication request based on a plurality of information items from a plurality of different externally residing information sources, the plurality of information items including at least one characteristic of the external device;
• issue an authentication token to the external device based on the evaluating the authentication request;
• receive login information for a user of the external device, subsequent to issuing the authentication token;
• issue a login token to the external device in response to the receiving the login information;
• receive a request for access to private information and a confirmation of the authentication token and the login token;
• and
• selectively permit access to the private information by the external device through the application, based on the confirmation of the authentication token and the login token.

A non-transitory machine-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform steps comprising:

• receiving an authentication request from an external device for authenticating an application on the external device;
• receiving a plurality of information items from a plurality of different externally residing information sources, the plurality of information items including at least one characteristic of the external device;
• evaluating the authentication request, including evaluating each of the plurality of information items using a scoring system, to determine an authentication status of the application;
• issuing an authentication token to the external device, the authentication token including token information reflecting the authentication status and indicating a degree of certainty that the application or the external device is compromised based on the evaluating each of the plurality of information items;
• receiving login information for a user of the external device, subsequent to issuing the authentication token;
• issuing a login token to the external device in response to the receiving the login information;
• receiving a request for access to private information and a confirmation of the authentication token and the login token;
• and
• providing a selected degree of access to the private information by the external device through the application, based on the authentication status and the degree of certainty that the application or the external device is compromised.