Access control for requests to services

A system for controlling access to services for processing requests, comprising:

• one or more processors coupled with memory, configured to:
• maintain a plurality of rules defined for a plurality of risk levels to control requests for accessing at least one of a plurality of second services based on likelihoods associated with the requests as being fraudulent, the plurality of rules for at least one of a plurality of transaction types, the plurality of rules comprising a first rule for an allowance of access, a second rule for a denial of access, and a third rule for a challenge, the plurality of transaction types corresponding to a corresponding plurality of functions to be performed on at least one of the plurality of second services;
• receive for a first risk level of the plurality of risk levels, an instruction defining a first group of rules from the plurality of rules to apply to requests identified with the first risk level, each of the plurality of risk levels corresponding to a respective range of likelihoods associated with the requests as being fraudulent;
• configure, responsive to receiving the instruction, the first risk level of the plurality of risk levels with the first of group of rules of the plurality of rules in accordance with the instruction, the first group of rules including a subset of rules of a second group of rules configured for a second risk level of the plurality of risk levels;
• receive a request of a transaction type of the plurality of transaction types for an end user device to access a resource on a second service of the plurality of second services, the request including authentication information;
• determine (i) a plurality of risk parameters defining a corresponding plurality of criteria to determine a likelihood that the request is fraudulent and (ii) a challenge threshold in accordance to which to challenge the request, based on the plurality of criteria comprising the transaction type of the request, the end user device, and the second service to be accessed;
• identify, from the plurality of risk levels, the first risk level indicating a likelihood that the request is fraudulent based on the plurality of risk parameters, the risk level defining the group of rules at least partially shared with another risk level of the plurality of risk levels;
• select the first group of rules from the plurality of rules to apply for the identified risk level;
• and
• apply the first group of rules to the authentication information to perform at least one of the denial, the allowance, or the challenge of the request of the transaction type using the challenge threshold, for the end user device to access the resource on the second service for performing the function according to the transaction type of the request.

A non-transitory computer readable medium storing instructions, which when executed by at least one processor, cause the at least one processor to:

• maintain a plurality of rules defined for a plurality of risk levels to control requests for accessing at least one of a plurality of second services based on likelihoods associated with the requests as being fraudulent, the plurality of rules for at least one of a plurality of transaction types, the plurality of rules comprising a first rule for an allowance of access, a second rule for a denial of access, and a third rule for a challenge, the plurality of transaction types corresponding to a corresponding plurality of functions to be performed on at least one of the plurality of second services;
• receive for a first risk level of the plurality of risk levels, an instruction defining a first group of rules from the plurality of rules to apply to requests identified with the first risk level, each of the plurality of risk levels corresponding to a respective range of likelihoods associated with the requests as being fraudulent;
• configure, responsive to receiving the instruction, the first risk level of the plurality of risk levels with the first of group of rules of the plurality of rules in accordance with the instruction, the first group of rules including a subset of rules of a second group of rules configured for a second risk level of the plurality of risk levels;
• receive a request of a transaction type of the plurality of transaction types for an end user device to access a resource on a second service of the plurality of second services, the request including authentication information;
• determine (i) a plurality of risk parameters defining a corresponding plurality of criteria to determine a likelihood that the request is fraudulent and (ii) a challenge threshold in accordance to which to challenge the request, based on the plurality of criteria comprising the transaction type of the request, the end user device, and the second service to be accessed;
• identify, from the plurality of risk levels, the first risk level indicating a likelihood that the request is fraudulent based on the plurality of risk parameters, the risk level defining the group of rules at least partially shared with another risk level of the plurality of risk levels;
• select the first group of rules from the plurality of rules to apply for the identified risk level;
• and
• apply the first group of rules to the authentication information to perform at least one of the denial, the allowance, or the challenge of the request of the transaction type using the challenge threshold, for the end user device to access the resource on the second service for performing the function according to the transaction type of the request.