# US 8,782,761 B1 · Generating authentication challenges based on preferences of a user's contacts > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,782,761 B1 - Document ID: US8782761B1 - Status: Granted - Kind: B1 - Application number: 13/204,921 - Filed: 2011-08-08 - Granted: 2014-07-15 - Earliest claimed: 2011-08-08 - Assignees: Google Inc. - Applicants: Jessica Staddon - Inventors: Jessica Staddon - Web page: https://patentgrep.com/patent/US8782761B1 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - G06F 16/9535: Search customisation based on user profiles and personalisation - G06F 21/31: User authentication - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/606: {by securing the transmission between two devices or processes} - H04L 63/102: {Entity profiles} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Generating user authentication challenges based in part on preferences of one or more contacts of a user includes receiving an authentication request from a user. One or more contacts of the user associated with the authentication request are determined. One or more preferences of the close contact or contacts are determined. An authentication challenge based on the one or more preferences of one or more of the user's contacts is generated. The authentication request is allowed or denied based on the completion on the authentication challenge. ## Claims ### Claim 1 A computer-implemented method for generating user authentication challenges, the method comprising: receiving an authentication request from a user, wherein the authentication request includes primary authentication information and secondary authentication information from the user; in response to receiving the authentication request, detecting a potentially fraudulent authentication attempt based on the secondary authentication information from the user; identifying one or more contacts of an account owner based at least in part on a frequency of interaction between the account owner and the one or more contacts; determining one or more preferences of the one or more contacts based on an analysis of information about the one or more contacts; generating one or more authentication challenges based at least in part on the determined one or more preferences of the one or more contacts, the one or more authentication challenges including one or more questions about the determined one or more preferences of the one or more contacts based on the analysis; assessing a response to the one or more authentication challenges; and determining access based on the assessment. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving a response from the user and assessing completion of the one or more authentication challenges based on the response from the user. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the one or more contacts are identified at least in part by how recently the one or more contacts and the account owner interacted. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the one or more contacts are identified at least in part by a type or a number of commonalities between the account owner and the one or more contacts alone or in combination. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the one or more contacts are identified at least in part by a duration of contact or relationship between the account owner and the one or more contacts. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the one or more contacts are identified at least in part by an affiliation of the one or more contacts with the account owner. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the one or more contacts are identified by statistically weighing a plurality of factors. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the one or more preferences of the one or more contacts are determined explicitly from data of the one or more contacts. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the one or more preferences of the one or more contacts are determined implicitly from data of the one or more contacts. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein the one or more preferences of the one or more contacts are determined inferentially from data of the one or more contacts. ### Claim 11 (depends on 1) The computer-implemented method of claim 1, wherein the potentially fraudulent authentication attempt includes a failed authentication attempt. ### Claim 12 (depends on 10) The computer-implemented method of claim 10, wherein the inferential determination includes determining the one or more preferences based on data collected from the one or more contacts playing an online game. ### Claim 13 A system for generating user authentication challenges, the system comprising: one or more processors; an authentication receiver stored on a memory and executable by the one or more processors, the authentication receiver for receiving an authentication request from a user, wherein the authentication request includes primary authentication information and secondary authentication information from the user; a fraudulent authentication detection engine stored on the memory and executable by the one or more processors, the fraudulent authentication detection engine for detecting a potentially fraudulent authentication attempt based on the secondary authentication information from the user; a close contact identifier engine stored on the memory and executable by the one or more processors, the close contact identifier engine for identifying one or more contacts of an account owner based at least in part on a frequency of interaction between the account owner and the one or more contacts; a contact preference engine stored on the memory and executable by the one or more processors, the contact preference engine for determining one or more preferences of the one or more contacts based on an analysis of information about the one or more contacts; a challenge generation engine stored on the memory and executable by the one or more processors, the challenge generation engine for generating an authentication challenge based on the determined one or more preferences of the one or more contacts, the authentication challenge including a question about the determined one or more preferences of the one or more contacts based on the analysis; assess a response to the one or more authentication challenges; and determine access based on the assessment. ### Claim 14 (depends on 13) The system of claim 13, further comprising: a challenge assessment engine for receiving a response from the user and assessing completion of the authentication challenge based on the response from the user. ### Claim 15 (depends on 13) The system of claim 13, wherein the one or more contacts are identified at least in part by how recently the one or more contacts and the account owner have interacted. ### Claim 16 (depends on 13) The system of claim 13, wherein the one or more contacts are identified at least in part by a type or a number of commonalities between the account owner and the one or more contacts alone or in combination. ### Claim 17 (depends on 13) The system of claim 13, wherein the one or more contacts are identified at least in part by a duration of contact between the account owner and the one or more contacts. ### Claim 18 (depends on 13) The system of claim 13, wherein the one or more contacts are identified at least in part by an affiliation of the one or more contacts with the account owner. ### Claim 19 (depends on 13) The system of claim 13, wherein the one or more contacts are identified by statistically weighing a plurality of factors. ### Claim 20 (depends on 13) The system of claim 13, wherein the one or more preferences of the one or more contacts are determined explicitly from data of the one or more contacts. ### Claim 21 (depends on 13) The system of claim 13, wherein the one or more preferences of the one or more contacts are determined implicitly from data of the one or more contacts. ### Claim 22 (depends on 13) The system of claim 13, wherein the one or more preferences of the one or more contacts are determined inferentially from data of the one or more contacts. ### Claim 23 (depends on 13) The system of claim 13, wherein the potentially fraudulent authentication attempt includes a failed authentication attempt. ### Claim 24 (depends on 22) The system of claim 22, wherein the inferential determination includes determining the one or more preferences based on data collected from the one or more contacts playing an online game. ### Claim 25 A computer program product comprising a non-transitory computer usable storage medium including a computer readable program, the computer readable program when executed by a processor causes the processor to: receive an authentication request from a user, wherein the authentication request includes primary authentication information and secondary authentication information from the user; in response to receiving the authentication request, detect a potentially fraudulent authentication attempt based on the secondary authentication information from the user; identify one or more contacts of an account owner based at least in part on a frequency of interaction between the account owner and the one or more contacts; determine one or more preferences of the one or more contacts based on an analysis of information about the one or more contacts; generate one or more authentication challenges based at least in part on the determined one or more preferences of the one or more contacts, the one or more authentication challenges including one or more questions about the determined one or more preferences of the one or more contacts based on the analysis; assess a response to the one or more authentication challenges; and determine access based on the assessment.