Trusted device-specific authentication

One or more computer readable storage devices having computer-executable instructions to enable a computer process to perform multiple-factor authentication of a user within an account network, the account network having an authorization service that manages user accounts of users of the account network and that verifies requests, received via a network, of the users of the account network to access servers in the account network, the computer process comprising:

• receiving via the network, by the authorization service, a request initiated by a device to associate a device identifier of a device credential with a user identifier of a user credential of the user, the device credential corresponding to the device and employed by the user to access the account network, the device operated by the user;
• responsive to the request, configuring an account of the user to comprise an association between the user identifier and the device identifier, the association representing a trust relationship between the user and the device;
• responsive to an access request by the device, evaluating a credential from the device against the user credential and the device credential to generate verification results;
• and
• according to the verification results, generating a token usable by the device to access the servers in the account network, wherein the token is generated to comprise an indication of a first privilege granted when the user credential and the device credential have been verified, and wherein the token is generated to comprise an indication of a second privilege when the user credential is verified and the device credentials has not been verified.

A method of authorizing a user with a level of privilege for accessing an account network resource, the method comprising:

• receiving, via a network, evidence of identity from a device through which the user is attempting to access the account network resource;
• interrogating the evidence of identity to determine whether the evidence of identity indicates successful verification of both a user credential of the user and a device credential& of the device by an authentication provider trusted by the account network resource, the authentication provider comprising a network service used by users of the account network resource for authentication over the network;
• generating a first token granting a first level of privilege to the user when using the device within the account network if the evidence of identity indicates successful verification of both the user credential of the user and the device credential of the device by the authentication provider;
• and
• generating a second token granting a second level of privilege to the user using the device within the account network if the evidence of identity indicates successful verification of the user credentials and unsuccessful verification of the device credentials of the device by the authentication provider.