Interactive authentication

A system of one or more computers configured to perform operations for authenticating end users comprising:

• receiving a valid authentication credential associated with a digital identity, the valid authentication credential received from an end user at an input device in association with a login attempt;
• determining whether an identification token is received with the valid authentication credential;
• identifying the identification token as a token included in a list of valid tokens associated with the digital identity at an authentication system in response to the determination that the identification token is received;
• determining, in response to the identification token being identified as included in the list of valid tokens, whether a lockout period associated with the identification token in the list of valid tokens has expired;
• authenticating the end user associated with the login attempt in response to the determination that the lockout period has expired;
• determining, in response to the determination that the identification token is not received, whether a lockout period associated with the digital identity has expired;
• generating, in response to the determination that the lockout period associated with the digital identity has not expired, a new identification token associated with the current lockout period;
• adding the new identification token in the list of valid tokens associated with the digital identity;
• and
• rejecting the authentication of the end user associated with the login attempt.

A non-transitory computer-readable medium encoded with a computer program, the program comprising instructions that when executed by one or more computers cause the one or more computers to perform operations for authenticating an end user comprising:

• receiving a valid authentication credential associated with a digital identity, the valid authentication credential received from the end user at an input device in association with a login attempt;
• determining whether an identification token is received with the valid authentication credential;
• identifying the identification token as a token included in a list of valid tokens associated with the digital identity at an authentication system in response to the determination that the identification token is received;
• determining, in response to the identification token being identified as included in the list of valid tokens, whether a lockout period associated with the identification token in the list of valid tokens has expired;
• authenticating the end user associated with the login attempt in response to the determination that the lockout period has expired;
• determining, in response to the determination that the identification token is not received, whether a lockout period associated with the digital identity has expired;
• generating, in response to the determination that the lockout period associated with the digital identity has not expired, a new identification token associated with the current lockout period;
• adding the new identification token in the list of valid tokens associated with the digital identity;
• and
• rejecting the authentication of the end user associated with the login attempt.