# US 9,519,761 B2 · Systems and methods for authentication using low quality and high quality authentication information > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,519,761 B2 - Document ID: US9519761B2 - Status: Granted - Kind: B2 - Application number: 13/605,886 - Filed: 2012-09-06 - Published: 2014-03-06 - Granted: 2016-12-13 - Earliest claimed: 2012-09-06 - Assignees: Paypal, Inc. - Applicants: Bjorn Markus Jakobsson - Inventors: Bjorn Markus Jakobsson - Web page: https://patentgrep.com/patent/US9519761B2 ## CPC - G06F 21/31: User authentication - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04W 12/06: Authentication - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - G06F 2221/2113: Multi-level security, e.g. mandatory access control - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems, methods, and devices for authenticating a user are provided. A device includes one or more processors configured to determine if a requested service requires high quality authentication, generate a request for high quality authentication if the requested service requires high quality authentication, and generate a request for low quality authentication if the requested service requires low quality authentication. The device also include a network interface component coupled to a network, the network interface component configured to: receive the request for the service requiring authentication, and a memory, the memory storing high quality authentication information and low quality authentication information for authenticating the user. ## Claims ### Claim 1 A system, for authenticating a user, comprising: a non-transitory memory storing instructions, high quality authentication information, and low quality authentication information; and one or more hardware processors coupled to the non-transitory memory and configured to execute instructions to cause the system to perform operations comprising: determining whether a requested service associated with a user triggers (i) a request for high quality authentication information from the user or (ii) a request for low quality authentication information from the user based on whether a previously performed authentication within a predetermined amount of time was a successful high quality authentication; generating a request for low quality authentication information in response to determining that the previously performed authentication within the predetermined amount of time was a successful high quality authentication; obtaining low quality authentication information responsive to the request for low quality authentication information; in response to that determining the user does not pass a low quality authentication based on the obtained low quality authentication information, determining whether the requested service requires a successful authentication; and responsive to determining that the requested service does not require a successful authentication, allowing the request for service. ### Claim 2 (depends on 1) The system of claim 1, wherein a request for high quality authentication information comprises a request for the user to provide at least one of a user name, a password, a biometric identifier, or a combination thereof. ### Claim 3 (depends on 1) The system of claim 1, wherein a request for low quality authentication information comprises a request for the user to provide at least one of an image of the user, a biometric identifier of the user, a location, sensor information, or a combination thereof. ### Claim 4 (depends on 1) The system of claim 1, wherein the operations further comprise: requesting the user to perform a low quality authentication on a predefined time schedule. ### Claim 5 (depends on 1) The system of claim 1, wherein the request for low quality authentication information comprises a plurality of requests for low quality authentication information. ### Claim 6 A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising: receiving, from a user, a request for a service that requires authentication; determining whether the requested service triggers a high quality authentication information or a request for low quality authentication information based on a previously performed successful authentication within a predetermined amount of time; performing a high quality authentication if the service triggers a request for high quality authentication information; performing a low quality authentication if the service triggers a request for the low quality authentication information; determining whether the requested service requires a successful authentication responsive to determining that the user does not pass the high quality authentication or the low quality authentication; and allowing the request for service responsive to determining that the service does not require a successful authentication. ### Claim 7 (depends on 6) The non-transitory machine-readable medium of claim 6, wherein the operations further comprise: determining whether the requested service triggers a request for high quality authentication information or a request for low quality authentication information based on an existence of a valid user session. ### Claim 8 (depends on 6) The non-transitory machine-readable medium of claim 6, wherein performing the high quality authentication comprises performing an authentication based on at least one of a user name, a password, a biometric identifier, or a combination thereof. ### Claim 9 (depends on 6) The non-transitory machine-readable medium of claim 6, wherein performing the low quality authentication comprises performing an authentication based on at least one of an image of the user, a biometric identifier of the user, a location, sensor information, or a combination thereof. ### Claim 10 (depends on 6) The non-transitory machine-readable medium of claim 6, wherein determining whether the requested service triggers a request for high quality authentication information comprises: determining whether the requested service is a service that always triggers a request for high quality authentication information; or determining whether the requested service exceeds a predetermined risk threshold. ### Claim 11 (depends on 6) The non-transitory machine-readable medium of claim 6, wherein performing the high quality authentication comprises performing a plurality of authentications. ### Claim 12 A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising: performing an initial authentication successfully; receiving, from a user, a request for a service; determining that the requested service triggers a request for low quality authentication information in response to determining that the initial authentication was successfully performed within a predetermined amount of time and is a high quality authentication; obtaining the low quality authentication information responsive to the request for low quality authentication information; performing a low quality authentication based on the obtained low quality authentication information; permitting the service responsive to determining that the low quality authentication is successfully performed; in response to that determining the low quality authentication is not successfully performed, determining whether the requested service requires a successful authentication; and responsive to determining that the requested service does not require a successful authentication, allowing the request for service. ### Claim 13 (depends on 12) The non-transitory machine-readable medium of claim 12, wherein performing the high quality authentication comprises: requesting high quality authentication information from the user; and receiving the requested high quality authentication information from the user. ### Claim 14 (depends on 13) The non-transitory machine-readable medium of claim 13, wherein the high quality authentication is performed based on at least one of a user name, a password, a biometric identifier, or a combination thereof. ### Claim 15 (depends on 12) The non-transitory machine-readable medium of claim 12, wherein a request for low quality authentication information comprises: a request for at least one of an image of the user, a biometric identifier of the user, a location, sensor information, or a combination thereof. ### Claim 16 (depends on 12) The non-transitory machine-readable medium of claim 12, wherein determining that the service triggers a request for low quality authentication information when the initial authentication is a high quality authentication comprises: determining whether the requested service is a service that always triggers a request for high quality authentication information; or determining whether the requested service exceeds a predetermined risk threshold. ### Claim 17 A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising: transmitting a request for service; receiving, from a user, a request for authentication information; in response to receiving the request for authentication information, determining that the request for authentication information is a request for low quality authentication information, the determination being based on a previously performed successful authentication being a high quality authentication performed within a predetermined amount of time; obtaining low quality authentication information, responsive to the request for low quality authentication information; responsive to determining that the user does not pass a low quality authentication based on the obtained low quality authentication information, determining whether the requested service requires a successful authentication; and responsive to determining that the requested service does not require a successful authentication, allowing the request for service. ### Claim 18 (depends on 17) The non-transitory machine-readable medium of claim 17, wherein the request for high quality authentication information comprises a request for at least one of a user name, a password, a biometric identifier, or a combination thereof. ### Claim 19 (depends on 17) The non-transitory machine-readable medium of claim 17, wherein a request for low quality authentication information comprises a request for at least one of an image of the user, a biometric identifier of the user, a location, sensor information, or a combination thereof. ### Claim 20 (depends on 19) The non-transitory machine-readable medium of claim 19, wherein the request for the low quality information comprises a request for periodically capturing, from the user, low quality authentication information. ### Claim 21 (depends on 20) The non-transitory machine-readable medium of claim 20, wherein periodically capturing the low quality authentication information comprises automatically capturing, without affirmatively requiring user action, from the user the low quality authentication information. ### Claim 22 (depends on 1) The method of claim 1, further comprising: determining whether the requested service triggers a request for high quality authentication information or a request for low quality authentication information based on an existence of a valid user session. ### Claim 23 (depends on 12) The non-transitory machine-readable medium of claim 12, wherein the operations further comprise: determining whether the requested service triggers a request for high quality authentication information or a request for low quality authentication information based on an existence of a valid user session. ### Claim 24 (depends on 17) The non-transitory machine-readable medium of claim 17, wherein the operations further comprise: determining whether the requested service triggers a request for high quality authentication information or a request for low quality authentication information based on an existence of a valid user session.