Authenticating user sessions based on reputation of user locations

摘要

User sessions are authenticated based on locations associated with a user account used for sending a request for creating a session. Examples of locations of a source of a request include a geographical location, a network address, or a machine cookie associated with a device sending the request. Locations of the request are compared with stored safe locations associated with the user account and a suspiciousness index is determined for the session. The level of authentication required for the session is determined based on the suspiciousness index. Locations are associated with a reputation based on past history of sessions originating from the locations. A location associated with a history of creating suspicious session is considered an unsafe location. Reputation of the location originating the session is used to determine the level of authentication required for the session.

主权项

1. A computer implemented method comprising:
receiving a request for creating a session from a computing device; identifying a location associated with the computing device originating the request; receiving a measure of reputation of the location, wherein the measure of reputation of the location is determined based at least in part on a set of past sessions of a plurality of other users that originated from the location, the measure of reputation indicating the location as being safe if more than a threshold of past sessions correspond to benign requests, wherein a request is classified as a benign request if the request is for access to information of a user by another user connected to the user via a social networking system; determining a level of authentication required from the sender of the request based on the measure of reputation of the location; and sending a request for authentication, wherein the information requested for authentication is determined based on the determined level of authentication.