scope:

This Recommendation specifies a risk identification function in an information and communication technology (ICT) service system as a pre-processor before the authentication function is invoked. It enables the ICT service system to optimize user authentication based on identified risks.

This Recommendation covers the following topics:

- a reference model of an ICT service system where a risk identification function is introduced in between the core service-handling subsystem and the authentication subsystem;

- a detailed explanation of the component modules of this risk identification function, and how risks are identified, and user authentication is optimized;

- alternative processing designs for the risk identification engine.