Variable biometrics for multi-factor authentication

• US 10,163,105 B1
• Filed: 01/20/2015
• Issued: 12/25/2018
• Est. Priority Date: 01/24/2014
• Status: Active Grant

• Current Assignee: Microstrategy Incorporated
• Original Assignee: Microstrategy Incorporated
• Inventors: Ziraknejad, Siamak, Li, Elaine, Huang, Ren-Jay
• Primary Examiner(s): Le, Thien M
• Assistant Examiner(s): Kim, Tae
• Application Number:
  US14/600,274
• Time in Patent Office: 1,435 Days
• Field of Search: 235380
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 20/3274 using a pictured code, e.g. barcode or QR-code, being displayed on the M-device
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing

Abstract

In one implementation, requirement client device receives an indication of a transaction. The client device determines risk profile information and a credential for the transaction. The risk profile information describes a location of the client device, a time associated with the transaction, and a transaction provider to complete the transaction Finally, the client device prompts for biometric input based on the location of the client device, the time associated with the transaction, the transaction provider to complete the transaction, and the credential.

Claims

1. A computer-implemented method comprising:

generating, by a client device, motion data based on sensor readings from one or more sensors of the client device, the motion data indicating motion of the client device for at least a period of time before or during a first transaction;

scanning, by the client device, an optical code, wherein the motion data indicates the motion of the client device to reach a position where the client device scanned the optical code;

receiving, by the client device, an indication of a transaction, wherein the client device is configured to selectively prompt a user for biometric input of a type that is dynamically selected from among multiple different types of biometric input based at least on an analysis of the motion data;

determining, by the client device, risk profile information and a credential for the first transaction, the risk profile information describing a location of the client device, a time associated with the first transaction, and a transaction provider to complete the first transaction, and the risk profile information is based on a comparison of (i) the data indicating the motion of the client device to reach the position where the client device scanned the optical code with (ii) data that describes motion of the client device to reach one or more positions where the client device scanned an optical code for one or more prior transactions; and

providing, by the client device, a prompt for biometric input that requests input of a particular type of biometric input that is dynamically selected from among the multiple different types of biometric input, wherein the particular type of biometric input is selected according to an authentication requirement based on the motion data, the location of the client device, the time associated with the transaction, the transaction provider to complete the transaction, and the credential.

2. The method of claim 1, wherein receiving an indication of a transaction comprises:

receiving the indication of the transaction by obtaining an optical machine-readable representation for the transaction.

3. The method of claim 1, wherein receiving, by the client device, an indication of a transaction comprises:

obtaining an acoustic representation for the transaction.

4. The method of claim 1, wherein determining risk profile information and a credential for the transaction comprises:

identifying a credential stored on the client device that corresponds with the transaction.

5. The method of claim 1, comprising:

providing the risk profile information and the credential to a server;

receiving, from the server, a request for the biometric input; and

determining to prompt for the biometric input based on receiving the request for the biometric input.

6. The method of claim 1, comprising:

obtaining a risk level for the transaction based on the risk profile information and the credential;

determining a biometric authentication requirement based on the risk level; and

determining to prompt for the biometric input based on the biometric authentication requirement.

7. The method of claim 6, wherein obtaining a risk level for the transaction based on the risk profile information and the credential comprises:

determining a level of similarity between the risk profile information and historical information describing motion of the client device for previous transactions; and

determining the risk level for the transaction based on the determined level of similarity.

8. The method of claim 6, wherein obtaining a risk level for the transaction based on the risk profile information and the credential comprises:

providing the risk profile information and the credential to a server; and

receiving the risk level for the transaction from the server.

9. The method of claim 1, comprising:

determining an environmental condition that potentially interferes with biometric authentication using a biometric input; and

in response to determining the environmental condition that potentially interferes with the biometric authentication using the biometric input, determining, by the client device, to prompt for another type of biometric input.

10. The method of claim 9, wherein determining an environmental condition that potentially interferes with biometric authentication using a biometric input comprises:

determining that the biometric input indicates the environmental condition that potentially interferes with the biometric authentication using the biometric input.

11. The method of claim 1, comprising:

receiving the biometric input from a user;

providing the received biometric input to a server;

in response to providing the received biometric input to the server, receiving a confirmation of an identity of the user; and

in response to receiving a confirmation of an identity of the user, providing a confirmation of the identity of the user to a transaction provider to complete the transaction.

12. The method of claim 1, comprising selecting voice input from among the multiple different types of biometric input;

wherein providing the prompt for biometric input comprises providing a prompt for voice input.

13. The method of claim 1, comprising selecting fingerprint input from among the multiple different types of biometric input;

wherein providing the prompt for biometric input comprises providing a prompt for fingerprint input.

14. The method of claim 1, comprising selecting voice input and fingerprint input from among the multiple different types of biometric input;

wherein providing the prompt for biometric input comprises providing a prompt for voice input, fingerprint input, and a non-biometric authentication input.

15. The method of claim 1, wherein the motion data includes data that describes a path the client device travelled during the period of time before the transaction;

and

wherein the risk profile information is based on a comparison of the data that describes the path with data that describes one or more paths that the client device travelled before one or more prior transactions of the user.

16. The method of claim 1, wherein the motion data includes data that describes an orientation of the client device during the transaction;

and

wherein the risk profile information is based on a comparison of the data that describes the orientation with data that describes one or more orientations of the client device during one or more prior transactions of the user.

17. The method of claim 1, wherein the method comprises scanning, by the client device, an optical code;

and

wherein the motion data includes data that describes motion of or an orientation of the client device during scanning of the optical code.

18. A system comprising:

one or more computers; and

one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprising;

generating, by a client device, motion data based on sensor readings from one or more sensors of the client device, the motion data indicating motion of the client device for at least a period of time before or during a first transaction;

scanning, by the client device, an optical code, wherein the motion data indicates the motion of the client device to reach a position where the client device scanned the optical code;

receiving, by the client device, an indication of a transaction, wherein the client device is configured to selectively prompt a user for biometric input of a type that is dynamically selected from among multiple different types of biometric input based at least on an analysis of the motion data;

determining, by the client device, risk profile information and a credential for the first transaction, the risk profile information describing a location of the client device, a time associated with the first transaction, and a transaction provider to complete the first transaction, and the risk profile information is based on a comparison of (i) the data indicating the motion of the client device to reach the position where the client device scanned the optical code with (ii) data that describes motion of the client device to reach one or more positions where the client device scanned an optical code for one or more prior transactions; and

providing, by the client device, a prompt for biometric input that requests input of a particular type of biometric input that is dynamically selected from among the multiple different types of biometric input, wherein the particular type of biometric input is selected according to an authentication requirement based on the motion data, the location of the client device, the time associated with the transaction, the transaction provider to complete the transaction, and the credential.

19. A non-transitory computer-readable medium storing software comprising instructions executable by one or more computers which, upon such execution, cause the one or more computers to perform operations comprising:

generating, by a client device, motion data based on sensor readings from one or more sensors of the client device, the motion data indicating motion of the client device for at least a period of time before or during a first transaction;

scanning, by the client device, an optical code, wherein the motion data indicates the motion of the client device to reach a position where the client device scanned the optical code;

receiving, by the client device, an indication of a transaction, wherein the client device is configured to selectively prompt a user for biometric input of a type that is dynamically selected from among multiple different types of biometric input based at least on an analysis of the motion data;

determining, by the client device, risk profile information and a credential for the first transaction, the risk profile information describing a location of the client device, a time associated with the first transaction, and a transaction provider to complete the first transaction, and the risk profile information is based on a comparison of (i) the data indicating the motion of the client device to reach the position where the client device scanned the optical code with (ii) data that describes motion of the client device to reach one or more positions where the client device scanned an optical code for one or more prior transactions; and

providing, by the client device, a prompt for biometric input that requests input of a particular type of biometric input that is dynamically selected from among the multiple different types of biometric input, wherein the particular type of biometric input is selected according to an authentication requirement based on the motion data, the location of the client device, the time associated with the transaction, the transaction provider to complete the transaction, and the credential.