Public authentication systems and methods

• US 10,263,981 B1
• Filed: 11/30/2016
• Issued: 04/16/2019
• Est. Priority Date: 12/02/2015
• Status: Active Grant

• Current Assignee: United Services Automobile Association
• Original Assignee: United Services Automobile Association
• Inventors: Prasad, Bharat, Oakes, III, Charles Lee, Vijayvergia, Gunjan C., Jayapalan, Vijay, Buckingham, Thomas Bret
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US15/365,480
• Time in Patent Office: 867 Days
• Field of Search: 726 2- 7, 713168, 713182, 713186
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

Techniques provided herein relate to electronic authentication on public systems. A backend system receives at least one electronic data action request from a publicly available client system that is shared amongst a plurality of users. At least a portion of the primary authentication information is received from a secondary device separate from the publicly available client system. The electronic data action request is authenticated by determining if the primary authentication information matches expected primary authentication information that is expected to complete the electronic data action request. Performance of the electronic data action request is facilitated when the primary authentication information matches the expected primary authentication information.

Claims

1. An authentication system for electronic data, comprising:

a backend system, comprising;

non-volatile storage storing;

the electronic data, wherein permission to perform actions on the electronic data is limited to a user or set of users; and

a set of user profiles, wherein at least one of the set of user profiles comprises a user profile associated with the user or the set of users; and

at least one hardware-based processor configured to;

receive, from a client system, a request to perform an action on the electronic data;

receive primary authentication information and secondary authentication information, from the client system, a secondary device, or both;

authenticate the request by;

identifying a user profile associated with the primary authentication information;

determining whether the user profile associated with the primary authentication information is associated with the user or set of users;

determining whether the primary authentication information matches expected primary authentication of the user profile associated with the primary authentication information; and

determining whether the secondary authentication information matches or sufficiently overlaps with expected secondary authentication information of the user profile;

determining the request is authenticated when;

the user profile associated with the primary authentication information is associated with the user or set of users;

the primary authentication information matches the expected primary authentication of the user profile associated with the primary authentication information; and

the secondary authentication information matches or sufficiently overlaps with the expected secondary authentication information of the user profile; and

determining the request is not authenticated when;

the user profile associated with the primary authentication information is not associated with the user or set of users;

the primary authentication information does not match the expected primary authentication of the user profile associated with the primary authentication information;

or

the secondary authentication information does not match or sufficiently overlap the expected secondary authentication information of the user profile; and

when the request is authenticated, perform the action; and

when the request is not authenticated, deny performance of the action.

2. The authentication system of claim 1, wherein the primary authentication information comprises a username and password combination.

3. The authentication system of claim 1, wherein the primary authentication information comprises information sourced from the secondary device.

4. The authentication system of claim 3, wherein the primary authentication information comprises a unique identifier of the secondary authentication device.

5. The authentication system of claim 4, wherein the unique identifier comprises a media access control (MAC) address of the secondary device.

6. The authentication system of claim 3, wherein the primary authentication information comprises a cookie, token, or both stored on the secondary device.

7. The authentication system of claim 1, wherein the primary authentication information comprises biometric information.

8. The authentication system of claim 7, wherein the biometric information is obtained via one or more sensors of the secondary device.

9. The authentication system of claim 1, wherein the secondary authentication information comprises information sourced from the secondary device.

10. The authentication system of claim 9, wherein the secondary authentication information comprises a unique identifier of the secondary device, biometric information obtained via a sensor of the secondary device, or both.

11. The authentication system of claim 1, wherein:

the primary authentication information and secondary authentication information is received from the client system; and

the secondary authentication information comprises information sourced from the secondary device.

12. The authentication system of claim 1, wherein:

the primary authentication information and secondary authentication information is received from the client system; and

the secondary authentication information comprises information sourced from the secondary device.

13. The authentication system of claim 1, wherein:

the primary authentication information is received from the client system;

the secondary authentication information is received from the secondary device; and

the secondary authentication information comprises information sourced from the secondary device.

14. A tangible, non-transitory, machine-readable medium, comprising machine-readable instructions that when executed by one or more processors of an electronic device, cause the electronic device to:

receive, from a client system, a request to perform an action on electronic data, wherein permission to perform actions on the electronic data is limited to a user of a set of users;

receive primary authentication information and secondary authentication information, from the client system, a secondary device, or both;

authenticate the request by;

identifying a user profile associated with the primary authentication information;

determining whether the user profile associated with the primary authentication information is associated with the user or set of users;

determining whether the primary authentication information matches expected primary authentication of a user profile associated with the primary authentication information;

determining whether the secondary authentication information matches or sufficiently overlaps with expected secondary authentication information of the user profile;

determining the request is authenticated when;

the user profile associated with the primary authentication information is associated with the user or set of users;

the primary authentication information matches the expected primary authentication of the user profile associated with the primary authentication information; and

the secondary authentication information matches or sufficiently overlaps with the expected secondary authentication information of the user profile; and

determining the request is not authenticated when;

the user profile associated with the primary authentication information is not associated with the user or set of users;

the primary authentication information does not match the expected primary authentication of the user profile associated with the primary authentication information;

or

the secondary authentication information does not match or sufficiently overlap the expected secondary authentication information of the user profile; and

when the request is authenticated, perform the action; and

when the request is not authenticated, deny performance of the action.

15. The machine-readable medium of claim 14, wherein the secondary authentication information comprises information sourced from the secondary device.

16. The machine-readable medium of claim 15, comprising instructions to receive the secondary authentication information from client system.

17. The machine-readable medium of claim 15, comprising instructions to receive the secondary authentication information from the secondary device.

18. A computer-implemented method, comprising:

receiving, from a client system, a request to perform an action on electronic data, wherein permission to perform actions on the electronic data is limited to a user of a set of users;

receiving primary authentication information and secondary authentication information, from the client system, a secondary device, or both;

authenticating the request by;

identifying a user profile associated with the primary authentication information;

determining whether the user profile associated with the primary authentication information is associated with the user or set of users;

determining whether the primary authentication information matches expected primary authentication of a user profile associated with the primary authentication information; and

determining whether the secondary authentication information matches or sufficiently overlaps with expected secondary authentication information of the user profile;

determining the request is authenticated when;

the user profile associated with the primary authentication information is associated with the user or set of users;

the primary authentication information matches the expected primary authentication of the user profile associated with the primary authentication information; and

the secondary authentication information matches or sufficiently overlaps with the expected secondary authentication information of the user profile; and

determining the request is not authenticated when;

the user profile associated with the primary authentication information is not associated with the user or set of users;

the primary authentication information does not match the expected primary authentication of the user profile associated with the primary authentication information;

or

the secondary authentication information does not match or sufficiently overlap the expected secondary authentication information of the user profile;

when the request is authenticated, perform the action; and

when the request is not authenticated, deny performance of the action.