Systems and methods for providing credentialless login using a random one-time passcode

• US 10,454,924 B1
• Filed: 12/31/2018
• Issued: 10/22/2019
• Est. Priority Date: 03/27/2018
• Status: Active Grant

• Current Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Original Assignee: Capital One Services LLC (Capital One Financial Corporation)
• Inventors: Jain, Chintan
• Primary Examiner(s): Revak, Christopher A
• Application Number:
  US16/237,178
• Publication Number:
  US 20190306158A1
• Time in Patent Office: 295 Days
• Field of Search: None
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time

Abstract

A system includes one or more memory devices storing instructions, and one or more processors configured to execute the instructions to perform the steps of a method for providing a credentialless login for a user. The system may receive a request for credentialless login from a user of a mobile computing device. The system may then receive an authentication of a user accessing a software application running on a mobile computing device. Responsive to the receipt of the authentication, the system may generate a random one-time passcode associated with an account of the authenticated user and transmit the passcode to the mobile computing device for display to the user. The system may then receive the passcode from a second computing device and responsive to verifying the validity of the access code, grant the second computing device access to the account of the user.

Claims

1. A method for providing a credentialless login, comprising:

receiving an authentication of a user accessing a first user device;

generating an access code for a credentialless login for an account of the user;

transmitting, to the first user device, the generated access code;

receiving, from a second user device, a credentialless login attempt, the credentialless login attempt comprising an attempted access code;

determining that the attempted access code matches the generated access code; and

authorizing, based at least in part on the determination, the second user device to access the account of the user.

2. The method of claim 1, wherein authorizing the second user device to access the account of the user is further based on at least a determination that the attempted access code is valid.

3. The method of claim 2, wherein determining that the attempted access code is valid further comprises:

receiving, from the first user device, first location data representative of a first location of the first user device;

receiving, from the second user device, second location data representative of a second location of the second user device; and

determining that the first location data matches the second location data within a predetermined confidence level.

4. The method of claim 2, wherein the generated access code is only valid for a predetermined period of time and only for a single use.

5. The method of claim 4, wherein determining that the attempted access code is valid further comprises determining that the predetermined period of time has not expired.

6. The method of claim 4, wherein determining that the attempted access code is valid further comprises determining whether the attempted access code has been previously received in connection with a credentialless login attempt.

7. The method of claim 2, wherein the generated access code is one of a randomly generated 8-digit alphanumeric code or a randomly generated 16-digit alphanumeric code.

8. The method of claim 1, wherein receiving the authentication of the user accessing the first user device comprises:

receiving, from the first user device, an indication that current biometric data associated with the user and obtained by the first user device matches, within a predetermined confidence level, known biometric data stored on the first user device, wherein the known biometric data is associated with the user.

9. The method of claim 8, wherein the current biometric data and the known biometric data comprise fingerprint data obtained by a fingerprint scanner of the first user device.

10. The method of claim 8, wherein the current biometric data and the known biometric data comprise voice recordings obtained from a microphone of the first user device.

11. The method of claim 8, wherein the current biometric data and the known biometric data comprise image data obtained from an image capture device associated with the first user device.

12. The method of claim 1, wherein transmitting the generated access code comprises:

placing a phone call to the first user device, wherein an IVR system reads the generated access code to the user.

13. The method of claim 1, wherein receiving the authentication of the user accessing the first user device comprises verifying that the first user device is a trusted device associated with the user.

14. The method of claim 1, wherein receiving the authentication of the user the first user device comprises:

receiving, from the first user device, an indication that an authenticating motion associated with the user that is obtained by a gyroscope of the first user device matches, within a predetermined confidence level, a known authentication motion stored on the first user device, wherein the known authentication motion is associated with the user.

15. A method for providing a credentialless login, comprising:

receiving known identification data associated with a user;

receiving, from a first user device, login credentials associated with the user of the first user device;

receiving, from the first user device, a request for the credentialless login for an account associated with the user;

receiving, from the first user device, user identification data;

determining that the user identification data matches the known identification data;

transmitting, to an authentication device, user verification data, wherein the user verification data comprises an indication that the user'"'"'s identity has been verified;

receiving, from the authentication device, an access code for the credentialless login; and

outputting, to the first user device, the access code for use in association with a credentialless login attempt at a second user device.

16. The method of claim 15, wherein the user identification data is one of fingerprint data obtained by a fingerprint scanner of the first user device, voice recordings obtained from a microphone of the first user device, or image data obtained from an image capture device associated with the first user device.

17. The method of claim 15, wherein the login credentials comprise a username and a password.

18. A method for providing a passwordless login, comprising:

receiving, from a first user device, a first inbound communication comprising a first request from a user to complete the passwordless login;

determining, using one of natural language processing or machine learning, a first content of the first inbound communication;

transmitting, to the first user device, a first outbound communication comprising a second request for verification of an identification of the user;

receiving, from the first user device, a second inbound communication comprising user verification data, wherein the user verification data indicates that the user'"'"'s identity has been verified;

determining, using one of natural language processing or machine learning, a second content of the second inbound communication;

generating an access code associated with an account of the user for use in association with a passwordless login attempt;

transmitting, to the first user device, a second outbound communication comprising the generated access code;

receiving, from a second user device, a passwordless login attempt comprising a username associated with the account of the user and an attempted access code; and

authorizing, based on a determination that the attempted access code matches the generated access code associated with the account associated with the username, the second user device to access the account of the user.

19. The method of claim 18, wherein the first inbound communication, the second inbound communication, the first outbound communication, and the second outbound communication are SMS messages.

20. The method of claim 18, wherein receiving the user verification data further comprises:

receiving, from the first user device, an indication that obtained biometric data associated with the user matches, within a predetermined confidence level, known biometric data stored on the first user device.