System and method for authentication of network users

• US 20020157029A1
• Filed: 11/26/2001
• Published: 10/24/2002
• Est. Priority Date: 05/21/1998
• Status: Active Grant

• Current Assignee: Equifax, Inc.
• Original Assignee: Equifax, Inc.
• Inventors: Wilder, Jone, French, Jennifer
• Granted Patent: US 7,234,156 B2
• Time in Patent Office: Days
• US Class Current: 713/202
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners
• CPC Class Codes: G06Q 30/0609 Buyer or seller confidence or verification
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A network authentication system provides verification of the identity or other attributes of a network user to conduct a transaction, access data or avail themselves of other resources. The user is presented with a hierarchy of queries based on wallet-type (basic identification) and non-wallet type (more private) information designed to ensure the identity of the user and prevent fraud, false negatives and other undesirable results. A preprocessing stage may be employed to ensure correct formatting of the input information and clean up routine mistakes (such as missing digits, typos, etc.) that might otherwise halt the transaction. Queries can be presented in interactive, batch processed or other format. The authenticator can be configured to require differing levels of input or award differing levels of authentication according to security criteria.

Claims

1. A method of authenticating a network user, comprising:

a) performing a first authentication step based on a first type of information; and

b) performing at least a second authentication step based on a second type of information other than the first type of information.

2. The method of claim 1, wherein step (a) comprises:

i) obtaining the first type of information from the user;

ii) retrieving user identification information from a data source;

iii) comparing the first type of information supplied by the user with the user identification information retrieved from the data source; and

iv) determining a level of correspondence between the first type of information supplied by the user and the user identification information retrieved from the data source.

3. The method of claim 2, wherein the data source comprises a credit file of the user.

4. The method of claim 1, wherein step (b) comprises:

i) determining an availability of the second type of information for the user;

ii) formulating at least one query based on available second type information for the user;

iii) presenting the at least one query to the user for response; and

iv) evaluating the response.

5. The method of claim 4, wherein the identity of the user is authenticated based on the level of correspondence determined in step (a)(iv) and the evaluation made in step (b)(iv).

6. The method of claim 2, further comprising:

c) determining, based at least in part on the level of correspondence determined in step (a)(iv), to;

i) authenticate the user;

ii) perform at least the second authentication step;

iii) request additional information from the user;

or

iv) take other action.

7. The method of claim 6, wherein the step (c) of determining is further based on a level of certainty of authentication desired.

8. The method of claim 1, wherein at least one of step (a) and step (b) comprises generating an interactive query.

9. The method of claim 8, wherein the interactive query comprises at least one question having multiple choice answers.

10. The method of claim 1, wherein the first type of information comprises wallet-type information and the second type of information comprises non-wallet type information.

11. The method of claim 1, wherein the second type of information comprises information pertaining to credit accounts to which the user is a party.

12. The method of claim 11, wherein the second type of information comprises mortgage loan information, and the user is requested to identify at least one of:

i) mortgage lender information; and

ii) mortgage loan amount information.

13. The method of claim 2, wherein the data source for the first type of information is used to identify the availability of the second type of information for the user.

14. The method of claim 1, further comprising (d) receiving biometric input from the user.

15. The method of claim 1, wherein the network comprises the Internet.

16. The method of claim 1, further comprising (e) logging a transaction record of the authentication.

17. The method of claim 1, further comprising (f) executing a pattern recognition process to detect potential irregularities in the information supplied by the user.

18. The method of claim 1, further comprising (g) performing an offline authentication based upon at least one of the first type of information and the second type of information.

19. The method of claim 18, wherein the step (g) of performing an offline authentication comprises applying a mailability filter to the at least one of the first type of information and the second type of information.

20. A system for authenticating a network user, comprising:

an input interface for receiving input from the user; and

a processor, connected to the input interface and configured to;

perform a first authentication based on a first type of information; and

perform at least a second authentication based on a second type of information other than the first type of information.

21. The system of claim 20, wherein the first authentication performed by the processor comprises:

obtaining the first type of information from the user;

retrieving user identification information from a data source;

comparing the first type of information supplied by the user with the user identification information retrieved from the data source; and

determining a level of correspondence between the first type of information supplied by the user and the user identification information retrieved from the data source.

22. The system of claim 21, wherein the data source comprises a credit file of the user.

23. The system of claim 20, wherein the second authentication performed by the processor comprises:

determining an availability of the second type of information for the user;

formulating at least one query based on available second type information for the user;

presenting the at least one query to the user for response; and

evaluating the response.

24. The system of claim 23, wherein the identity of the user is authenticated based on the level of correspondence determined in the determining and the evaluating performed by the processor.

25. The system of claim 21, wherein the processor determines, based at least in part on the level of correspondence, whether to:

authenticate the user;

perform at least the second authentication;

request additional information from the user;

or take other action.

26. The system of claim 25, wherein the determining is further based on a level of certainty of authentication desired.

27. The system of claim 20, wherein the processor generates an interactive query.

28. The system of claim 27, wherein the interactive query comprises at least one question having multiple choice answers.

29. The system of claim 20, wherein the first type of information comprises wallet-type information and the second type of information comprises non-wallet type information.

30. The system of claim 29, wherein the second type of information comprises information pertaining to credit accounts to which the user is a party.

31. The system of claim 30, wherein the second type of information comprises mortgage loan information, and the query comprises a request for the user to identify at least one of:

mortgage lender information; and

mortgage loan amount information.

32. The system of claim 21, wherein the data source for the first type of information is used to identify the availability of the second type of information for the user.

33. The system of claim 20, wherein the processor receives biometric input from the user.

34. The system of claim 20, wherein the network comprises the Internet.

35. The system of claim 20, wherein the processor logs a transaction record of the authentication.

36. The system of claim 20, wherein the processor executes a pattern recognition process to detect potential irregularities in the information supplied by the user.

37. The system of claim 20, wherein the processor performs an offline authentication based upon at least one of the first type of information and the second type of information.

38. The system of claim 37, wherein the offline authentication comprises applying a mailability filter to the at least one of the first type of information and the second type of information.