System and method for blocking unauthorized network log in using stolen password

• US 20060069921A1
• Filed: 10/24/2005
• Published: 03/30/2006
• Est. Priority Date: 07/15/2004
• Status: Active Grant

• Current Assignee: Anakam, Inc. (Equifax, Inc.)
• Original Assignee: Anakam, Inc. (Equifax, Inc.)
• Inventors: Camaisa, Allan, Samuelsson, Jonas
• Granted Patent: US 8,219,822 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

The geographic location of a computer attempting to gain authentication to a server is obtained using the IP address of the computer, with authentication being denied if the geographic location is not approved.

Claims

1. A method for selectively granting a user access to data, comprising:

receiving an IP address from a computer attempting to gain access to the data;

correlating the IP address to a geographic location; and

based on the geographic location, determining whether to deny the computer access to the data.

2. The method of claim 1, wherein the act of correlating includes accessing a database of IP addresses correlating IP addresses to geographic location.

3. The method of claim 2, wherein the geographic location is country.

4. The method of claim 2, wherein the geographic location is state.

5. The method of claim 2, wherein the geographic location is city.

6. The method of claim 2, wherein the geographic location is postal code.

7. The method of claim 1, wherein the act of determining further includes, if the geographic location is not approved, issuing a challenge to the user of the computer and not denying access only if a correct response to the challenge is received.

8. The method of claim 1, further comprising:

determining whether a cookie previously deposited on the computer includes a machine ID matching a test machine ID and a login key matching a test login key, and if so, granting the computer access to the data, and refreshing the login key, otherwise not granting the computer access to the data absent additional authentication steps.

9. An authentication system for at least one user computer associated with a user, comprising:

a server executing logic that determines whether to grant the user computer authentication based at least in part on the geographic location of the user computer.

10. The system of claim 9, wherein the geographic location is obtained using the IP address of the user computer.

11. The system of claim 10, wherein the geographic location is country and/or state and/or city and/or postal code and/or time zone and/or ISP identity and/or location type.

12. The system of claim 10, wherein the server logic, if the geographic location is not approved, issues a challenge to the user of the computer and does not deny access only if a correct response to the challenge is received.

13. The system of claim 10, further comprising:

means for determining whether a cookie previously deposited on the computer includes a machine ID matching a test machine ID and a login key matching a test login key, and if so, granting the computer access to the data, and refreshing the login key, otherwise not granting the computer access to the data absent additional authentication steps.

14. A method for authenticating a user of a computer to a server, comprising:

receiving from the computer biometric information representing the user; and

using the biometric information, determining whether to issue a challenge to the user.

15. The method of claim 14, further comprising:

determining whether a cookie previously deposited on the computer includes a machine ID matching a test machine ID and a login key matching a test login key, and if so, granting the computer access to data sought by the computer, and refreshing the login key, otherwise not granting the computer access to the data absent additional authentication steps.