Authentification Broker for the Securities Industry

• US 20090055907A1
• Filed: 08/20/2007
• Published: 02/26/2009
• Est. Priority Date: 08/20/2007
• Status: Active Grant

• Current Assignee: Goldman Sachs & Co. LLC (Goldman Sachs Group Incorporated)
• Original Assignee: Goldman Sachs & Company (Goldman Sachs Group Incorporated)
• Inventors: Van Horn, Richard
• Granted Patent: US 8,839,383 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Identity-independent authentication tokens enable issuance of a single strong credential that can be mapped to an individual at each of multiple accounts within the online world. An issuer generates one or more authentication tokens for issuance to individuals or other entities. In some instances, each of these authentication tokens comprises a unique serial number. The individual or other entity may then request an authentication token from the issuer. The issuer may then issue the token to the individual without the need to ask or require the individual to identify his or herself. The individual may then map this issued authentication token to the individual'"'"'s password at each of the individual'"'"'s online accounts.

Claims

1. A method comprising:

generating multiple authentication tokens, each of the multiple authentication tokens comprising a unique identifier; and

issuing one of the multiple authentication tokens to an individual without requiring the individual to provide a legal name of the individual.

2. A method as recited in claim 1, wherein at least some of the multiple authentication tokens are embodied as digital certificates.

3. A method as recited in claim 1, wherein the unique identifier comprises a serial number.

4. A method as recited in claim 1, further comprising mapping the one of the multiple authentication tokens to the individual.

5. A method as recited in claim 1, further comprising mapping the one of the multiple authentication tokens to the individual, and wherein the mapping comprises:

asking one or more questions to the individual; and

storing answers to the one or more questions.

6. A method as recited in claim 1, further comprising receiving a request from the individual for one of the multiple authentication tokens.

7. A method as recited in claim 1, further comprising:

requesting an account with a service provider; and

mapping the account to the one of the multiple authentication tokens.

8. A method as recited in claim 1, further comprising:

requesting an account with a first service provider;

mapping the account with the first service provider to the one of the multiple authentication tokens;

requesting an account with a second service provider; and

mapping the account with the second service provider to the one of the multiple authentication tokens.

9. A method as recited in claim 1, further comprising:

requesting an account with a service provider; and

conducting a “

know-your-client”

process to identify the individual; and

mapping the account to the one of the multiple authentication tokens.

10. A method as recited in claim 1, further comprising substituting a password with the one of the multiple authentication tokens for an individual'"'"'s account with a service provider.

11. A method as recited in claim 1, further comprising:

substituting a first password with the one of the multiple authentication tokens for an individual'"'"'s account with a first service provider; and

substituting a second password with the one of the multiple authentication tokens for an individual'"'"'s account with a second service provider.

12. One or more computer-readable media storing computer-executable instructions that, when executed on one or more processors, performs acts comprising:

receiving, from a requestor, a request for an authentication token; and

issuing the authentication token to the requestor without requiring the requester to include identifying information in the request.

13. One or more computer-readable media as recited in claim 12, wherein the authentication token includes an identifier that is unique to the authentication token.

14. One or more computer-readable media as recited in claim 12, further comprising mapping the authentication token to the requestor such that the authentication token may be issued to the requestor a second time.

15. One or more computer-readable media as recited in claim 12, further comprising receiving an inquiry from a service provider regarding a validity of the authentication token.

16. One or more computer-readable media as recited in claim 12, further comprising:

receiving an inquiry from a service provider regarding a validity of the authentication token; and

issuing a response to the service provider in response to the receiving of the inquiry.

17. One or more computer-readable media as recited in claim 12, further comprising receiving a notification from a service provider when the requestor accesses an online account with use of the authentication token.

18. One or more computer-readable media as recited in claim 12, further comprising:

receiving a notification from a service provider when the requester accesses an online account with use of the authentication token; and

responsive to the receiving of the notification, requesting payment from the service provider.

19. A method comprising:

requesting, by an individual, an authentication token without providing an identification of the individual, the authentication token for use in accessing multiple online accounts accessible by the individual; and

receiving the authentication token responsive to the requesting.

20. A method as recited in claim 19, wherein the authentication token includes a unique serial number.

21. A method as recited in claim 19, wherein the multiple online accounts include at least one online account provided by an investment management organization.

22. A method as recited in claim 19, wherein the multiple online accounts include at least one online account provided by financial institution.

23. A method as recited in claim 19, further comprising mapping the authentication token to at least one of the multiple online accounts such that the individual is allowed to access the at least one of the multiple online accounts with use of the authentication token.

24. A method as recited in claim 19, further comprising mapping the authentication token to the multiple online accounts such that the individual is allowed to access each of the multiple online accounts with use of the authentication token.

25. A method as recited in claim 19, further comprising:

creating an online account with a service provider; and

mapping the online account to the authentication token such that the individual is allowed to access the online account with use of the authentication token.