SYSTEM AND METHOD FOR PASSWORD-FREE ACCESS FOR VALIDATED USERS

• US 20090265773A1
• Filed: 06/19/2008
• Published: 10/22/2009
• Est. Priority Date: 10/31/2006
• Status: Active Grant

• Current Assignee: Gula Consulting Limited Liability Company (Intellectual Ventures LLC)
• Original Assignee: Genmobi Technologies Incorporated
• Inventors: Schultz, Michael J.
• Granted Patent: US 8,515,847 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04M 1/665 by checking the validity of a code

Abstract

A new approach is proposed that first validates identity of a user/individual who is initiating a request for a web service for the first time. Once validated, the user is allowed to access the web service, to register securely with the provider of the web service, and to create a series of personalized questions to be used for future validation purposes. During the user'"'"'s subsequent request for the web service, the user will be asked, in addition to his/her user name, one or more of the personalized questions he/she created on rotation basis in place of a PIN or password.

Claims

1. A system, comprising:

a web service engine operable to;

provide a web service to a user online;

request validation of identity of the user when the user initiates a first request for the web service;

prompt the user with one or more of a set of personal challenge questions (PCQs) when the user initiates a second request for the web service;

accept second answers to the one or more PCQs from the user to grant or decline the second request;

a validation engine operable to;

validate the identity of the user when requested by the web service engine;

enable the user to register securely and to create a profile, the set of PCQs, and first answers to the PCQs when the identity of the user is validated;

compare the first and the second answers to the one or more PCQs from user for authorization of the second request.

2. The system of claim 1, further comprising:

a credit reporting engine operable to generate a set of knowledge based authentication (KBA) questions based on credit and/or transaction history of the user for the validation of identity of the user;

a credit database coupled to the credit reporting engine, wherein the credit database is operable to store and manage credit and/or transaction history of the user.

3. The system of claim 2, wherein:

the web service engine, the validation engine, and the credit reporting engine communicate over a network via communication interfaces and/or application programming interfaces (APIs).

4. The system of claim 2, wherein:

the validation engine is operable to provide the set of KBA questions to and retrieve responses to the set of KBA questions from the user.

5. The system of claim 4, wherein:

the validation engine is operable to deny the validation of the identity of the user if the user does not respond to the KBA questions in a timely manner.

6. The system of claim 4 wherein:

the credit reporting engine is operable to grade the responses to the set of KBA questions from the user.

7. The system of claim 6, wherein:

the validation engine is operable to approve or deny the identity of the user based on the grading of the responses to the set of KBA questions from the user.

8. The system of claim 7, wherein:

The web service engine is operable to accept or decline the first request by the user based on the validation result of the identity of the user.

9. The system of claim 1, wherein:

the web service engine is operable to grant or decline the second request by the user based on comparison of the first and the second answers to the one or more PCQs from user without prompting the user for PIN or password.

10. The system of claim 1, further comprising:

a user database operable to store and manage the profile, the set of PCQs, and the first answers to the PCQs.

11. The system of claim 10, wherein:

the validation engine is operable to retrieve the one or more PCQs and/or the first answers to the one or more PCQs from the user database.

12. The system of claim 10, wherein:

the validation engine is operable to keep records of requests and access to the web service by the user in the user database.

13. The system of claim 1, wherein:

the validation engine is operable to rotate and/or randomly select the one or more PCQs prompted to the user.

14. The system of claim 1, wherein:

the validation engine is operable to utilize an interactive voice response (IVR) system for identity validation.

15. A method, comprising:

accepting a first request for a web service initiated by a user online over a network;

validating identity of the user based on the information provided by the user;

accepting or declining the first request by the user based on the validation result of the identity of the user;

enabling the user to access the web service and to create a profile, a set of personal challenge questions (PCQs), and first answers to the PCQs if the identity of the user is validated;

prompting the user with one or more of the PCQs created by the user during a second request for the web service by the user;

comparing the first and the second answers to the PCQs from the user;

granting or declining the second the second request for the web service based on result of the comparison without prompting the user for PIN or password.

16. The method of claim 15, further comprising:

generating a set of knowledge based authentication (KBA) questions based on credit and/or transaction history of the user for the validation of identity of the user.

17. The method of claim 16, further comprising:

providing the set of KBA questions to and retrieve responses to the set of KBA questions from the user.

18. The method of claim 16, further comprising:

denying the validation of the identity of the user if the user does not respond to the KBA questions in a timely manner.

19. The method of claim 16, further comprising:

grading the responses to the set of KBA questions from the user;

approving or denying the identity of the user based on the grading of the responses to the set of KBA questions from the user.

20. The method of claim 15, further comprising:

keeping records of request and access to the web service by the user.

21. The method of claim 15, further comprising:

rotating and/or randomly selecting the one or more PCQs prompted to the user.

22. The method of claim 15, further comprising:

utilizing an interactive voice response (IVR) system for the validation process.

23. A system, comprising:

means for accepting a first request for a web service initiated by a user online over a network;

means for validating identity of the user based on the information provided by the user;

means for accepting or declining the first request by the user based on the validation result of the identity of the user;

means for enabling the user to access the web service and to create a profile, a set of personal challenge questions (PCQs), and first answers to the PCQs if the identity of the user is validated;

means for prompting the user with one or more of the PCQs created by the user during a second request for the web service by the user;

means for comparing the first and the second answers to the PCQs from the user;

means for granting or declining the second the second request for the web service based on result of the comparison without prompting the user for PIN or password.