DYNAMIC ACCOUNT AUTHENTICATION USING A MOBILE DEVICE

• US 20090327131A1
• Filed: 04/29/2008
• Published: 12/31/2009
• Est. Priority Date: 04/29/2008
• Status: Abandoned Application

• Current Assignee: Liberty Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Inventors: Beenau, Blayn W., Gray, William J., Whittington, David P., Langus, Jeffrey D.
• Application Number:
  US12/111,381
• Publication Number:
  US 20090327131A1
• Time in Patent Office: Days
• US Class Current: 705/44
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06Q 20/326 Payment applications installed on the mobile devices
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners

Abstract

Providing dynamic authentication of a user requesting access to a system via a mobile device is disclosed. An account holder tailors a set of customized security challenges and responses. When a request for account authentication is received from a mobile device, the system conducts a multi-step user authentication process that includes dynamically selecting and prompting the user with the custom security challenges.

Claims

1. A method for dynamic authentication of a user using a mobile device, comprising:

receiving a request from the mobile device for authentication of the user using the mobile device, wherein the request includes information that uniquely identifies an account;

sending a first custom security challenge that is selected from custom security challenges, wherein the first custom security challenge and a first valid response to the first custom security challenge were previously established with the user and stored in association with the account;

receiving a first response to the security challenge from the mobile device; and

,

validating the first response against the first valid response to authenticate the user.

2. The method of claim 1, wherein sending the first custom security challenge comprises sending multiple custom security challenges.

3. The method of claim 1, further comprising encrypting the first custom security challenge.

4. The method of claim 1, wherein the step of receiving a first response comprises receiving an encrypted first response.

5. The method of claim 1, wherein the request includes a personal identification number (PIN) to uniquely identify the account.

6. The method of claim 1, wherein the account is a transaction account.

7. The method of claim 1, further comprising enabling the user to perform at least one of:

executing a transaction with the account, modifying the account, enrolling in additional products and enrolling in additional services.

8. The method of claim 1, further comprising enabling the user to execute a transaction with limitations based upon at least one of time, transaction type, transaction amount, number of transactions, mobile device capabilities, mobile device characteristics and user permissions.

9. The method of claim 1, wherein receiving the request from the mobile device comprises receiving the request from an application on the mobile device.

10. The method of claim 1, further comprising causing an application to be loaded onto the mobile device.

11. The method of claim 1, wherein the first valid response is dynamic with respect to at least one of time and a stored data value.

12. The method of claim 1, wherein selecting from custom security challenges comprises selecting based upon at least one of:

user specified order, random selection, a calculation, a previous user response, an event, a date, a time, a location, mobile device capabilities, mobile device characteristics and the service being requested by the user.

13. The method of claim 1, wherein sending comprises sending multiple security challenges, receiving comprises receiving multiple responses to the multiple security challenges and validating comprises validating multiple responses.

14. The method of claim 1, further comprising:

sending a second custom security challenge that is selected from custom security challenges, wherein the second custom security challenge and a second valid response to the second custom security challenge were previously established with the user and stored in association with the account, and wherein sending a second custom security challenge is triggered by the step of validating the first response;

receiving a second response to the second security challenge from the mobile device; and

,

validating the second response against the second valid response to further authenticate the user.

15. The method of claim 1, wherein the request includes a card identification number (CID) to uniquely identify the account.

16. The method of claim 1, wherein the user is a third-party and the information that uniquely identifies the account also identifies the user as a third-party.

17. The method of claim 1, wherein the user is a third-party and the first custom security challenge and the first valid response are unique to the third-party and were previously established by an account holder.

18. The method of claim 1, wherein the information that uniquely identifies an account includes at least one of mobile device capabilities, mobile device characteristics and data associated with the mobile device.

19. The method of claim 1, wherein the account is a transaction account and the first valid security response is at least partially related to the amount of the latest transaction against the transaction account.

20. A machine-readable medium having stored thereon a plurality of instructions for dynamic authentication of a user using a mobile device, the plurality of instructions when executed by a processor, cause the processor to perform the steps of:

receiving a request from the mobile device for authentication of the user using the mobile device, wherein the request includes information that uniquely identifies an account;

sending a first custom security challenge that is selected from custom security challenges, wherein the first custom security challenge and a first valid response to the first custom security challenge were previously established with the user and stored in association with an account;

receiving a first response to the security challenge from the mobile device; and

,

validating the first response against the first valid response to authenticate the user.

21. A system for dynamic authentication of a user using a mobile device, comprising:

an authentication engine configured to;

receive a request from the mobile device for authentication of the user using the mobile device, wherein the request includes information that uniquely identifies an account;

send a custom security challenge that is selected from custom security challenges, wherein the custom security challenge and a valid response to the custom security challenge were previously established with the user and stored in association with the account;

receive a response to the security challenge from the mobile device; and

,

validate the response against the valid response; and

a database containing custom security challenges and the valid response to each security challenge.

22. A method for dynamic authentication of a mobile device, comprising:

receiving a request from the mobile device, wherein the request includes information that uniquely identifies the mobile device or an account;

sending a first custom security challenge that is selected from custom security challenges, wherein the first custom security challenge and a first valid response to the first custom security challenge were previously established with an account holder and stored in association with the account;

receiving a first response to the security challenge from the mobile device; and

,

validating the first response against the first valid response to authenticate the mobile device.