ONLINE CHALLENGE-RESPONSE

• US 20100114776A1
• Filed: 11/05/2009
• Published: 05/06/2010
• Est. Priority Date: 11/06/2008
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Steele, Kim, Faith, Patrick, Weller, Kevin, Koganti, Krishna Prasad
• Granted Patent: US 8,533,118 B2
• Time in Patent Office: Days
• US Class Current: 705/44
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

Embodiments of the invention enable cardholders conducting an online transaction to be authenticated in real-time using a challenge-response application. The challenge-response application can be administered by an issuer or by a third party on-behalf-of an issuer. A challenge question can be presented to the cardholder, and the cardholder'"'"'s response can be verified. The challenge question presented can be selected based on an analysis of the risk of the transaction and potentially other factors. A variety of dynamic challenge questions can be used without the need for the cardholder to enroll into the program. Additionally, there are many flexible implementation options of the challenge-response application that can be adjusted based on factors such as the location of the merchant or the location of the consumer.

Claims

1. A system for authenticating a consumer conducting a transaction, the system comprising:

a challenge-response server computer, the challenge response server computer comprising modules capable of executing on the challenge-response server, the modules comprising;

a risk analyzer module configured to obtain a risk score for the transaction; and

a challenge optimizer module configured to generate an authentication challenge using the risk score, and configured to compare a response received from the consumer to an expected response, wherein the challenge-response server computer is configured to receive an enrollment request message and is configured to send an enrollment response message.

2. The system of claim 1 further comprising:

a password-based authentication system, wherein the password-based authentication system is configured to provide a password-based authentication of the consumer conducting the transaction.

3. The system of claim 2 wherein the password-based authentication system is configured to provide authentication of the consumer substantially concurrently to the authentication provided by the challenge-response server.

4. The system of claim 2 wherein parameters of the authentication provided by the challenge-response server and parameters of the authentication provided by the password-based authentication system are determined based on information about the transaction being conducted and on information on the account being used to conduct the transaction.

5. The system of claim 2 wherein the authentication provided by the challenge-response server is provided when the password-based authentication of the consumer cannot take place.

6. The system of claim 1 wherein challenge-response server is configured to authenticate the consumer substantially concurrently with an enrollment process for the password-based authentication system that occurs during the transaction;

and wherein the challenge-response server computer is configured to calculate the risk score.

7. The system of claim 1 wherein challenge-response server authenticates the consumer substantially concurrently with a password recovery process for the password-based authentication system that occurs during the transaction.

8. The system of claim 1 wherein the challenge-response server computer comprises a device information module configured to obtain information on a device used by the consumer to conduct the transaction.

9. A computer implemented method of authenticating a consumer conducting a transaction with a merchant, the method comprising:

a) receiving a request for consumer authentication at a server computer, the request including information about the transaction being conducted and information on an account being used to conduct the transaction, wherein the server computer sends an authentication message to the merchant if the account can be authenticated;

b) determining a risk score for the transaction at the server computer;

c) if the account can be authenticated, sending an authentication challenge to the consumer when the risk score exceeds a threshold, the authentication challenge comprising a question whose response is static, dynamic or semi-dynamic;

d) receiving a consumer response to the authentication challenge;

e) comparing the consumer response to an expected response; and

f) authenticating the consumer conducting the transaction when the expected response and the consumer response are substantially the same.

10. The method of claim 9 wherein a)-f) are performed substantially concurrently with a password-based authentication of the consumer conducting the transaction.

11. The method of claim 10 wherein a)-f) are performed when the risk score is a medium risk score, and wherein no challenge is sent if the risk score is a low risk score and a transaction failure message is sent if the risk score is a high risk score.

12. The method of claim 9 wherein a)-f) are performed when a password-based authentication of the consumer conducting the transaction cannot take place.

13. The method of claim 9 wherein a)-f) are performed substantially concurrently with an enrollment process for a password-based authentication of the consumer conducting the transaction.

14. The method of claim 9 wherein a)-f) are performed substantially concurrently with a password recovery process for a password-based authentication of the consumer conducting the transaction.

15. The method of claim 9 wherein a)-f) are performed instead of a password recovery process for a password-based authentication of the consumer conducting the transaction.

16. The method of claim 9 further comprising:

sending the expected response to a consumer device,

wherein the expected response sent to the consumer device is valid for only one transaction.

17. The method of claim 9 wherein the risk score is further based on querying an external risk assessment system.

18. The method of claim 9 wherein the authentication challenge is generated by a payment processing network.

19. The method of claim 9 further comprising:

sending the risk score to a server computer associated with an issuer of the account being used to conduct the transaction;

wherein the authentication challenge is generated by the server computer associated with the issuer and wherein the consumer response is received by the issuer.

20. A computer-readable medium comprising computer-executable code, executable by a processor, for performing the method of claim 9.

21. A server computer comprising a processor and the computer readable medium of claim 20 coupled to the processor.