INTEGRATED VOICE BIOMETRICS CLOUD SECURITY GATEWAY

• US 20110246196A1
• Filed: 03/30/2011
• Published: 10/06/2011
• Est. Priority Date: 03/30/2010
• Status: Active Grant

• Current Assignee: Ack3 Bionetics Pte Limited
• Original Assignee: Aspen Networks, Inc.
• Inventors: BHASKARAN, SAJIT
• Granted Patent: US 9,412,381 B2
• Time in Patent Office: Days
• US Class Current: 704/235
• CPC Class Codes: G06F 21/313 using a call-back technique via a telephone network
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G10L 15/26 Speech to text systems G10L15/08 takes precedence
• CPC Class Codes: G10L 17/08 Use of distortion metrics or a particular distance between probe pattern and reference templates
• CPC Class Codes: G10L 17/24 the user being prompted to utter a password or a predefined phrase
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04W 12/065 Continuous authentication

Abstract

A triple factor authentication in one step method and system is disclosed. According to one embodiment, an Integrated Voice Biometrics Cloud Security Gateway (IVCS Gateway) intercepts an access request to a resource server from a user using a user device. IVCS Gateway then authenticates the user by placing a call to the user device and sending a challenge message prompting the user to respond by voice. After receiving the voice sample of the user, the voice sample is compared against a stored voice biometrics record for the user. The voice sample is also converted into a text phrase and compared against a stored secret text phrase. In an alternative embodiment, an IVCS Gateway that is capable of making non-binary access decisions and associating multiple levels of access with a single user or group is described.

Claims

1. ) A computer-implemented method to authenticate a user through a triple factor authentication in one step, the method comprising:

intercepting an access request to a resource server from a user using a user device providing a user credential;

placing a call to the user device;

sending a challenge message prompting the user to respond by voice;

receiving a voice sample of the user;

comparing the voice sample of the user against a stored voice biometrics record for the user;

converting the voice sample into a text phrase; and

comparing the text phrase against a stored secret text phrase.

2. ) The computer-implemented method of claim 1, further comprising determining a non-binary access check result for the user, wherein the non-binary access check result for the user device is either ‘

GRANTED’

, ‘

DENIED’

, or ‘

LIMITED ACCESS’

.

3. ) The computer-implemented method of claim 2, wherein the user device is routed to a suspicious activity playground if the non-binary access check result for the data terminal is ‘

LIMITED ACCESS’

.

4. ) The computer-implemented method of claim 1, further comprising detecting a device type that is used by the user automatically.

5. ) The computer-implemented method of claim 2, further comprising checking a callback policy for the user device.

6. ) The computer-implemented method of claim 5, further comprising:

confirming that the callback policy for the user device allows for a single step with interactive voice response backup if the user device access check is ‘

DENIED’

;

placing a call to the user device;

sending one or more challenge messages to the user device;

converting the voice sample into text phrases; and

comparing the text phrases against stored secret text phrases.

7. ) The computer-implemented method of claim 1, further comprising:

storing the user credential;

storing the voice sample of the user;

storing an address of resource server that is accessed; and

recording an access time stamp for the resource server.

8. ) The computer-implemented method of claim 1, wherein multiple voice biometrics records are stored for the user, and each voice biometrics record corresponds to a different type of user device.

9. ) The computer-implemented method of claim 2, wherein multiple credentials can be stored for the user, and each credential corresponds to a non-binary access check result.

10. ) The computer-implemented method of claim 1, wherein instead of intercepting an access request to a resource server from a user using a user device providing a user credential, the user credential is provided by an authentication, authorization and accounting (AAA) protocol.

11. ) The computer-implemented method of claim 10, wherein the user device is an authorized phone number within an internal PBX network.

12. ) The computer-implemented method of claim 10, wherein the authentication, authorization and accounting (AAA) protocol is either RADIUS or DIAMETER.

13. ) A computer-readable medium having stored thereon a plurality of instructions, the plurality of instructions when executed by a computer, cause the computer to perform:

intercepting an access request to a resource server from a user using a user device providing a user credential;

placing a call to the user device;

sending a challenge messages prompting the user to respond by voice;

receiving a voice sample of the user;

comparing the voice sample of the user against a stored voice biometrics record for the user;

converting the voice sample into a text phrase; and

comparing the text phrase against a stored secret text phrase.

14. ) The computer-readable medium of claim 13, further comprising determining a non-binary access check result for the user, wherein the non-binary access check result for the user device is either ‘

GRANTED’

, ‘

DENIED’

, or ‘

LIMITED ACCESS’

.

15. ) The computer-readable medium of claim 14, wherein the user device is routed to a suspicious activity playground if the non-binary access check result for the data terminal is ‘

LIMITED ACCESS’

.

16. ) The computer-readable medium of claim 13, further comprising detecting a device type that is used by the user automatically.

17. ) The computer-readable medium of claim 14, further comprising checking a callback policy for the user device.

18. ) The computer-readable medium of claim 17, further comprising:

confirming that the callback policy for the user device allows for a single step with interactive voice response backup if the user device access check is ‘

DENIED’

;

placing a call to the user device;

sending one or more challenge messages to the user device;

converting the voice sample into text phrases; and

comparing the text phrases against stored secret text phrases.

19. ) The computer-readable medium of claim 13, further comprising:

storing the user credential;

storing the voice sample of the user;

storing an address of resource server that is accessed; and

recording an access time stamp for the resource server.

20. ) The computer-readable medium of claim 13, wherein multiple voice biometrics records are stored for the user, and each voice biometrics record corresponds to a different type of user device.

21. ) The computer-readable medium of claim 14, wherein multiple credentials can be stored for the user, and each credential corresponds to a non-binary access check result.

22. ) The computer-readable medium of claim 13, wherein instead of intercepting an access request to a resource server from a user using a user device providing a user credential, the user credential is provided by an authentication, authorization and accounting (AAA) protocol.

23. ) The computer-readable medium of claim 22, wherein the user device is an authorized phone number within an internal PBX network.

24. ) The computer-readable medium of claim 22, wherein the authentication, authorization and accounting (AAA) protocol is either RADIUS or DIAMETER.

25. ) An integrated voice biometrics cloud security (IVCS) gateway system, comprising:

a database;

an application layer based packet forwarding and control engine comprising;

a voice biometrics callback and routing policy engine, and one or more IP protocol handlers;

a voice biometrics verification server (VBVS) comprising;

a third party call control,

an interactive voice response (IVR) module, and

a suspicious activity playground;

one or more WAN Ethernet switch ports for connection to ISP cloud; and

one or more LAN Ethernet switch ports for connection to resource servers, wherein the

application layer based packet forwarding and control engine executes instructions to;

intercept an access request to a resource server from a user using a user device providing a user credential;

place a call to the user device;

send a challenge messages prompting the user to respond by voice;

receive a voice sample of the user;

compare the voice sample of the user against a stored voice biometrics record for the user;

convert the voice sample into a text phrase; and

compare the text phrase against a stored secret text phrase.

26. ) The system of claim 25, wherein the application layer based packet forwarding and control engine executes instructions to determine a non-binary access check result for the user, and the non-binary access check result for the user device is either ‘

GRANTED’

, ‘

DENIED’

, or ‘

LIMITED ACCESS’

.

27. ) The system of claim 26, wherein the user device is routed to a suspicious activity playground if the non-binary access check result for the data terminal is ‘

LIMITED ACCESS’

.

28. ) The system of claim 25, wherein the application layer based packet forwarding and control engine executes instructions to detect a device type that is used by the user automatically.

29. ) The system of claim 26, wherein the application layer based packet forwarding and control engine executes instructions to check a callback policy for the user device.

30. ) The system of claim 29, wherein the application layer based packet forwarding and control engine executes instructions to:

confirm that the callback policy for the user device allows for a single step with interactive voice response backup if the user device access check is ‘

DENIED’

;

place a call to the user device;

send one or more challenge messages to the user device;

convert the voice sample into text phrases; and

compare the text phrases against stored secret text phrases.

31. ) The system of claim 25, wherein the application layer based packet forwarding and control engine executes instructions to:

store the user credential;

store the voice sample of the user;

store an address of resource server that is accessed; and

record an access time stamp for the resource server.

32. ) The system of claim 25, wherein multiple voice biometrics records are stored for the user, and each voice biometrics record corresponds to a different type of user device.

33. ) The system of claim 26, wherein multiple credentials can be stored for the user, and each credential corresponds to a non-binary access check result.

34. ) The system of claim 25, wherein instead of intercepting an access request to a resource server from a user using a user device providing a user credential, the user credential is provided by an authentication, authorization and accounting (AAA) protocol.

35. ) The system of claim 34, wherein the user device is an authorized phone number within an internal PBX network.

36. ) The system of claim 34, wherein the authentication, authorization and accounting (AAA) protocol is either RADIUS or DIAMETER.

37. ) The system of claim 25, further comprising one or more PSTN ports.

38. ) The system of claim 25, further comprising one or more SIP trunk ports.