MOBILE PIN PAD

• US 20120144461A1
• Filed: 12/07/2010
• Published: 06/07/2012
• Est. Priority Date: 12/07/2010
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Rathbun, George Steven
• Granted Patent: US 8,555,355 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles

Abstract

A system is configured to: receive an authentication request for a transaction from a web server; identify a phone number of the mobile device based on identifying information of the user in the authentication request and the user information, transmit a message to the mobile device based on the phone number, receive a message response from the mobile device, determine whether the mobile device provided a mobile pin pad authentication for the user based on the message response, and transmit a success authentication response to the web server when the mobile device provided the mobile pin pad authentication for the user.

Claims

1. A method comprising:

generating, by a server device, a message based on an authentication request for a transaction;

transmitting, by the server device, the message to a remote device based on the authentication request, where the message prompts a pin pad application;

receiving, by the server device, a message response from the remote device, where the message response comprises a first one time password (OTP) generated by the pin pad application of the remote device;

validating, by the server device, the first OTP;

generating, by the server device, a success authentication response when the validating of the first OTP is successful, where the success authentication response comprises an approval of the transaction; and

transmitting, by the server device, the success authentication response.

2. The method of claim 1, further comprising:

transmitting the pin pad application to the remote device, where the pin pad application displays a pin pad and generates the first OTP when the pin pad is used to enter a correct personal identification number (PIN);

receiving the authentication request for the transaction from a web server;

determining an identity of a user of the remote device based on the authentication request; and

determining contact information of the remote device based on the identity of the user,

where the transmitting the message to the remote device based on the authentication request comprises transmitting the message to the remote device based on the contact information.

3. The method of claim 2,

where the contact information is a phone number, and

where the remote device is a mobile device.

4. The method of claim 1, where the validating of the first OTP comprises:

generating a second OTP; and

determining whether the first OTP matches the second OTP,

where the validating of the first OTP is successful when the first OTP matches the second OTP.

5. The method of claim 1,

where the authentication request comprises a first location of the transaction;

and

where the message response comprises a second location of the remote device.

6. The method of claim 5, further comprising:

calculating a risk score for the transaction based on the first location and the second location,

where the success authentication response comprises the risk score.

7. The method of claim 1, where the transaction is one of logging into a website by a user of the remote device, purchasing an item by the user, or providing verification of identity by the user.

8. A system comprising:

a memory to store user information for a user of a mobile device; and

a processor, connected to the memory, to;

receive an authentication request for a transaction from a web server;

identify a phone number of the mobile device based on identifying information of the user in the authentication request and the user information,

transmit a message to the mobile device based on the phone number, where the message prompts a mobile pin pad application of the mobile device,

receive a message response from the mobile device,

determine whether the mobile device provided a mobile pin pad authentication for the user based on the message response, and

transmit a success authentication response to the web server when the mobile device provided the mobile pin pad authentication for the user.

9. The system of claim 8, where the message response comprises a first one time password (OTP) generated by the mobile device.

10. The system of claim 9, where, when determining whether the mobile device provided the mobile pin pad authentication for the user, the processor is further to:

generate a second OTP; and

determine whether the first OTP matches the second OTP.

11. The system of claim 8, where the authentication request comprises a request for geographic coordinates of the mobile device.

12. The method of claim 11,

where the message response comprises the geographic coordinates of the mobile device, and

where the success authentication response comprises the geographic coordinates of the mobile device.

13. The method of claim 8,

where the authentication request comprises a first location of the transaction,

where the message response comprises a second location of the mobile device,

where the processor is further to generate a risk score for the transaction based on the first location and the second location, and

where the success authentication response comprises the risk score.

14. The method of claim 8,

where the transaction requires a first form of authentication and a second form of authentication,

where the second form of authentication is provided by the success authentication response.

15. A computer-readable media storing a program for causing a computer to perform a method, the method comprising:

receiving a message from an authentication server;

displaying a request based on the message;

receiving a response to the request from a user;

displaying a mobile pin pad when the response indicates that the user wants to proceed with providing mobile pin pad authentication for a transaction;

receiving a personal identification number (PIN) input through the mobile pin pad;

generating a message response based on the pin input; and

transmitting the message response to the authentication server.

16. The computer-readable media of claim 15, where the method further comprises:

determining whether the PIN input is equal to a personal identification number (PIN) stored for the user; and

generating a first one time password (OTP) when the PIN input is equal to the PIN.

17. The computer-readable media of claim 16, where the generating the OTP comprises generating the OTP based on a seed value provided by the authentication server.

18. The computer-readable media of claim 16, where the generating the message response comprises including the OTP in the message response when the PIN input is equal to the PIN.

19. The computer-readable media of claim 15, where the method further comprises:

determining whether the message comprises a request for geographical coordinates; and

transmitting the geographical coordinates of the computer to the authentication server when the message comprises the request for geographical coordinates.

20. The computer-readable media of claim 15,

where the message comprises a text of the request, and

where the request describes the transaction.