ENHANCED 2CHK AUTHENTICATION SECURITY WITH QUERY TRANSACTIONS

• US 20130333008A1
• Filed: 06/07/2012
• Published: 12/12/2013
• Est. Priority Date: 06/07/2012
• Status: Active Grant

• Current Assignee: Payfone Incorporated
• Original Assignee: Authentify, Inc. (Early Warning Services, LLC)
• Inventors: TAPLING, Peter George, ROLFE, Andrew Robert, GANESAN, Ravi, SHEWARD, Sally
• Granted Patent: US 9,716,691 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A security server receives a request of a user to activate a secure communications channel over the network and, in response, transmits an activation code for delivery to the user via another network. The security server receives an activation code from the user network device via the network, compares the received activation code with the transmitted activation code to validate the received activation code, and activates the secure communications channel based on the validation. The security server next receives a query including a question for the user from an enterprise represented on the network, transmits the received enterprise query to the user network device via the secure communications channel, and receives, from the user network device via the secure communications channel, a user answer to the transmitted enterprise query. The security server then transmits the received user answer to the enterprise to further authenticate the user to the enterprise.

Claims

1. A method of operating a security server to perform query transactions via a network, comprising:

receiving, at the security server from a user network device via the network, a request of a user to activate a secure communications channel over the network between the user network device and the security server;

transmitting, by the security server in response to the received activation request, an activation code for delivery to the user via another network;

receiving, at the security server from the user network device via the network, an activation code;

comparing, at the security server, the received activation code with the transmitted activation code to validate the received activation code;

activating the secure communications channel based on the validation of the received activation code;

receiving, at the security server from an enterprise network, which is also represented on the network, a query including a question for the user, wherein the correct answer to the question has been previously agreed to by the user and the enterprise;

transmitting, from the security server to the user network device via the secure communications channel, the received enterprise query;

receiving, at the security server from the user network device via the secure communications channel, a user answer to the transmitted enterprise query; and

transmitting the received user answer, from the security server to the enterprise to further authenticate the user to the enterprise.

2. The method of claim 1, wherein the other network is an out-of-band authentication network.

3. The method of claim 2, wherein the out-of-band authentication network is a phone network.

4. The method of claim 1, wherein the enterprise question asks for one of a secret shared by the user and the enterprise and information that is personal to the user.

5. The method of claim 1, further comprising:

incorporating, at the security server, the received enterprise query into at least one of a voice stream and an image;

wherein the transmitted enterprise query is the enterprise query incorporated into the at least one of the voice stream and the image.

6. The method of claim 5, wherein the voice stream is a voice stream having a voice recognizable by the user and the image is an image having a background known to the user.

7. (canceled)

8. A method of operating a security server to securely transact business between a user and an enterprise via a network, comprising:

receiving, at the security server from a user network device via the network, a request of the user to activate a secure communications channel over the network between the user network device and the security server;

transmitting, by the security server in response to the received activation request, an activation code for delivery to the user via another network;

receiving, at a security server from the user network device via the network, an activation code;

comparing, at the security server, the received activation code with the transmitted activation code to validate the received activation code;

activating the secure communications channel based on the validation of the received activation code;

receiving, at the security server from the user network device via the secure communications channel, transaction information including an identifier of an enterprise with which the user desires to enter into the transaction via the network, and details of the desired transaction;

transmitting the transaction information, from the security server to the enterprise via another secure communications channel;

receiving, at the security server from the enterprise via the other secure communications channel, notification that either (i) the transaction has been accepted or (ii) the transaction has been rejected or (iii) additional authentication of the user is required by the enterprise; and

if the received notification is a notification that the transaction has been accepted or rejected, transmitting the received notification from the security server to the user network device via the secure communications channel.

9. An article of manufacture for performing query transactions via a network, comprising:

non-transitory storage medium; and

logic stored on the storage medium, wherein the stored logic is configured to be readable by a processor and thereby cause the processor to operate so as to;

receive, from a user network device via the network, a request of a user to activate a secure communications channel over the network for communications with the user network device;

direct transmission, in response to the received activation request, of an activation code for delivery to the user via another network;

receive, from the user network device via the network, an activation code;

compare the received activation code with the transmitted activation code to validate the received activation code;

activate the secure communications channel based on the validation of the received activation code;

receive, from an enterprise network, which is also represented on the network, a query including a question for the user, wherein the correct answer to the question has been previously agreed to by the user and the enterprise;

direct transmission of the received enterprise query to the user network device via the secure communications channel;

receive, from the user network device via the secure communications channel, a user answer to the transmitted enterprise query; and

direct transmission of the received user answer to the enterprise to further authenticate the user to the enterprise.

10. The article of manufacture of claim 9, wherein the other network is an out-of-band authentication network.

11. The article of manufacture of claim 10, wherein the out-of-band authentication network is a phone network.

12. The article of manufacture of claim 9, wherein the enterprise question asks for one of a secret shared by the user and the enterprise and information that is personal to the user.

13. The article of manufacture of claim 9, wherein:

the stored logic is further configured to cause the processor to operate so as to incorporate the received enterprise query into at least one of a voice stream and an image; and

the enterprise query that is directed to be transmitted is the enterprise query incorporated into the at least one of the voice stream and the image.

14. The method of claim 13, wherein the voice stream is a voice stream having a voice recognizable by the user and the image is an image having a background known to the user.