USER AUTHENTICATION

• US 20140250512A1
• Filed: 09/25/2012
• Published: 09/04/2014
• Est. Priority Date: 10/03/2011
• Status: Active Grant

• Current Assignee: Barclays Execution Services Ltd. (Barclays PLC)
• Original Assignee: Barclays Bank PLC (Barclays PLC)
• Inventors: Dwyer, Dermot, Goldstone, Jeremy
• Granted Patent: US 11,063,933 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/313 using a call-back technique via a telephone network
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 20/306 using TV related infrastructures external card used for payment with client device H04N21/4185
• CPC Class Codes: G06Q 20/3223 Realising banking transactions through M-devices
• CPC Class Codes: G06Q 20/3272 using an audio code
• CPC Class Codes: G06Q 20/3274 using a pictured code, e.g. barcode or QR-code, being displayed on the M-device
• CPC Class Codes: G06Q 20/3276 using a pictured code, e.g. barcode or QR-code, being read by the M-device
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/4097 using mutual authentication between devices and transaction partners
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

User Authentication A mobile user authentication application is operable to perform one or more of the following operations: •authenticate a user in a voice call to a telephony service, by passing an authentication code to the telephony service within the voice call [FIGS. 2, 2c]; •validate a user instruction during a secure messaging session [FIG. 3]; and •authenticate a user at a physical local service by obtaining a challenge code at that local service, validating the challenge code with a remote authentication service, obtain a confirmation code from the authentication service and presenting the confirmation code for validation at the local service [FIGS. 4, 4a and 4b].

Claims

1-38. -38. (canceled)

39. A method of user authentication by a mobile device, the method comprising the steps of:

a) generating a challenge code independently of any user authentication session;

b) presenting the challenge code so as to be accessible to the mobile device;

c) capturing the challenge code at the mobile device;

d) sending a response code derived from the challenge code from the mobile device to an authentication service,

e) validating the response code at the authentication service and sending a confirmation code to the mobile device if the response code is validated;

f) outputting the confirmation code at the mobile device;

g) capturing the confirmation code from the mobile device; and

h) authenticating the user by the confirmation code.

40. The method of claim 39, wherein the confirmation code is derived from the response code.

41. The method of claim 39, wherein a plurality of mutually different challenge codes are generated and presented, and the mobile device captures a selected one of the challenge codes.

42. The method of claim 39, wherein the challenge code is indicative of a physical location at which the challenge code is presented.

43. The method of claim 39, wherein the challenge code is indicative of a time at which the challenge code is presented.

44. The method of claim 39, wherein the confirmation code is indicative of a location, and the user is not authenticated unless the confirmation code is captured at that location.

45. The method of claim 39, wherein the confirmation code is indicative of a time period, and the user is not authenticated unless the confirmation code is captured within that time period.

46. The method of claim 39, further including sending a status message to the user after sending the response code from the mobile device.

47. The method of claim 46, wherein the status message is sent to the mobile device.

48. The method of claim 46, wherein the status message is displayed at a location at which the challenge code is presented.

49. The method of claim 46, further including determining a priority level of the user, and wherein the status message is derived from the priority level.

50. The method of claim 46, further including determining service information for the user, and wherein the status message includes the service information.

51. The method of claim 39, further including authenticating a user input at the mobile device prior to sending the response code.

52. The method of claim 51, wherein the user input comprises a passcode, graphical input or biometric input.

53. The method of claim 51, wherein the user input is authenticated by the authentication service.

54. The method of claim 39, wherein authenticating the user comprises validating the confirmation code with the authentication service.

55. The method of claim 39, wherein authenticating the user includes validating user information.

56. The method of claim 55, wherein the user information is validated by the authentication service.

57. The method of claim 39, wherein capturing the challenge code is performed by optically scanning a displayed machine-readable code.

58. The method of claim 57, wherein the displayed machine-readable code comprises a two dimensional matrix code.

59. A method of user authentication by an application on a mobile telephony device, the method comprising the steps of:

a) registering the application on the mobile telephony device with a remote authentication service, to generate one or more cryptographic keys for secure communication between the application and the remote authentication service;

b) authenticating the user by interaction with the application, to receive a call identifier from the remote authentication service;

c) initiating a telephone call to a remote telephony service, and after the telephone call has been connected to the remote telephony service,

d) sending the call identifier within the telephone call to the remote telephony service, by which the user is authenticated to the remote telephony service.

60. The method of claim 59, wherein registering the application includes storing identity data associated with the application by the remote authentication service.

61. The method of claim 59, wherein the one or more cryptographic keys are generated from a passcode entered by the user.

62. The method of claim 59, wherein the user is further authenticated by verbal validation within the telephone call.

63. The method of claim 62, wherein the verbal validation comprises confirming data relating to the user.

64. The method of claim 63, wherein the confirming data relating to the user is obtained from the remote authentication service.

65. The method of claim 59, wherein the user is authenticated locally at the mobile telephony device by interaction with the application, to receive a call identifier from the remote authentication service.

66. The method of claim 59, further including communicating a purpose of the telephone call from the mobile telephony device, and routing the telephone call by the telephony service according to the communicated purpose.

67. The method of claim 66, wherein the purpose of the telephone call is communicated by a telephone number called by the mobile telephony device.

68. The method of claim 66, wherein the purpose of the telephone call is communicated by the call identifier.

69. The method of claim 59, wherein the call identifier is included as an audio signal within the telephone call.

70. A system comprising:

a) a mobile device running a mobile application; and

b) a local service;

wherein the local service presents a challenge code; and

the mobile application captures the challenge code, and outputs a confirmation code in response to a validation of the challenge code; and

the local service captures and validates the confirmation code.

71. The system of claim 70, further including an authentication service remote from the mobile device and from the local service, the authentication service validates the challenge code and sends the confirmation code to the mobile application, and wherein the local service to validates the confirmation code with the authentication service.