METHOD FOR SECURE USER AND TRANSACTION AUTHENTICATION AND RISK MANAGEMENT

• US 20140337943A1
• Filed: 07/14/2014
• Published: 11/13/2014
• Est. Priority Date: 01/27/2010
• Status: Active Grant

• Current Assignee: Payfone Incorporated
• Original Assignee: Authentify, Inc. (Early Warning Services, LLC)
• Inventors: GANESAN, Ravi
• Granted Patent: US 9,325,702 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

To provide a user signature on a network transaction, a security server receives transaction information representing a transaction between a network user and a network site, such as a website, directly from the network site. The security server calculates a one-time-password based on the received transaction information and a secret shared by the security server and the network site, but not by the user. The security server transmits the calculated one-time-password for application as the user'"'"'s signature on the transaction. The one-time-password is independently calculable by the network site based on the shared secret.

Claims

1. A method of providing a user signature on a network transaction, comprising:

receiving, by a security server directly from a network site, transaction information representing a transaction between a network user and a network site;

calculating, by the security server, a one-time-password based on (i) the received transaction information and (ii) a secret shared by the security server and the network site, but not by the user, wherein the one-time-password is independently calculable by the network site based on the shared secret and the transaction information; and

transmitting, by the security server, the calculated one-time-password for application as the user'"'"'s signature on the transaction and verification by the network site.

2. The method of claim 1, wherein:

the network site is a web site.

3. The method of claim 1, wherein:

the calculated one-time-password is transmitted, by the security server to a user network device for presentation on a window displayed by the user network device and entry by the user onto a network page associated with the network site and displayed on the user network device.

8. The method of claim 1, further comprising:

storing, at the security server, a log of transactions between the user and the network site.

9. The method of claim 8, further comprising:

computing, by the security server, a risk profile of the user based on the stored transactions log.

10. The method of claim 8, further comprising:

transmitting, by the security server to a third party, the stored transactions log for risk analysis.

17. The method of claim 1, wherein the shared secret is not associated with any particular user.

4. (canceled)

5. (canceled)

6. (canceled)

7. (canceled)

11. A method of validating a user signature on a network transaction, comprising:

receiving, by a network site from a user network device, transaction information representing a transaction between a user and the network site;

transmitting, by the network site directly to a security server, the transaction information;

receiving, by the network site from the user network device, a one-time-password as the user'"'"'s signature on the transaction;

calculating, by the network site, a one-time-password based on (i) the received transaction information and (ii) a secret shared by a security server and the network site, but not by the user; and

verifying, by the network site, the signature based on a comparison of the received one-time-password and the calculated one-time-password.

18. The method of claim 11, wherein the shared secret is not associated with any particular user.

12. (canceled)

13. (canceled)

14. (canceled)

15. (canceled)

16. A method of authenticating a user on a network, comprising:

transmitting, by a network site directly to a security server, a request to have a user authenticated;

receiving, by the network site from a network device of the user, a one-time-password;

calculating, by the network site, a one-time-password based on a secret shared by the security server and the network site, but not by the user; and

comparing, by the network site, the received one-time-password and the calculated one-time-password to authenticate the user.

19. The method of claim 16, wherein the shared secret is not associated with any particular user.