Network Authentication Of Multiple Profile Accesses From A Single Remote Device

• US 20160323290A1
• Filed: 07/08/2016
• Published: 11/03/2016
• Est. Priority Date: 02/27/2014
• Status: Active Grant

• Current Assignee: Cullen/Frost Bankers, Inc.
• Original Assignee: Cullen/Frost Bankers, Inc.
• Inventors: Stead, James M., Muthukrishnan, Arun, Johnson, Michael R., Rivera, Laurie A., Bilyeu, Selina D.
• Granted Patent: US 9,787,689 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

A network authentication system and method is described for authenticating multiple profile accesses from a single remote device. A device remote from a web server, yet connected to the web server via, for example, the Internet, can allow multiple users to register their profiles within the device. The profiles are registered using a pre-existing user ID and password corresponding to, for example, the user'"'"'s financial accounts. Multiple profiles and, specifically, the indicia of those profiles, can appear on the display of the remote device allowing each user the ability to select their own registered profile. Access to a profile is granted when the user enters their private PIN. Once the PIN is entered, the private information such as financial account information will be securely forwarded from the web server to the remote device.

Claims

1-10. -10. (canceled)

11. A web server adapted for communication with a communication network and for receiving requests for information from a device communicatively linked to the web server via the communication network, said web server comprising:

a memory containing two software tokens and respective two user profiles, said two profiles comprising two separate financial accounts of a single user or financial accounts of two separate users;

an execution unit coupled to the memory for drawing instructions therefrom and, in response to said instructions, for;

(i) receiving two one-time passwords in a request message from the network;

(ii) determining if correspondence exists between each of the respective two one-time passwords received from the network and each of the two software tokens stored in the memory; and

(iii) sending the respective two user profiles if correspondence exists between each of the two one-time passwords and each of the two software tokens.

12. The web server according to claim 11, wherein the communication network is the Internet.

13. The web server according to claim 11, wherein the one-time passwords are not stored in the memory and expire from the request message after a configurable timeout.

14. The web server according to claim 11, wherein the request message is for a request of the either two separate financial accounts or financial accounts of two separate users, each having a corresponding, unique one of the software tokens.

15. A method for authenticating multiple accesses to user profiles stored on a web server from a single remote device communicatively coupled to the web server, said method comprising:

(a) entering a user identifier and user password into the user interface of the remote device;

(b) entering a personal identification number (PIN) into the user interface of the remote device and associating the PIN with a corresponding profile indicator displayed on the user interface to register the profile indicator and respective PIN;

(c) repeating steps (a) and (b) to register at least two profile indicators and respective at least two Ms;

(d) selecting from a list of the at least two profile indicators displayed on the user interface of the remote device;

(e) entering the PIN corresponding with the selected profile indicator for receiving a profile from the web server; and

(f) repeating steps (d) and (e) to receive at least two profiles from the web server.

16. The method according to claim 15, wherein the entering of the user identifier and user password further comprising combining the user identifier and the user password for authenticating the receipt of a software token sent from the web server to the remote device, and repeating said combining for authenticating the receipt of at least two software tokens sent from the web server to the single remote device.

17. The method according to claim 16, wherein the entering a personal identification number (PIN) further comprising combining the at least two software tokens with corresponding at least two PINs for encrypting the at least two software tokens and storing the at least two encrypted software tokens in the single remote device.

18. The method according to claim 17, further comprising:

combining the at least two encrypted software tokens with corresponding at least two PINs for decrypting the at least two software tokens and generating corresponding at least two decrypted software tokens; and

generating at least two one-time passwords using corresponding said at least two decrypted software tokens.

19. The method according to claim 18, further comprising sending the at least two one-time passwords from the remote device to the web server.

20. The method according to claim 19, further comprising receiving at least two profiles from the web server in response to the web server receiving the corresponding at least two one-time passwords from the remote device.