Transaction Verification Through Enhanced Authentication

• US 20170214531A1
• Filed: 05/19/2016
• Published: 07/27/2017
• Est. Priority Date: 09/25/2014
• Status: Active Grant

• Current Assignee: eBay Inc.
• Original Assignee: eBay Inc.
• Inventors: Wardman, Bradley, Sugihara, Kevin
• Granted Patent: US 11,075,767 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Methods, systems, and computer program products for providing transaction verification through enhanced authentication are provided. A method performed by a computer system may include receiving an application programming interface (API) request from a client, detecting a change associated with the API request as compared to a prior use of the API by the client, generating an encrypted challenge to authenticate the API request based on detecting the change, and issuing the encrypted challenge to the client to authenticate the API request.

Claims

1. A computer system, comprising:

a non-transitory memory storing instructions; and

one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising;

receiving an application programming interface (API) request from a client;

detecting a change associated with the API request as compared to a prior use of the API by the client;

generating an encrypted challenge to authenticate the API request based on detecting the change; and

issuing the encrypted challenge to the client to authenticate the API request.

2. The computer system of claim 1, wherein the encrypted challenge is encrypted using a key received prior to the API request from a party authorized to use the API.

3. The computer system of claim 1, wherein the encrypted challenge is an additional challenge issued to the client.

4. The computer system of claim 1, wherein the detecting is based on determining that information known about an authorized user associated with the API request differs from information associated with the client.

5. The computer system of claim 1, wherein the operations further comprise:

processing the API request based on a result of issuing the encrypted challenge to the client.

6. The computer system of claim 1, wherein the change is detected based on a change in use of the API by the client when compared to the prior use of the API by the client.

7. The computer system of claim 1, wherein the change is detected based on a deviation from a baseline pattern of activity associated with the API.

8. A computer-implemented method, comprising:

receiving, by one or more processing devices, an application programming interface (API) request from a client;

detecting, by one or more of the processing devices, a change associated with the API request as compared to a prior use of the API by the client;

generating, by one or more of the processing devices, an encrypted challenge to authenticate the API request based on detecting the change; and

issuing, by one or more of the processing devices, the encrypted challenge to the client to authenticate the API request.

9. The computer-implemented method of claim 8, wherein the encrypted challenge is encrypted using a key received prior to the API request from a party authorized to use the API.

10. The computer-implemented method of claim 8, wherein the encrypted challenge is an additional challenge issued to the client.

11. The computer-implemented method of claim 8, wherein the detecting comprises determining that information known about an authorized user associated with the API request differs from information associated with the client.

12. The computer-implemented method of claim 8, further comprising:

processing the API request based on a result of issuing the encrypted challenge to the client.

13. The computer-implemented method of claim 8, wherein the change is detected based on a change in behavior of the client when compared to the prior use of the API by the client.

14. The computer-implemented method of claim 8, wherein the change is detected based on a deviation from a baseline pattern of activity associated with the API.

15. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:

receiving an application programming interface (API) request from a client;

detecting a change associated with the API request as compared to a prior use of the API by the client;

generating an encrypted challenge to authenticate the API request based on detecting the change; and

issuing the encrypted challenge to the client to authenticate the API request.

16. The non-transitory machine-readable medium of claim 15, wherein the encrypted challenge is encrypted using a key received prior to the API request from a party authorized to use the API.

17. The non-transitory machine-readable medium of claim 15, wherein the encrypted challenge is an additional challenge issued to the client.

18. The non-transitory machine-readable medium of claim 15, wherein the detecting comprises determining that information known about an authorized user associated with the API request differs from information associated with the client.

19. The non-transitory machine-readable medium of claim 15, wherein the operations further comprise:

processing the API request based on a result of issuing the encrypted challenge to the client.

20. The non-transitory machine-readable medium of claim 15, wherein the change is detected based on a change in use of the API by the client when compared to the prior use of the API by the client.