Security arrangement and method for controlling access to a protected system

• US 5,805,674 A
• Filed: 03/08/1996
• Issued: 09/08/1998
• Est. Priority Date: 01/26/1995
• Status: Expired due to Fees

• Current Assignee: Victor C. Anderson Jr
• Original Assignee: Victor C. Anderson Jr
• Inventors: Anderson, Victor C. Jr.
• Primary Examiner(s): Zele, Krista
• Assistant Examiner(s): WEAVER, SCOTT LOUIS
• Application Number:
  US08/612,679
• Time in Patent Office: 914 Days
• Field of Search: 379/67, 379/88, 379/89, 379/91.01, 379/93.02, 379/93.03, 379/93.04, 379/111, 379/113, 379/118, 379/120, 379/188, 379/200, 379/201, 379/243, 379/127, 379/142, 395/2.1, 395/2.35, 395/2.36, 395/2.37, 395/2.55, 395/2.6, 395/2.79, 395/2.82, 380/3, 380/6, 380/19, 902/5, 704/201, 704/226, 704/227, 704/228, 704/242, 704/246, 704/251, 704/270, 704/273
• US Class Current: 379/93.03
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

The security arrangement includes a computer processor unit coupled to a subscriber information memory to verify whether the user is an authorized user. The subscriber information memory stores subscriber voice information and variable security level information. A prompt memory coupled to the computer processor unit requests the user to input a set of verification information determined by the security level information. The input set of verification information is compared with stored subscriber voice information by a voice analyzer coupled to the subscriber information memory, wherein access to the system is enabled when the input set of verification information corresponds substantially with the subscriber voice information.

Claims

1. A method for controlling access to a protected system by a user utilizing a calling unit to provide call information, comprising:

determining if the user is an authorized user associated with the calling unit to reduce substantially the ability of a non-authorized user to gain access to the protected system,

storing subscriber information relating to said authorized user to facilitate verifying that the user is said authorized user, said subscriber information including authentication information and security level information associated with said authorized user;

detecting an indicator of potential fraudulent activity;

adjusting said security level information in response to the detection of said potential fraudulent activity indicator for indicating that a higher probability of fraudulent activity exists;

determining a given set of verification information to be input by the system user corresponding to a given level of said security level information, said given set of verification information corresponding to a certain subset of said authentication information, wherein said given set of verification information is adjusted according to the given level of said security level information for a given attempted use of the system;

requesting the system user to input said given set of verification information, wherein said certain subset of authentication information is communicated to the user for enabling the user to repeat said certain subset of authentication information;

comparing a user generated set of verification information received from the user with said certain subset of authentication information to verify that the user attempting to use the system is said authorized user, wherein access to the system by the user attempting to use the system is enabled when said user generated set of verification information corresponds substantially with said certain subset of authentication information;

determining the connection status of the calling unit at the time the user attempts to gain access;

adjusting said security level information to reflect the maximum probability that fraudulent activity is present when the connection status of said calling unit indicates that it is being used concurrently by another user to access the protected system;

requesting said another user to input another given set of verification information; and

disconnecting said another user when said another user generated set of verification information does not correspond to said certain subset of authentication information.

2. A method according to claim 1, further including updating and storing the given level of said security level information for use in determining said given set of verification information to be input by the user when the calling unit is used to make a subsequent attempt to gain access to the protected system.

3. A method according to claim 2, further including storing said given level of said security level information, adjusting said given level of said security level by a predetermined increment upon the detection of said potential fraudulent activity indicator, and storing said adjusted given level of said security level information for a predetermined period of time before readjusting said adjusted given level of said security level information by said predetermined increment.

4. A method according to claim 1, wherein said step of storing subscriber information includes storing a password.

5. A method according to claim 4, wherein said step of storing subscriber information further includes storing a plurality of security phrases.

6. A method according to claim 5, further including selecting randomly at least one of said security phrases to be included in said given set of verification information to be input by the user.

7. A method according to claim 5, wherein said step of storing subscriber information further includes storing personal data information.

8. A method according to claim 1, further including selectively obtaining an ambient noise sample from the vicinity of the user, and superimposing temporarily said ambient noise sample over said certain subset of authentication information to facilitate the comparison of said user generated set of verification information with said certain subset of authentication information.

9. A method according to claim 1, further including disconnecting both the user and said another user when said user generated set of verification information and said another user generated set of verification information correspond substantially with said certain subset of authentication information.