System and method of using the public switched telephone network in providing authentication or authorization for online transactions

• US 6,934,858 B2
• Filed: 12/13/2000
• Issued: 08/23/2005
• Est. Priority Date: 12/15/1999
• Status: Expired due to Term

• Current Assignee: Payfone Incorporated
• Original Assignee: Authentify, Inc. (Bank of America Corp.)
• Inventors: Woodhill, James R.
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US09/737,254
• Publication Number:
  US 20020004831A1
• Time in Patent Office: 1,714 Days
• Field of Search: 713200-202, 713/186, 379/88.01, 379/88.02, 340/5.84
• US Class Current: 726/5
• CPC Class Codes: G06F 21/313 using a call-back technique via a telephone network
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04M 3/382 using authorisation codes or passwords
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention
• CPC Class Codes: H04M 7/128 Details of addressing, directories or routing tables

Abstract

An authentication or authorization system to facilitate electronic transactions uses simultaneous or substantially simultaneous communications on two different networks to verify a user'"'"'s identity. When a user logs onto a site, via the internet, a telephone number, either pre-stored or obtained in real time from the visitor, where the visitor can be called essentially immediately is used to set up, via the switched telephone network another communication link. Where the user has multiple communication links available, the telephone call is automatically placed via the authentication or authorization software simultaneously while the user is on-line. In the event that the user has only a single communication link, that individual will have to log off temporarily for purposes of receiving the telephone call. Confirmatory information is provided via the internet to the user. The automatically placed telephone call requests that the user feed back this confirmatory information for verification purposes. The telephone number which is being called is adjacent to the user'"'"'s internet terminal. The user'"'"'s response, via the telephone network, can be compared to the originally transmitted confirmatory information to determine whether the authentication or authorization process should go forward.

Claims

1. A system comprising:

an electronic, packet switching communications network;

a user operable terminal for coupling a user to a displaced site on the network;

pre-stored, executable instructions for establishing a telephone number for calling the user essentially immediately;

pre-stored instructions for forming confirmation information and for transmitting same to the user terminal for display;

pre-stored instructions for calling the user at the user'"'"'s phone number via a public telephone network;

pre-stored instructions requesting the user to provide at least the confirmation information during the call; and

pre-stored instructions for evaluating the identity of the user.

2. A system as in claim 1 which includes:

executable instructions for creating and storing an audit trail for the transaction.

3. A system in claim 1 which includes executable instructions for providing a verbal request, during the call, that the user provide selected audio information for audit purposes.

4. A system as in claim 1 wherein the establishing instructions include requesting a telephone number from the user for calling the user essentially immediately.

5. A system as in claim 1 wherein the instructions for calling are executed while communicating with the user via the terminal.

6. A system as in claim 1 which includes instructions for transferring the user to evaluating software prior to calling the user.

7. A system as in claim 1 which includes instructions directing the user to sign off of the network prior to executing the instructions for calling the user.

8. A system as in claim 4 wherein the instructions for calling are executed while communicating with the user via the terminal.

9. A system as in claim 1 wherein the establishing instructions retrieve a pre-stored user phone number from storage.

10. A method comprising:

establishing a bi-directional communications link between a visitor and a displaced software driven entity via a first electronic network;

obtaining an identifying indicium for the visitor for a second electronic network;

transferring confirmation information to the visitor, via the first network;

initiating a bi-directional communications link with the visitor via the second network; and

transferring the confirmation information received by the visitor to the software driven entity via the second network;

evaluating the received confirmation information at the software driven entity.

11. A method as in claim 10 wherein the first network is selected from a class which includes an internet-type network and an intranet-type network.

12. A method as in claim 10 wherein the obtaining step comprises obtaining a telephone number from the visitor.

13. A method as in claim 10 wherein the transferring step comprises transferring an alphanumeric code as the confirmation information.

14. A method as in claim 10 wherein the transferring step comprises transferring a numeric code as the confirmation information.

15. A method as in claim 10 wherein the initiating step comprises selecting the public switched telephone network as the second network and, placing a telephone call to the visitor.

16. A method as in claim 10 which includes providing directions verbally to the visitor via the bi-directional communications link of the second network.

17. A method as in claim 10 which includes displaying the confirmation information for the visitor.

18. A method as n claim 10 which includes obtaining a pre-stored telephone number for the user.

19. A method as in claim 10 wherein the first electronic network is selected from a class which includes an internet and an intranet.

20. A system comprising:

a first communication path for enabling a user to access at least one of a source of a selected product, a selected service; and

a selected functional capability; and

a second, different communication path for enabling the use, in response to communications on the first path, to respond to an inquiry initiated by the source using a predetermined station coupled to the second path and associated with the user.

21. A system as in claim 20 wherein the first communication path is established intermittently by the user via a publicly accessible electronic packet switching network.

22. A system as in claim 20 wherein the second communication path is established intermittently by the source via a different, publicly accessible switched network.

23. A system as in claim 21 wherein the second communication path is established intermittently by the source via a different, publicly accessibly voice network.

24. A system as in claim 20 wherein the second communication path is implemented using a publicly available switched telephone network.

25. A system as in claim 20 wherein the station comprises a telephone.

26. A system as in claim 25 wherein the first communication path establishes a link to a site on a digital network associated with the source.

27. A system as in claim 26 wherein the first communication path is established using an Internet service provider.

28. A system as in claim 27 wherein the user provides identifying information to the source using the first path.

29. A system as in claim 25 wherein the source transmits a message to the user to specify an identifier for the station.

30. A system as in claim 29 wherein the source, responding to the identifier, initiates the second communication path using the identifier to specify the station.

31. A system as in claim 30 wherein the source initiates a call to the telephone.

32. A system as in claim 31 wherein the user uses the telephone, in response to the source to provide selected information to the source via the second communication path.

33. A system as in claim 32 wherein the selected information is processed by the source to provide at least one of an authentication function, an authorization function and a collection function associated with the user.

34. A system as in claim 33 wherein the source, in response to selected results of processing the selected information executes one of an authentication function and an authorization function.

35. A system as in claim 34 wherein the source transmits a first, graphically displayable indicium to the user via the first communication path and wherein the user, via the telephone transmits a second indicium to the source, wherein the source processes the received indicium and in response thereto executes one of the functions provided that the received indicium exhibits a predetermined characteristic.

36. A system as in claim 35 wherein the first indicium and the second indicium contain the same information.

37. A system as in claim 20 wherein an audit trail is created by the source.

38. A system as in claim 34 wherein an audit trail is created by the source along with executing the function.

39. A system as in claim 25 wherein a call is automatically placed to the telephone on behalf of the source and responses from the telephone are analyzed on behalf of the source.

40. A system as in claim 39 wherein audit information is collected during the call.

41. A system as in claim 39 wherein the source provides a communication function, and where the responses from the telephone exhibit a predetermined characteristic, the user will be provided access to the communication function.

42. A system comprising:

first and second electronic networks which are, at least in part;

different;

first and second terminals, physically adjacent to one another, with each terminal associated with a respective network;

pre-stored, executable instructions for receiving an inquiry from the first terminal, via the first network;

additional executable instructions for establishing an address of the second terminal on the second network;

instructions for establishing a communications link, on the second network, with the second terminal;

instructions for transmitting confirmatory information, via the first network, to the first terminal;

instructions for receiving a representation of the confirmatory information, via the second network, from the second terminal; and

instructions for comparing the received representation to the transmitted information.

43. A system as in claim 42 wherein the second network comprises a switched telephone system.

44. A system as in claim 43 wherein the second terminal comprises a telephone handset.

45. A system as in claim 43 wherein the communications link of the second network is established simultaneously with another communications link using the first network.

46. A system as in claim 43 which includes instructions for displaying the confirmatory information on the first terminal.

47. An authorization system comprising:

first and second electronic networks which are, at least in part, different;

first and second terminals, with each terminal associated with a respective network;

instructions for receiving an inquiry from the first terminal, via the first network;

instructions for establishing an address of the second terminal on the second network;

instructions for establishing a communications link, on the second network, with the second terminal;

instructions for transmitting confirmatory information, via the first network, to the first terminal;

instructions for receiving a representation of the confirmatory information, via the second network, from the second terminal;

instructions for comparing the received representation to the transmitted information and for producing a comparison indicating indicium; and

instructions, responsive to the comparison indicium, for conducting an authorization process and for generating an authorization related indicium.

48. A system as in claim 47 wherein the second network comprises a switched telephone system with a wireless portion.

49. A system as in claim 48 wherein the second terminal comprises one of a land line telephone and a wireless phone.

50. A system as in claim 48 wherein the communications link of the second network is established simultaneously with another communications link using the first network.

51. A system as in claim 48 which includes instructions for displaying the confirmatory information on the first terminal.

52. A system as in claim 47 for authorizing a charge to a financial account wherein the inquiry from the first terminal includes a financial account designator.

53. A system as in claim 52 wherein the instructions for conducting an authorization process comprise instructions for evaluating if a proposed charge to the designated account will be accepted.

54. A system as in claim 53 for authorizing a charge to a credit-type account wherein the instructions for evaluating comprise instructions for determining if a proposed charge to a designated credit-type account will be accepted as an increase to an amount due on the respective account.

55. An authentication process comprising:

establishing a first communications channel via a computer network between an individual at a location and a provider of at least one of a product or service;

transmitting at least an authentication indicium from the provider to the individual, using the first communications channel;

retrieving an address of the individual for establishing a second communications channel via a different network;

initiating communications, via the different network, with the individual at the address;

returning the indicium, via the different network, for comparison to the transmitted indicium, and, where substantially indentical, providing an authenticated indicium to the provider.

56. A process as in claim 55 where the computer network includes at least one of an intranet or an internet.

57. A process as in claim 55 where the different network includes at least a portion of a public telephone network.

58. A process as in claim 55 where the address comprises a multi-digit telephone number.

59. A process as in claim 57 where the indicium is returned by the individual via at least the portion of the telephone network.