Methods and systems for authentication

• US 7,853,984 B2
• Filed: 12/10/2003
• Issued: 12/14/2010
• Est. Priority Date: 12/11/2002
• Status: Active Grant

• Current Assignee: Authorize Net LLC (Visa, Inc.)
• Original Assignee: Authorize Net LLC (Visa, Inc.)
• Inventors: Arena, Michael, Antell, Richard, Chraplewski, Michele, Shapiro, Robert D.
• Primary Examiner(s): Patel; Nirav
• Application Number:
  US10/732,668
• Publication Number:
  US 20040123162A1
• Time in Patent Office: 2,561 Days
• Field of Search: 726 2- 7, 726 16- 18, 726/22, 726 26- 30, 705/64, 705/67, 705/50, 707/1, 707/3, 707/705, 707/783, 707/784, 713182-186, 709/223, 709/225, 709/229
• US Class Current: 726/2
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Disclosed are systems and methods of authenticating a user on a network, including, based on identity information received from the user, accessing at least one data source to retrieve data associated with the user, comparing the retrieved data against a listing of possible questions associated with the retrieved data to determine associations between the retrieved data and the listing of possible questions, based on a ranking of the listing of possible questions, formulating at least one question set using questions within the listing of possible questions for which retrieved data is available, where each of the at least one question set includes at least two different questions, causing at least some of the questions from the at least one question set to be presented to the user, and, based on responses to the questions from the user, determining whether the user is authenticated.

Claims

1. A method of authenticating a user on a computer network, the method comprising:

based on identity information received from the user over the computer network, accessing at least one data source to retrieve data associated with the user,

comparing, using the computing device, the retrieved data against a listing of possible questions associated with the retrieved data to determine associations between the retrieved data and the listing of possible questions,

based on a ranking of the listing of possible questions, formulating at least one question set using questions within the listing of possible questions for which retrieved data is available, where each of the at least one question set includes at least two different questions,

causing at least some of the questions from the at least one question set to be presented to the user, and,

based on responses to the questions from the user, determining, using the computing device, whether the user is authenticated, according to a total authentication point value;

wherein determining includes at least determining, based on a response to one question from the at least one question set, that the response is a partially correct response to that one question;

wherein a correct response is a value between a first minimum threshold value and a first maximum threshold value, and the partially correct response is a value;

a) that is not between the first minimum threshold value and the first maximum threshold value, and

b) that is between a second minimum threshold value and a second maximum threshold value;

wherein the second minimum threshold value is less than the first minimum threshold value, and the second maximum threshold value is greater than the first maximum threshold value;

awarding points to the partially correct response, wherein the points are based on a multiplier that is configured for a partially correct response;

wherein the multiplier for a partially correct response is different than a multiplier that is configured for a correct response;

determining that the user is authenticated when the total authentication point value exceeds a predetermined total.

2. The method of claim 1, where determining includes comparing the responses to the retrieved data associated with the at least some of the questions presented to the user.

3. The method of claim 1, where comparing the retrieved data includes parsing the retrieved data.

4. The method of claim 1, further comprising receiving configuration data, where the configuration data includes at least one of:

a priority ranking for the listing of potential questions, a number of question sets, a number of questions for each question set, and at least one authentication criteria.

5. The method of claim 4, where the at least one authentication criteria includes at least one of a percentage of questions to respond to correctly, a number of questions to respond to partially correctly, and a percentage of questions to respond to partially correctly.

6. The method of claim 1, where determining includes returning to causing at least some of the questions from the at least one question set to be presented to the user.

7. The method of claim 1, where determining includes at least one of:

causing the user to be informed on non-authentication, and in response to the non-authentication, causing the user to be provided with instructions to proceed to a manual method of authentication.

8. The method of claim 7, wherein the manual method comprises:

prompting the user for at least one access criteria,

based on the access criteria, retrieving data associated with the user,

based on the data, causing at least some of the questions from the at least one question set to be presented to the user, and,

based on the responses to the questions from the user, and the data, determining whether the user is authenticated.

9. The method of claim 8, further comprising, based on whether the user is authenticated, providing instructions to the user to proceed to a mail method of authentication.

10. The method of claim 9, where the mail method comprises:

obtaining physical specimens from the user, and,

comparing the physical specimens to the retrieved data.

11. The method of claim 1, where the at least one data source includes personal information.

12. The method of claim 11, where the at least one data source includes at least one database.

13. The method of claim 12, where the personal information includes at least one of:

credit data, debit data, demographic data, and household data.

14. The method of claim 1, where the at least one data source includes corporate information.

15. The method of claim 1, wherein determining the total authentication point value further comprises:

determining a first point value by adding together points of each of the correct responses;

determining a second point value by adding together the points of each of the partially correct responses;

determining the total authentication point value comprising the sum of the first point value and the second value.

16. The method of claim 15, further comprising:

in response to determining that the user is authenticated, providing an authentication decision code.

17. The method of claim 16, wherein the authentication decision code includes a digital certificate.

18. A data processing system, comprising:

one or more processors;

a memory coupled to the processors;

one or more sequences of instructions stored in the memory and which when executed by the one or more processors cause the one or more processors to perform;

based on identity information received from the user, accessing at least one data source to retrieve data associated with the user,

comparing the retrieved data against a listing of possible questions associated with the retrieved data to determine associations between the retrieved data and the listing of possible questions,

based on a ranking of the listing of possible questions, formulating at least one question set using questions within the listing of possible questions for which retrieved data is available, where each of the at least one question set includes at least two different questions,

causing at least some of the questions from the at least one question set to be presented to the user, and,

based on responses to the questions from the user, determining;

whether the user is authenticated, according to a total authentication point value;

wherein determining includes at least determining, based on a response to one question from the at least one question set, that the response is a partially correct response to that one question;

wherein a correct response is a value between a first minimum threshold value and a first maximum threshold value, and the partially correct response is a value;

a) that is not between the first minimum threshold value and the first maximum threshold value, and

b) that is between a second minimum threshold value and a second maximum threshold value;

wherein the second minimum threshold value is less than the first minimum threshold value, and the second maximum threshold value is greater than the first maximum threshold value;

wherein a partially correct response to one or more of the questions is associated with a multiplier that is configured for a partially correct response;

wherein the multiplier that is configured for a partially correct response is different than a multiplier that is configured for a correct response;

determining that the user is authenticated when the total authentication point value exceeds a predetermined total.

19. The system of claim 18, further comprising instructions which when executed cause the user to be informed on non-authentication, and in response to the non-authentication, cause the user to be provided with user instructions to proceed to a manual method of authentication.

20. The system of claim 19, further comprising instructions which when executed cause providing, in response to the non-authentication, user instructions to the user to proceed to a mail method of authentication.

21. The system of claim 18, wherein the at least one data source includes corporate information.

22. A non-transitory storage medium, readable by one or more processors, comprising one or more sequences of instructions which, when executed by a first processor of the one or more processors, cause the first processor to perform the steps of:

based on identity information received from the user, accessing at least one data source to retrieve data associated with the user,

comparing the retrieved data against a listing of possible questions associated with the retrieved data to determine associations between the retrieved data and the listing of possible questions,

based on a ranking of the listing of possible questions, formulating at least one question set using questions within the listing of possible questions for

which retrieved data is available, where each of the at least one question set includes at least two different questions,

causing at least some of the questions from the at least one question set to be presented to the user, and,

based on responses to the questions from the user, determining;

whether the user is authenticated, according to a total authentication point value;

wherein determining includes at least determining, based on a response to one question from the at least one question set, that the response is a partially correct response to that one question;

wherein a correct response is a value between a first minimum threshold value and a first maximum threshold value, and the partially correct response is a value;

a) that is not between the first minimum threshold value and the first maximum threshold value, and

b) that is between a second minimum threshold value and a second maximum threshold value;

wherein the second minimum threshold value is less than the first minimum threshold value, and the second maximum threshold value is greater than the first maximum threshold value;

awarding points to the partially correct response, wherein the points are based on a multiplier that is configured for a partially correct response;

wherein the multiplier for a partially correct response is different than a multiplier that is configured for a correct response;

determining that the user is authenticated when the total authentication point value exceeds a predetermined total.

23. The non-transitory storage medium of claim 22, wherein determining includes comparing the responses to the retrieved data associated with the at least some of the questions presented to the user.

24. The non-transitory storage medium of claim 22, wherein the one or more sequences of instructions which, when executed by a first processor of the one or more processors, cause the first processor to further perform the steps of:

receiving configuration data, where the configuration data includes at least one of;

a priority ranking for the listing of potential questions, a number of question sets, a number of questions for each question set, and at least one authentication criteria.

25. The non-transitory storage medium of claim 24, wherein the at least one authentication criteria includes at least one of a percentage of questions to respond to correctly, a number of questions to respond to partially correctly, and a percentage of questions to respond to partially correctly.

26. The non-transitory storage medium of claim 22, wherein the at least one data source includes at least one database containing personal information or corporate information, wherein the personal information includes at least one of:

credit data, debit data, demographic data, and household data.