Method and apparatus for enabling authentication of on-line communications

• US 7,996,530 B1
• Filed: 01/27/2005
• Issued: 08/09/2011
• Est. Priority Date: 11/15/2004
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Koenig, William, Wright, David, MacLean, Rhonda, Hogeboom, David A., Phillips, Richard Wade, Parra, William A.
• Primary Examiner(s): Hamza; Faruk
• Application Number:
  US10/905,942
• Time in Patent Office: 2,385 Days
• Field of Search: 709/206, 709217-219, 709/223, 709/225, 713/175, 726/5, 726/10, 726 17- 18
• US Class Current: 709/225
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

Method and apparatus for enabling authentication of on-line communications. In some embodiments, a message code is embedded in an e-mail, where the message code can be used by the recipient to verify the authenticity of the e-mail or of a Web site. In some embodiments, this code can be created for a particular e-mail message; in other embodiments, the code is created as a watermark for use by a customer or other a specific user or recipient. The message code is associated with both the e-mail message and the recipient. In the case of a message-specific code, a recipient can verify the e-mail message by inputting the code via a Web server to be looked up in the database. Provision is also made for including steganographic information in graphical or other codes as further authentication when accessing a Web site.

Claims

1. A system for authenticating a website to a specific user prior to providing the specific user with access to the website, the system comprising:

a data repository configured to store a graphical message code, a user authentication, and a userid, wherein each of the graphical message code, user authentication, and userid is associated with the specific user; and

a hardware processor operatively connected to the data repository and configured to;

receive the userid from the specific user;

present the graphical message code to the specific user after receiving the userid from the specific user and based at least partially on a determination that the userid received from the specific user is associated with the graphical message code stored in the data repository;

receive the user authentication from the specific user after presenting the graphical message code to the specific user; and

provide the specific user with access to the website after receiving the user authentication from the specific user and based at least partially on a determination that the user authentication received from the specific user is associated with the userid stored in the data repository,

wherein the graphical message code is selected by the specific user prior to the graphical message code being presented to the specific user, and wherein the graphical message code serves to authenticate the website to the specific user.

2. The system of claim 1 wherein the graphical message code further comprises steganographic information.

3. The system of claim 1, wherein the hardware processor is further configured to:

create the graphical message code; and

associate the graphical message code with the userid.

4. The system of claim 1, wherein the user authentication is a password selected by the specific user.

5. The system of claim 1, wherein the graphical message code is a watermark.

6. The system of claim 1, wherein the determination that the userid received from the specific user is associated with the graphical message code stored in the data repository comprises:

the hardware processor determining that the userid received from the specific user matches the userid that is stored in the data repository and determining that the userid stored in the data repository is associated with the graphical message code stored in the data repository.

7. The system of claim 1, wherein the determination that the user authentication received from the specific user is associated with the userid stored in the data repository comprises:

the hardware processor determining that the user authentication received from the specific user matches the user authentication stored in the data repository and determining that the user authentication stored in the data repository is associated with the userid stored in the data repository.

8. The system of claim 1, wherein the hardware processor presenting the graphical message code to the specific user comprises:

the hardware processor retrieving the graphical message code from the data repository and transmitting the graphical message code to a processing device accessible to the specific user.

9. The system of claim 1, wherein the website is associated with online banking, and wherein the hardware processor is further configured to:

present an online banking logon page to the specific user,

wherein the hardware processor receives the userid from the specific user based at least partially on the specific user inputting the userid into the online banking logon page.

10. The system of claim 1, wherein the hardware processor is further configured to:

present a user interface to the specific user that enables the specific user to select the graphical message code from a plurality of graphical message codes.

11. A method for authenticating a website to a specific user prior to providing the specific user with access to the website, the method comprising:

receiving a userid from the specific user, wherein the userid is associated with the specific user;

presenting a graphical message code to the specific user after the receiving the userid, wherein the presenting the graphical message code is based at least partially on a determination that the graphical message code is associated with the userid;

receiving a user authentication from the specific user after the presenting the graphical message code; and

providing, using a processing device, the specific user with access to the website after the receiving the user authentication, wherein the providing the access is based at least partially on a determination that the user authentication is associated with the userid,

wherein the graphical message code is selected by the specific user prior to the presenting the graphical message code, and wherein the graphical message code serves to authenticate the website to the specific user.

12. The method of claim 11 wherein the graphical message code comprises steganographic information.

13. The method of claim 11, further comprising:

creating the graphical message code; and

associating the graphical message code with the userid.

14. The method of claim 11, wherein the presenting the graphical message code to the specific user comprises retrieving the graphical message code from a data repository and transmitting the graphical message code to a processing device accessible to the specific user.

15. A computer program product comprising a non-transitory computer-readable medium, wherein the non-transitory computer-readable medium comprises one or more computer-executable program code portions stored therein that, when executed by a computer, cause the computer to:

receive a userid from the specific user, wherein the userid is associated with the specific user;

display a graphical message code to the specific user after receiving the userid from the specific user and based at least partially on a determination that the graphical message code is associated with the userid;

receive a user authentication from the specific user after displaying the graphical message code; and

provide the specific user with access to the website after receiving the user authentication and based at least partially on a determination that the user authentication is associated with the userid,

wherein the graphical message code is selected by the specific user prior to the computer displaying the graphical message code to the specific user, and wherein the graphical message code serves to authenticate the website to the specific user.

16. The computer program product of claim 15 wherein the graphical message code comprises including steganographic information in the graphical message code.

17. The computer program product of claim 15, wherein the computer is accessible to the specific user, and wherein the computer receives the userid from the specific user based at least partially on the specific user inputting the userid into the computer.

18. An apparatus for authenticating a website to a specific user prior to providing the specific user with access to the website, the apparatus comprising:

a processing device configured to;

receive a userid from the specific user, wherein the userid is associated with the specific user;

present a graphical message code to the specific user after receiving the userid from the specific user and based at least partially on a determination that the graphical message code is associated with the userid;

receive a user authentication from the specific user after presenting the graphical message code to the specific user; and

provide the specific user with access to the website after receiving the user authentication from the specific user and based at least partially on a determination that the user authentication is associated with the userid,

wherein the graphical message code is selected by the specific user prior to the graphical message code being presented to the specific user, and wherein the graphical message code serves to authenticate the website to the specific user.

19. The apparatus of claim 18 wherein the graphical message code comprises steganographic information.

20. The apparatus of claim 18, wherein the processing device is further configured to:

create the graphical message code; and

associate the graphical message code with the userid.