System and method for password-free access for validated users

• US 8,515,847 B2
• Filed: 06/19/2008
• Issued: 08/20/2013
• Est. Priority Date: 10/31/2006
• Status: Active Grant

• Current Assignee: Gula Consulting Limited Liability Company (Intellectual Ventures LLC)
• Original Assignee: Microfolio Data LLC (Intellectual Ventures LLC)
• Inventors: Schultz, Michael J.
• Primary Examiner(s): Chang, Edward
• Application Number:
  US12/142,727
• Publication Number:
  US 20090265773A1
• Time in Patent Office: 1,888 Days
• Field of Search: 705/44, 705/36, 705/35
• US Class Current: 705/36
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2133 Verifying human interaction, e.g., Captcha
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04M 1/665 by checking the validity of a code

Abstract

A new approach is proposed that first validates identity of a user/individual who is initiating a request for a web service for the first time. Once validated, the user is allowed to access the web service, to register securely with the provider of the web service, and to create a series of personalized questions to be used for future validation purposes. During the user'"'"'s subsequent request for the web service, the user will be asked, in addition to his/her user name, one or more of the personalized questions he/she created on rotation basis in place of a PIN or password.

Claims

1. A system, comprising:

a memory device configured to store instructions; and

a computing device configured to execute the instructions stored in the memory device to;

validate an identity of an individual requesting initial access to an online merchant by;

generating at least one knowledge based authentication (KBA) question based on at least one of a credit history or a transaction history of the individual in response to receiving a validation request from the online merchant; and

determining valid at least one response corresponding to the at least one KBA question by the individual;

enable the individual to select at least one personalized challenge question (PCQ) and to provide an answer to the at least one PCQ in response to validating the identity of the individual; and

enable subsequent access to the online merchant by the individual in response to comparing the answer to a subsequent answer to the at least one PCQ from the individual without prompting the individual for a personal identification number or a password.

2. The system of claim 1, wherein the computing device is further configured to execute the instructions stored in the memory device to:

store and manage the credit history or the transaction history of the individual in the memory device.

3. The system of claim 2, wherein the computing device is further configured to execute the instructions stored in the memory device to:

communicate over a network via communication interfaces or application programming interfaces (APIs) with the online merchant.

4. The system of claim 1, wherein the computing device is further configured to execute the instructions stored in the memory device to:

deny the identity of the individual in response to the at least one response to the at least one KBA question not being received in a timely manner.

5. The system of claim 1, wherein the computing device is further configured to execute the instructions stored in the memory device to:

determine valid the at least one response corresponding to the at least one KBA question based on objectively grading the at least one response to the at least one KBA question.

6. The system of claim 5, wherein the computing device is further configured to execute the instructions stored in the memory device to:

deny access to the online merchant by the individual in response to the validation of the identity of the individual.

7. The system of claim 1, further comprising:

a database configured to store the at least one PCQ, the answer, and the subsequent answer to the at least one PCQ.

8. The system of claim 7, wherein the computing device is further configured to execute the instructions stored in the memory device to:

retrieve the at least one PCQ or the subsequent answer to the at least one PCQ from the database.

9. The system of claim 7, wherein the computing device is further configured to execute the instructions stored in the memory device to:

record accesses to the online merchant by the individual in the database.

10. The system of claim 1, wherein the computing device is further configured to execute the instructions stored in the memory device to:

randomly select the at least one PCQ from a set of PCQs.

11. The system of claim 1, wherein the computing device is further configured to execute the instructions stored in the memory device to:

utilize an interactive voice response (IVR) system to validate the identity.

12. A method, comprising:

validating, using a processing device, an identity of a user in response to a request for access to an online merchant by the user by;

generating knowledge based authentication (KBA) questions based on at least one of a credit history or a transaction history of the user in response to receiving a validation request from the online merchant;

verifying a response to at least one of the KBA questions by the user; and

granting the request for access to the user in response to the verifying the response;

enabling, using the processing device, the user to create personal challenge questions (PCQs) and to provide first answers to the PCQs in response to validating the identity of the user;

prompting, using the processing device, the user with at least one of the PCQs in response to a subsequent request for access to the online merchant by the user; and

granting, using the processing device, the subsequent request for access in response to comparing the first answers to a second answer to the least one of the PCQs without prompting the user for a personal identification number or a password.

13. The method of claim 12, further comprising:

denying the request for access to the user in response to the user not replying to the KBA questions in a timely manner.

14. The method of claim 12, further comprising:

grading the response to the at least one KBA question;

granting the request for access to the user in response to the grading.

15. The method of claim 12, further comprising:

keeping records of request and access to the online merchant by the user.

16. The method of claim 12, further comprising:

randomly selecting a set of the PCQs for prompting the user.

17. The method of claim 12, further comprising:

validating the identity of the user in response to an interactive voice response (IVR) system.