Multi-channel multi-factor authentication

• US 8,516,562 B2
• Filed: 08/18/2011
• Issued: 08/20/2013
• Est. Priority Date: 05/13/2008
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Veritrix, Inc.
• Inventors: Headley, Paul
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US13/213,035
• Publication Number:
  US 20110302645A1
• Time in Patent Office: 733 Days
• Field of Search: None
• US Class Current: 726/7
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Systems and methods for authenticating electronic transactions are provided. The authentication methods employ a combination of security features and communication channels. These security features can be based, for example, on unique knowledge of the person being authenticated, a unique thing that the person has, unique personal features and attributes of the person, the ability of the person to respond, and to do so in a fashion that a machine cannot, and so forth. Methods for enrolling the person prior to authentication are also provided, as well as systems for enrollment and authentication.

Claims

1. A method for authenticating a user comprising:

receiving a claimant target over a first channel, the claimant target being associated with a user ID;

selecting an entry from a knowledge base associated with the user ID;

sending a prompt, where the prompt does not include the entry;

receiving a biometric response including voice data spoken by a claimant in response to the prompt;

performing a voice recognition analysis on the voice data to identify the entry within the voice data; and

performing a voice identification analysis to determine a match between the claimant and the user.

2. The method of claim 1 wherein the claimant target comprises the user ID.

3. The method of claim 1 wherein the prompt is sent over a second channel to a device address associated with the user ID.

4. The method of claim 1 wherein the prompt is sent over the first channel and the biometric response is received over a second channel.

5. The method of claim 1 wherein the biometric response comprises video.

6. The method of claim 1 wherein selecting the entry is performed according to a rule that the same entry is not used in successive authentications.

7. An authentication system comprising:

enrollment logic configured to enroll a user by

associating the user with a user ID,

associating the user ID and with a device address, and

creating a knowledge base associated with the user ID, the knowledge base including a set of records, each record including a pair of entries; and

authentication logic configured to authenticate a claimant as the user by receiving a claimant target over a first channel,

selecting a first entry from the knowledge base associated with the user ID,

sending a prompt, where the prompt does not include the first entry,

receiving a biometric response including voice data spoken by the claimant in response to the prompt,

performing a voice recognition analysis on the voice data to identify the first entry within the voice data, and

performing a voice identification analysis to determine a match between the claimant and the user.

8. The authentication system of claim 7 wherein the enrollment logic is further configured to enroll the user by obtaining voice data from the user.

9. The authentication system of claim 8 wherein the enrollment logic is further configured to obtain the voice data from a video of the user.

10. The authentication system of claim 7 wherein the enrollment logic is further configured to enroll the user by associating a device address with the user ID.

11. The authentication system of claim 10 wherein the authentication logic is further configured to authenticate the claimant by sending the prompt over a second channel to the device address.

12. The authentication system of claim 7 wherein the authentication logic is further configured to determine the prompt from a second entry of the knowledge base, wherein the first and second entries comprise a record of the knowledge base.

13. The authentication system of claim 7 wherein the authentication logic is further configured to receive video as the biometric response.

14. The authentication system of claim 7 further comprising logic configured to update the knowledge base after the user has been enrolled.

15. An authentication system comprising:

authentication logic configured to authenticate a claimant by

receiving a claimant target over a first channel,

selecting a first entry from a knowledge base associated with the claimant target,

sending a prompt, where the prompt does not include the first entry,

receiving a biometric response including voice data spoken by the claimant in response to the prompt,

performing a voice recognition analysis on the voice data to identify the first entry within the voice data, and

performing a voice identification analysis to determine a match between the claimant and a user associated with the claimant target.

16. The authentication system of claim 15 wherein the authentication logic is further configured to send the prompt over a second channel to a device address associated with the claimant target.

17. The authentication system of claim 15 wherein the authentication logic is further configured to determine the prompt from a second entry of the knowledge base, wherein the first and second entries comprise a record of the knowledge base.

18. The authentication system of claim 15 wherein the authentication logic is further configured to receive video as the biometric response.

19. The authentication system of claim 15 wherein the authentication logic is further configured to select the first entry according to a rule that the same entry is not used in successive authentications.