Single-channel multi-factor authentication

• US 8,536,976 B2
• Filed: 06/11/2008
• Issued: 09/17/2013
• Est. Priority Date: 06/11/2008
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Veritrix, Inc.
• Inventors: Headley, Paul, Collins, Kevin
• Primary Examiner(s): Zimmerman, Brian
• Assistant Examiner(s): SAMSON, SARA B
• Application Number:
  US12/137,129
• Publication Number:
  US 20090309698A1
• Time in Patent Office: 1,924 Days
• Field of Search: 340/5.2, 340/5.1, 340/1.1, 340/5.8, 340 581- 585, 382/115, 382/116, 382/118, 382/124, 902/3, 902/6
• US Class Current: 340/5.2
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

Systems and methods for authenticating electronic transactions are provided. The authentication methods employ a combination of security features. These security features can be based, for example, on unique knowledge of the person being authenticated, unique personal features and attributes of the person, the ability of the person to respond, and to do so in a fashion that a machine cannot, and so forth. Methods for enrolling the person prior to authentication are also provided, as well as systems for enrollment and authentication.

Claims

1. A method for authenticating a user comprising:

receiving a claimant target;

retrieving an IP address associated with a user ID and establishing a communication channel using the IP address;

sending a prompt over the communication channel, the prompt being one of a plurality of prompts, each of the plurality of prompts having a biometric template of the user associated therewith;

receiving a biometric response to the prompt over the communication channel; and

determining a match between the biometric response and a biometric template associated with the prompt.

2. The method of claim 1 wherein the claimant target comprises a user ID.

3. The method of claim 1 further comprising determining a user ID from the claimant target.

4. The method of claim 1 not comprising receiving a password.

5. The method of claim 1 wherein the claimant target is received over the communication channel.

6. The method of claim 1 wherein at least one of the prompts of the plurality of prompts comprises a personalized prompt.

7. The method of claim 1 wherein the prompt comprises a hybrid prompt including a random word.

8. The method of claim 7 further comprising applying voice recognition to the random word.

9. The method of claim 8 further comprising storing a biometric signature corresponding to the random word.

10. The method of claim 1 further comprising selecting the prompt from the plurality of prompts.

11. The method of claim 10 wherein selecting the prompt is performed according to a rule that the same prompt is not used in successive authentications.

12. The method of claim 1 wherein the prompt is obscured.

13. The method of claim 12 wherein the prompt is obscured through the application of a CAPTCHA program.

14. The method of claim 1 wherein the prompt comprises a hybrid prompt including a random word.

15. The method of claim 14 further comprising applying voice recognition to the random word.

16. The method of claim 15 further comprising storing a biometric signature corresponding to the random word.

17. The method of claim 1 further comprising sending a key that expires within a period of time.

18. The method of claim 17 wherein the key is included in the prompt.

19. A method for authenticating a user comprising:

receiving a claimant target;

retrieving a phone number associated with a user ID and establishing a communication channel using the phone number;

sending a prompt over the communication channel, the prompt being one of a plurality of prompts, each of the plurality of prompts having a biometric template of the user associated therewith;

receiving a biometric response to the prompt over the communication channel; and

determining a match between the biometric response and a biometric template associated with the prompt.

20. The method of claim 19 further comprising determining a user ID from the claimant target.

21. The method of claim 19 not comprising receiving a password.

22. The method of claim 19 wherein at least one of the prompts of the plurality of prompts comprises a personalized prompt.

23. The method of claim 19 wherein sending the prompt includes sending a SMS.