Methods and systems for authentication

• US 8,621,562 B2
• Filed: 11/18/2010
• Issued: 12/31/2013
• Est. Priority Date: 12/11/2002
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Antell, Richard, Arena, Michael, Chraplewski, Michele, Shapiro, Robert D.
• Primary Examiner(s): Patel, Nirav B
• Application Number:
  US12/949,553
• Publication Number:
  US 20110067094A1
• Time in Patent Office: 1,139 Days
• Field of Search: 726 2- 7, 726 16- 18, 726 26- 30, 713182-186, 705/64, 705/67, 705/50, 709/223, 709/225, 709/229, 707/705, 707/783, 707/784
• US Class Current: 726/2
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Disclosed are systems and methods of authenticating a user on a network, including, based on identity information received from the user, accessing at least one data source to retrieve data associated with the user, comparing the retrieved data against a listing of possible questions associated with the retrieved data to determine associations between the retrieved data and the listing of possible questions, based on a ranking of the listing of possible questions, formulating at least one question set using questions within the listing of possible questions for which retrieved data is available, where each of the at least one question set includes at least two different questions, causing at least some of the questions from the at least one question set to be presented to the user, and, based on responses to the questions from the user, determining whether the user is authenticated.

Claims

1. A method, comprising:

receiving, using one or more processing units, identity information corresponding to an identity;

accessing, using the one or more processing units, one or more data sources using the identity information, wherein accessing includes obtaining additional data associated with the identity information;

accessing, using the one or more processing units, a collection of questions;

generating, using the one or more processing units, one or more answers corresponding to one or more questions in the collection of questions using the additional data associated with the identity information;

generating, using the one or more processing units, one or more question sets using the one or more questions that have corresponding answers, wherein the questions sets are generated according to a ranking of the one or more questions and corresponding answers;

outputting, using the one or more processing units, a question subset from the one or more question sets;

receiving, using the one or more processing units, one or more responses to the question subset, wherein each question in the question subset has an associated correctness criteria, wherein each response to a question is categorized according to the correctness criteria associated with that question, and wherein the correctness criteria includes partially correct response criteria, correct response criteria, and incorrect response criteria,

wherein the correct response criteria includes values between a first minimum threshold value and a first maximum threshold value, and the partially correct response criteria includes values that are between a second minimum threshold value and a second maximum threshold value and not between the first minimum threshold value and the first maximum threshold value, wherein the second minimum threshold value is less than the first minimum threshold value and the second maximum threshold value is greater than the first maximum threshold value;

assigning, using the one or more processing units, a score to each categorized response based on a multiplier, wherein a multiplier for the correct response criteria is different than a multiplier for the partially correct response criteria; and

authenticating, using the one or more processing units, the identity using the assigned scores.

2. The method of claim 1, wherein partially correct response criteria differs from correct response criteria and incorrect response criteria for each question in the question subset.

3. The method of claim 1, wherein each of the one or more question sets includes two or more questions.

4. The method of claim 1, wherein generating the one or more answers includes using the identity information in addition to the additional data associated with the identity information.

5. The method of claim 1, wherein the one or more question sets are generated according to a configurable question-set criteria.

6. The method of claim 5, wherein the question-set criteria includes one or more ranks for the one or more questions that have corresponding answers, and wherein the one or more ranks are used to generate the one or more question sets.

7. The method of claim 1, wherein authenticating includes using a configurable authentication criteria.

8. The method of claim 1, further comprising:

outputting, using the one or more processing units, one or more additional questions from the one or more question sets when authentication fails;

receiving, using the one or more processing units, one or more additional responses to the one or more additional questions, wherein the one or more additional responses are categorized;

assigning, using the one or more processing units, a score to each categorized additional response; and

authenticating, using the one or more processing units, using the assigned scores for the one or more additional responses.

9. The method of claim 8, wherein authenticating also includes using the assigned scores for the one or more responses.

10. The method of claim 1, further comprising:

outputting, using the one or more processing units, instructions related to one or more manual methods of authentication when authentication fails.

11. The method of claim 10, wherein the one or more manual methods of authentication include telephone, mail, or e-mail authentication.

12. The method of claim 1 further comprising:

determining that the identity is not authenticated based on the one or more responses to the question subset;

outputting a subsequent question subset in response to the determination that the identity is not authenticated based on the one or more responses to the question subset;

receiving, using the one or more processing units, one or more responses to the subsequent question subset; and

categorizing, using the one or more processing units, each of the responses to the subsequent question subset according to the correctness criteria associated with that question;

assigning, using the one or more processing units, scores to each categorized subsequent response; and

wherein the authenticating the identity further uses the scores assigned to each subsequent response.

13. The method of claim 1 further comprising identifying subsequent authentication attempts for the identity prior to generating the one or more question sets;

and providing a different question set from a previously provided question set.

14. The method of claim 1 wherein the correctness criteria for at least one of the one or more responses to the question subset comprises:

a first value identified as a correct value;

a range of values identified as partially correct;

and all other values identified as incorrect.

15. A system, comprising:

one or more processors;

a non-transitory computer-readable storage medium containing instructions configured to cause the one or more processors to perform operations, including;

receiving identity information corresponding to an identity;

accessing one or more data sources using the identity information, wherein accessing includes obtaining additional data associated with the identity information;

accessing a collection of questions;

generating one or more answers corresponding to one or more questions in the collection of questions using the additional data associated with the identity information;

generating one or more question sets using the one or more questions that have corresponding answers, wherein the questions sets are generated according to a ranking of the one or more questions and corresponding answers;

outputting a question subset from the one or more question sets;

receiving one or more responses to the question subset, wherein each question in the question subset has an associated correctness criteria, wherein each response to a question is categorized according to the correctness criteria associated with that question, and wherein the correctness criteria includes partially correct response criteria, correct response criteria, and incorrect response criteria,

wherein the correct response criteria includes values between a first minimum threshold value and a first maximum threshold value, and the partially correct response criteria includes values that are between a second minimum threshold value and a second maximum threshold value and not between the first minimum threshold value and the first maximum threshold value, wherein the second minimum threshold value is less than the first minimum threshold value and the second maximum threshold value is greater than the first maximum threshold value;

assigning a score to each categorized response based on a multiplier, wherein a multiplier for the correct response criteria is different than a multiplier for the partially correct response criteria; and

authenticating the identity using the assigned scores.

16. The system of claim 15, wherein partially correct response criteria differs from correct response criteria and incorrect response criteria for each question in the question subset.

17. The system of claim 15, wherein each of the one or more question sets includes two or more questions.

18. The system of claim 15, wherein generating the one or more answers includes using the identity information in addition to the additional data associated with the identity information.

19. The system of claim 15, wherein the one or more question sets are generated according to a configurable question-set criteria.

20. The system of claim 19, wherein the question-set criteria includes one or more ranks for the one or more questions that have corresponding answers, and wherein the one or more ranks are used to generate the one or more question sets.

21. The system of claim 15, wherein authenticating includes using a configurable authentication criteria.

22. The system of claim 15, wherein authenticating is performed over an electronic network.

23. The system of claim 15, wherein authenticating is performed over a telephone network.

24. The system of claim 15, further comprising instructions to cause the one or more processors to perform operations, including:

outputting one or more additional questions from the one or more question sets when authentication fails;

receiving one or more additional responses to the one or more additional questions, wherein the one or more additional responses are categorized;

assigning a score to each categorized additional response; and

authenticating using the assigned scores for the one or more additional responses.

25. The system of claim 24, wherein authenticating also includes using the assigned scores for the one or more responses.

26. The system of claim 15, further comprising instructions to cause the one or more processors to perform operations, including:

outputting instructions related to one or more manual methods of authentication when authentication fails.

27. The system of claim 26, wherein the one or more manual methods of authentication include telephone, mail, or e-mail authentication.

28. A computer program product, tangibly embodied in a non-transitory machine readable storage medium, including instructions stored thereon configured to cause a data processing apparatus to:

receive identity information corresponding to an identity;

access one or more data sources using the identity information, wherein accessing includes obtaining additional data associated with the identity information;

access a collection of questions;

generate one or more answers corresponding to one or more questions in the collection of questions using the additional data associated with the identity information;

generate one or more question sets using the one or more questions that have corresponding answers, wherein the questions sets are generated according to a ranking of the one or more questions and corresponding answers;

output a question subset from the one or more question sets;

receive one or more responses to the question subset, wherein each question in the question subset has an associated correctness criteria, wherein each response to a question is categorized according to the correctness criteria associated with that question, and wherein the correctness criteria includes partially correct response criteria, correct response criteria, and incorrect response criteria,

wherein the correct response criteria includes values between a first minimum threshold value and a first maximum threshold value, and the partially correct response criteria includes values that are between a second minimum threshold value and a second maximum threshold value and not between the first minimum threshold value and the first maximum threshold value, wherein the second minimum threshold value is less than the first minimum threshold value and the second maximum threshold value is greater than the first maximum threshold value;

assign a score to each categorized response based on a multiplier, wherein a multiplier for the correct response criteria is different than a multiplier for the partially correct response criteria; and

authenticate the identity using the assigned scores.

29. The computer program product of claim 28, wherein partially correct response criteria differs from correct response criteria and incorrect response criteria for each question in the question subset.

30. The computer program product of claim 28, wherein each of the one or more question sets includes two or more questions.

31. The computer program product of claim 28, wherein generating the one or more answers includes using the identity information in addition to the additional data associated with the identity information.

32. The computer program product of claim 28, wherein the one or more question sets are generated according to a configurable question-set criteria.

33. The computer program product of claim 32, wherein the question-set criteria includes one or more ranks for the one or more questions that have corresponding answers, and wherein the one or more ranks are used to generate the one or more question sets.

34. The computer program product of claim 28, wherein authenticating includes using a configurable authentication criteria.

35. The computer program product of claim 28, further comprising instructions configured to cause a data processing apparatus to:

output one or more additional questions from the one or more question sets when authentication fails;

receive one or more additional responses to the one or more additional questions, wherein the one or more additional responses are categorized;

assign a score to each categorized additional response; and

authenticate using the assigned scores for the one or more additional responses.

36. The computer program product of claim 35, wherein authenticating also includes using the assigned scores for the one or more responses.

37. The computer program product of claim 28, further comprising instructions configured to cause a data processing apparatus to:

output instructions related to one or more manual methods of authentication when authentication fails.

38. The computer program product of claim 37, wherein the one or more manual methods of authentication include telephone, mail, or e-mail authentication.