Authentication method

• US 8,695,071 B2
• Filed: 10/23/2011
• Issued: 04/08/2014
• Est. Priority Date: 10/23/2011
• Status: Active Grant

• Current Assignee: Textile Computer Systems, Inc.
• Original Assignee: Gopal Nandakumar
• Inventors: Nandakumar, Gopal
• Primary Examiner(s): Yalew, Fikremariam A
• Assistant Examiner(s): Le, Khoi
• Application Number:
  US13/279,296
• Publication Number:
  US 20130104213A1
• Time in Patent Office: 898 Days
• Field of Search: None
• US Class Current: 726/7
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation

Abstract

A system and method whereby the identity of a person, entity, device or the like attempting to gain access to a secured resource may be securely authenticated includes a means for receiving from a service client (such as a retail store, service station, on-line service provider or merchandiser, healthcare provider, medical insurer, information consumer or the like) a request for access to a secured resource, where the request for access was previously submitted to the service client by a requester purporting to be an authorized user of said secured resource; means for generating and communicating to the purported authorized user a challenge string adapted to provide a basis for authenticating the identity of the requester; a means for receiving from the service client a response string corresponding to the challenge string; and a means for evaluating the response string to authenticate the identity of the requester.

Claims

1. A method for authenticating the identity of a requester of access to a secured resource, said method for authenticating comprising the steps of:

receiving from a service client a request for access to a secured resource, said request for access having been submitted to said service client by a requester purporting to be an authorized user of said secured resource;

generating a challenge message with a computer server, said challenge message having a challenge string being a random string having a plurality of symbols, wherein at least one of the symbols of said challenge string is a specially designated symbol;

communicating said challenge message through a discrete channel to said authorized user that said requester purports to be, said discrete channel being a communications channel not readily identifiable by information submitted by an end user;

receiving from said service client a response message corresponding to said challenge message, said response message comprising a response string;

evaluating said response message to authenticate the identity of said requester as the authorized user; and

wherein said challenge message further comprises a copy of an image file, and further comprising the step of sending a service client image data including a publicly accessible file location for a copy of said image file.

2. The method for authenticating the identity of a requester of access to a secured resource as recited in claim 1, said method for authenticating further comprising the step of conducting for the benefit of said service client a transaction reliant upon access to said secured resource.

3. The method for authenticating the identity of a requester of access to a secured resource as recited in claim 2, said method for authenticating further comprising the steps of:

generating a receipt for said transaction; and

transmitting said receipt to said authorized user.

4. The method for authenticating the identity of a requester of access to a secured resource as recited in claim 2, wherein said transaction comprises providing a financial benefit.

5. The method for authenticating the identity of a requester of access to a secured resource as recited in claim 4, wherein said secured resource comprises a payment resource selected from the group consisting of:

a credit card account;

a banking account; and

an automated teller machine account.

6. The method for authenticating the identity of a requester of access to a secured resource as recited in claim 4, wherein said service client comprises a vendor selected from the group consisting of:

a retail store;

a service station;

an on-line service provider; and

an on-line merchandiser.

7. The method for authenticating the identity of a requester of access to a secured resource as recited in claim 2, wherein said secured resource comprises a medical record.

8. The method for authenticating the identity of a requester of access to a secured resource as recited in claim 7, wherein said service client comprises an information consumer selected from the group consisting of:

a healthcare provider; and

a medical insurer.

9. The method for authenticating the identity of a requester of access to a secured resource as recited in claim 2, wherein said secured resource comprises an information product.

10. The method for authenticating the identity of a requester of access to a secured resource as recited in claim 9, wherein said information product comprises a credit data.

11. The method of claim 1 further comprising the step of establishing a test adapted to detect the existence of a spoofing type deception.

12. The method for authenticating the identity of a requester of access to a secured resource as recited in claim 11, wherein said test adapted to detect the existence of a spoofing type deception is further adapted to at least in part authenticate the identity of said requester.

13. The method for authenticating the identity of a requester of access to a secured resource as recited in claim 1, said method for authenticating further comprising the step of determining based upon passage of time whether said response string should be deemed invalid.

14. The method of claim 1 further comprising the step of removing, restricting access to replacing the said copy of said image file at said publicly accessible file location after the copy of said image has been accessed by a service client.

15. The method of claim 1 wherein said response message further comprising a user-selected image selected from a plurality of images.

16. The method of claim 1 wherein said challenge string comprises instructions instructing the requester to enter a variation of a private string associated with the authorized user.

17. The method of claim 1 wherein said evaluating step comprises the step of determining whether an image composing said response string is a copy of an image composing said challenge string.

18. The method of claim 1 wherein said evaluating step comprises retrieving a key string associated with an authorized user and evaluating the received response string against said key string.