Systems and methods for authenticating a user of a computer application, network, or device using a wireless device

• US 8,839,394 B2
• Filed: 05/13/2009
• Issued: 09/16/2014
• Est. Priority Date: 03/16/2007
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Finsphere Corporation (Visa, Inc.)
• Inventors: Dennis, Charles L., Snyder, Randall A., Boyle, Patrick J.
• Primary Examiner(s): THIAW, CATHERINE B
• Application Number:
  US12/992,064
• Publication Number:
  US 20110154447A1
• Time in Patent Office: 1,952 Days
• Field of Search: 726 3- 9
• US Class Current: 726/8
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04M 1/72457 according to geographic location
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A method and system for authenticating a user includes providing an invocation element capable of being activated by a single user action, receiving an indication that the invocation element has been activated, obtaining a location of a wireless device associated with the user, determining whether the wireless device is associated with an authorized user, approving the user to use the application based on a predetermined location criterion, and producing an indication that the user has been authenticated.

Claims

1. A method for authenticating a user of an application requiring secure access to the application using a mobile access point, an authentication system, and a wireless device associated with the user, the method comprising:

providing an invocation element on the wireless device, the invocation element being activated by a single user action on a user interface of the wireless device;

receiving an indication at the authentication system that the invocation element has been activated;

obtaining a location of the wireless device;

determining whether the user of the wireless device is an authorized user based on a previously registered association between a wireless device identifier associated with the wireless device and an application identifier associated with the application using the authentication system;

approving the user to use the application using the authentication system based on a predetermined location criterion related to at least one of the obtained wireless device location and a location of the mobile access point, when the wireless device is associated with an authorized user, wherein the mobile access point comprises a personal computing device configured to execute software applications that send and receive data over a data network and wherein the predetermined location criterion comprises a determination that the wireless device and the mobile access point are within a predetermined proximity of one another; and

producing an indication on the wireless device that the user has been authenticated when the user was approved using the authentication system, whereby the user can be reliably authenticated for use of the application with a single activation of the invocation element.

2. The method of claim 1, further comprising:

storing user identity data that includes a mobile directory number associated with the wireless device; and

enabling single-action authentication for the application, wherein storing the user identity data and enabling single-action authentication are performed before providing the invocation element.

3. The method of claim 2, wherein the mobile directory number is the wireless device identifier.

4. The method of claim 1, wherein the step of providing the invocation element includes presenting an electronic form that includes the invocation element.

5. The method of claim 4, wherein during a first presentation to the user, the form includes a mobile directory number field and the method further includes entering a mobile directory number associated with the wireless device in the mobile directory number field before activating the invocation element.

6. The method of claim 5, wherein during the first presentation to the user, the form also includes an additional field, and wherein the additional field must be populated by the user the first time the form is presented to the user before the invocation element can be activated.

7. The method of claim 6, wherein the additional field is a password field.

8. The method of claim 6, wherein during a subsequent presentation to the user, the invocation element is capable of being activated without entry of information in the form.

9. The method of claim 1, wherein the invocation element includes an authentication button presented on a display associated with the mobile access point and wherein the single user action includes selecting the authentication button with a user interface device associated with the mobile access point.

10. The method of claim 1, wherein the invocation element includes a button displayed on the wireless device and wherein the single user action includes selecting the button with the wireless device.

11. The method of claim 1, wherein the application is in data communication with the mobile access point over a network.

12. The method of claim 1, wherein providing the invocation element is implemented by remotely providing an electronic form to the user from the application to the mobile access point over a network.

13. The method of claim 1, wherein the step of providing the invocation element includes locally providing the invocation element on a display associated with the mobile access point from the application, wherein the mobile access point is a computer locally running the application.

14. The method of claim 1, wherein the application is one of a computer application, a computer network, and an electronic device.

15. The method of claim 1, further comprising obtaining authentication key information associated with the wireless device, wherein determining whether the wireless device is associated with an authorized user is also based on the authentication key information.

16. The method of claim 1, including a step of determining whether the wireless device is within a predetermined authentication distance from the mobile access point using the authentication system based on the obtained wireless device location and the location of the mobile access point, wherein the predetermined location criterion is based on the predetermined authentication distance.

17. The method of claim 16 wherein the step of determining whether the wireless device is within a predetermined authentication distance from the mobile access point includes sending an electronic wireless device location query from the authentication system to a wireless network service provider system, receiving a wireless device location response that includes a geographic location of the wireless device from the wireless network service provider system at the authentication system, and comparing the geographic location of the wireless device to a geographic location associated with the mobile access point.

18. The method of claim 17, wherein sending a wireless device location query includes sending a mobile directory number associated with the wireless device.

19. The method of claim 16, wherein the step of determining whether the wireless device is within a predetermined authentication distance from the mobile access point includes locally transmitting a unique identifier associated with the wireless device from the wireless device to the mobile access point and receiving the unique identifier at the mobile access point.

20. A non-transitory computer-readable medium including instructions that, when executed by a processing device, enable the processing device to perform a method of authenticating a user of an application requiring secure access to the application using a mobile access point and a wireless device associated with the user, the method comprising the steps of:

providing an invocation element activated by a single user action on a user interface of the wireless device;

receiving an indication at the authentication system that the invocation element has been activated;

obtaining a location of the wireless device;

determining whether the user of the wireless device is an authorized user based on a previously registered association between a wireless device identifier associated with the wireless device and an application identifier associated with the application;

approving the user to use the application based on a predetermined location criterion related to at least one of the obtained wireless device location and a location of the mobile access point, when the wireless device is associated with an authorized user, wherein the mobile access point comprises a personal computing device configured to execute software applications that send and receive data over a data network and wherein the predetermined location criterion comprises a determination that the wireless device and the mobile access point are within a predetermined proximity of one another;

and producing an indication on the wireless device that the user has been authenticated when the user was approved, whereby the user can be reliably authenticated for use of the application with a single activation of the invocation element.

21. The non-transitory computer-readable medium of claim 20, wherein the method further comprises:

storing user identity data that includes a mobile directory number associated with the wireless device;

enabling single-action authentication for the application, and providing the invocation element based on the enabled single-action authentication for the application, and determining whether the wireless device is associated with an authorized user based on the stored user identity data.

22. The non-transitory computer-readable medium of claim 21, wherein the mobile directory number is the wireless device identifier.

23. The non-transitory computer-readable medium of claim 20, wherein the method further comprises presenting an electronic form that includes the invocation element.

24. The non-transitory computer-readable medium of claim 23, wherein during a first presentation to the user, the form also includes a mobile directory number field, and wherein the method further comprises receiving a mobile directory number entered in the mobile directory number field and determining whether the wireless device is associated with an authorized user based on the received mobile directory number.

25. The non-transitory computer-readable medium of claim 24, wherein during the first presentation to the user, the form also includes an additional field, and wherein the additional field must be populated by the user the first time the form is presented to the user before the invocation element can be activated.

26. The non-transitory computer-readable medium of claim 25, wherein the additional field is a password field.

27. The non-transitory computer-readable medium of claim 24, wherein during a subsequent presentation to the user, the invocation element is capable of being activated without entry of information in the form.

28. The non-transitory computer-readable medium of claim 20, wherein the invocation element includes an authentication button presented on a display associated with the mobile access point and wherein the single user action includes selecting the authentication button with a user interface device associated with the mobile access point.

29. The non-transitory computer-readable medium of claim 20, wherein the invocation element includes a button displayed on the wireless device and wherein the single user action includes selecting the button with the wireless device.

30. The non-transitory computer-readable medium of claim 20, wherein the application is in data communication with the mobile access point over a network.

31. The non-transitory computer-readable medium of claim 20, wherein the method further comprises providing an electronic form to the user from the application to the mobile access point over a network.

32. The non-transitory computer-readable medium of claim 20, wherein the method further comprises locally providing the invocation element on a display associated with the mobile access point from the application, wherein the mobile access point is a computer locally running the application.

33. The non-transitory computer-readable medium of claim 20, wherein the application is one of a computer application, a computer network, and an electronic device.

34. The non-transitory computer-readable medium of claim 20, wherein the method further comprises obtaining authentication key information associated with the wireless device, and determining whether the wireless device is associated with an authorized user based on the authentication key information.

35. The non-transitory computer-readable medium of claim 20, wherein the method further comprises determining whether the wireless device is within a predetermined authentication distance from the mobile access point using the authentication system based on the obtained wireless device location and the location of the mobile access point, wherein the predetermined location criterion is based on the predetermined authentication distance.

36. The non-transitory computer-readable medium of claim 35, wherein the method further comprises sending an electronic wireless device location query from the authentication system to a wireless network service provider system, receiving a wireless device location response that includes a geographic location of the wireless device from the wireless network service provider system at the authentication system, and comparing the geographic location of the wireless device to a geographic location associated with the mobile access point.

37. The non-transitory computer-readable medium of claim 36, wherein the method further comprises sending a mobile directory number associated with the wireless device as a part of the wireless device location query.

38. The non-transitory computer-readable medium of claim 35, wherein the method further comprises locally transmitting a unique identifier associated with the wireless device from the wireless device to the mobile access point and receiving the unique identifier at the mobile access point.

39. A system for authenticating a user of an application requiring secure access to the application using a mobile access point in data communication with the application and a wireless device associated with the user, the system comprising:

a memory; and

a processor in data communication with the memory, the mobile access point, and the wireless device, wherein the processor is configured to;

provide an invocation element being activated by a single user action on a user interface of the wireless device;

receive an indication that the invocation element has been activated;

obtain a location of the wireless device;

determine whether the user of the wireless device is an authorized user based on a previously registered association between a wireless device identifier associated with the wireless device and an application identifier associated with the application;

approve the user to use the application based on a predetermined location criterion related to at least one of the obtained wireless device location and a location of the mobile access point, when the wireless device is associated with an authorized user, wherein the mobile access point comprises a personal computing device configured to execute software applications that send and receive data over a data network and wherein the predetermined location criterion comprises a determination that the wireless device and the mobile access point are within a predetermined proximity of one another;

and produce an indication on the wireless device that the user has been authenticated when the user was approved, whereby the user can be reliably authenticated for use of the application with a single activation of the invocation element.