Adaptive policies and protections for securing financial transaction data at rest

• US 8,850,539 B2
• Filed: 06/22/2010
• Issued: 09/30/2014
• Est. Priority Date: 06/22/2010
• Status: Active Grant

• Current Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Original Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Inventors: Bailey, JR., Samuel A.
• Primary Examiner(s): Hailu, Teshome
• Assistant Examiner(s): Getachew, Abiy
• Application Number:
  US12/820,193
• Publication Number:
  US 20110314529A1
• Time in Patent Office: 1,561 Days
• Field of Search: 726/7
• US Class Current: 726/7
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/325 using wireless networks
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G09C 1/04 with sign carriers or indicators moved relative to one another to positions determined by a permutation code, or key, so as to indicate the appropriate corresponding clear or ciphered text
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A system for challenge-response authentication is provided by receiving, from an external terminal over a communication network, a request for access to a service. A plurality of objects is presented to a user via a display. A plurality of codes is received over the communication network, each of the plurality of codes corresponding to one of the plurality of objects. The plurality of codes are matched to a plurality of alphanumeric characters according to a predetermined table. An alphanumeric string is generated from the plurality of alphanumeric characters and the alphanumeric string is compared to a user identifier stored in a database. Based on the comparing, a determination is made as to whether to grant the user access to the service.

Claims

1. A method for challenge-response authentication, the method comprising:

receiving, from an external terminal over a communication network, a request for access to a service;

presenting to a user, via a display, a plurality of images;

receiving, via the external terminal, an arrangement of the plurality of images;

receiving, over the communication network, a plurality of codes based on the arrangement of the plurality of images, each of the plurality of codes corresponding to an image of the plurality of images and to an alphanumeric character of a plurality of alphanumeric characters, the plurality of codes being distinct from the plurality of alphanumeric characters;

matching the plurality of codes to the plurality of alphanumeric characters based on a predetermined one-time use table, wherein the one-time use table associates each image of the plurality of images with a corresponding code of the plurality of codes and with a corresponding alphanumeric character of the plurality of alphanumeric characters, wherein each of the plurality of codes is generated, by a pseudorandom number generator, independently from the plurality of alphanumeric characters;

generating an alphanumeric string from the plurality of alphanumeric characters based on the matching;

comparing the alphanumeric string to an alphanumeric user identifier stored in a database; and

determining whether to grant the user access to the service based on a result of the comparing.

2. The method of claim 1, wherein generating an alphanumeric string includes generating an alphanumeric string based on the order the codes were received over the communication network.

3. The method of claim 1, wherein the plurality of images includes at least one of:

an undistorted image of an alphanumeric character, a distorted image of an alphanumeric character, an image including a plurality of sub-images, an image pre-selected by the user, an image including a plurality of overlaying sub-images, or an image including a portion of a mathematical equation.

4. The method of claim 1, wherein the request for access includes at least one of:

a request for authorization to complete a financial transaction using a financial transaction account linked to the external terminal;

or

a request for access to financial data associated with the financial transaction account linked to the external terminal.

5. The method of claim 1, wherein presenting the plurality of images further includes presenting the plurality of images as at least one of:

a multidimensional grid of the plurality of images, a horizontal arrangement of the plurality of images, or a spatial overlay of the plurality of images.

6. The method of claim 1, wherein the alphanumeric user identifier stored in the database is an alphanumeric string that uniquely identifies the user and a financial account of the user.

7. A system for challenge-response authentication, the system comprising:

a processor, coupled to a memory, configured to;

receive, from an external terminal over a communication network, a request for access to a service;

present to a user, via a display, a plurality of images;

receive, via the external terminal, an arrangement of the plurality of images;

receive, over the communication network, a plurality of codes based on the arrangement of the plurality of images, each of the plurality of codes corresponding to an image of the plurality of images and to an alphanumeric character of a plurality of alphanumeric characters, the plurality of codes being distinct from the plurality of alphanumeric characters;

match the plurality of codes to the plurality of alphanumeric characters based on a predetermined one-time use table, wherein the one-time use table associates each image of the plurality of images with a corresponding code of the plurality of codes and with a corresponding alphanumeric character of the plurality of alphanumeric characters, wherein each of the plurality of codes is generated, by a pseudorandom number generator, independently from the plurality of alphanumeric characters;

generate an alphanumeric string from the plurality of alphanumeric characters based on the matching;

compare the alphanumeric string to an alphanumeric user identifier stored in a database; and

determine whether to grant the user access to the service based on a result of the comparing.

8. The system of claim 7, wherein generating an alphanumeric string includes generating an alphanumeric string based on the order the codes were received over the communication network.

9. The system of claim 7, wherein the plurality of images includes at least one of:

an undistorted image of an alphanumeric character, a distorted image of an alphanumeric character, an image including a plurality of sub-images, an image pre-selected by the user, an image including a plurality of overlaying sub-images, or an image including a portion of a mathematical equation.

10. The system of claim 7, wherein the request for access includes at least one of:

a request for authorization to complete a financial transaction using a financial transaction account linked to the external terminal;

or

a request for access to financial data associated with the financial transaction account linked to the external terminal.

11. The system of claim 7, wherein the processor is further configured to:

present the plurality of images as at least one of;

a multidimensional grid of the plurality of images, a horizontal arrangement of the plurality of images, or a spatial overlay of the plurality of images.

12. The system of claim 7, wherein the alphanumeric user identifier stored in the database is an alphanumeric string that uniquely identifies the user and a financial account of the user.

13. A non-transitory computer-readable medium having stored thereon sequences of instructions, the sequences of instructions including instructions, which, when executed by a computer system, cause the computer system to perform:

receiving, from an external terminal over a communication network, a request for access to a service;

presenting to a user, via a display, a plurality of images;

receiving, via the external terminal, an arrangement of the plurality of images;

receiving, over the communication network, a plurality of codes based on the arrangement of the plurality of images, each of the plurality of codes corresponding to an image of the plurality of images and to an alphanumeric character of a plurality of alphanumeric characters, the plurality of codes being distinct from the plurality of alphanumeric characters;

matching the plurality of codes to the plurality of alphanumeric characters based on a predetermined one-time use table, wherein the one-time use table associates each image of the plurality of images with a corresponding code of the plurality of codes and with a corresponding alphanumeric character of the plurality of alphanumeric characters, wherein each of the plurality of codes is generated, by a pseudorandom number generator, independently from the plurality of alphanumeric characters;

generating an alphanumeric string from the plurality of alphanumeric characters based on the matching;

comparing the alphanumeric string to an alphanumeric user identifier stored in a database; and

determining whether to grant the user access to the service based on a result of the comparing.

14. The non-transitory computer readable medium of claim 13, wherein generating an alphanumeric string includes generating an alphanumeric string based on the order the codes were received over the communication network.

15. The non-transitory computer readable medium of claim 13, wherein the plurality of images includes at least one of:

an undistorted image of an alphanumeric character, a distorted image of an alphanumeric character, an image including a plurality of sub-images, an image pre-selected by the user, an image including a plurality of overlaying sub-images, or an image including a portion of a mathematical equation.

16. The non-transitory computer readable medium of claim 13, wherein the request for access includes at least one of:

a request for authorization to complete a financial transaction using a financial transaction account linked to the external terminal;

or

a request for access to financial data associated with the financial transaction account linked to the external terminal.

17. The non-transitory computer readable medium of claim 13, wherein presenting the plurality of images further includes presenting the plurality of images as at least one of:

a multidimensional grid of the plurality of images, a horizontal arrangement of the plurality of images, or a spatial overlay of the plurality of images.

18. The non-transitory computer readable medium of claim 13, wherein the alphanumeric user identifier stored in the database is an alphanumeric string that uniquely identifies the user and a financial account of the user.

19. A method for generating a challenge-response authentication interface, the method comprising:

generating a plurality of images;

generating a plurality of codes, each of the plurality of codes corresponding to an image of the plurality of images and to an alphanumeric character of a plurality of alphanumeric characters, wherein each of the plurality of codes is generated, by a pseudorandom number generator, independently from the plurality of alphanumeric characters;

generating a one-time use table that associates each image of the plurality of images with a corresponding code of the plurality of codes and with a corresponding alphanumeric character of the plurality of alphanumeric characters, the plurality of codes being distinct from the plurality of alphanumeric characters; and

generating an interactive graphical presentation of the plurality of images, wherein the interactive graphical presentation is configured to;

receive, via an external terminal, an arrangement of the plurality of images; and

provide, over a communication network, the plurality of codes based on the arrangement of the plurality of images.

20. A system for generating a challenge-response authentication interface, the system comprising:

a processor, coupled to a memory, configured to;

generate a plurality of images;

generate a plurality of codes, each of the plurality of codes corresponding to an image of the plurality of images and to an alphanumeric character of a plurality of alphanumeric characters, the plurality of codes being distinct from the plurality of alphanumeric characters, wherein each of the plurality of codes is generated, by a pseudorandom number generator, independently from the plurality of alphanumeric characters;

generate a one-time use table that associates each image of the plurality of images with a corresponding code of the plurality of codes and with a corresponding alphanumeric character of the plurality of alphanumeric characters; and

generate an interactive graphical presentation of the plurality of images, wherein the interactive graphical presentation is configured to;

receive, via an external terminal, an arrangement of the plurality of images; and

provide, over a communication network, the plurality of codes based on the arrangement of the plurality of images.