System and method for dynamic multifactor authentication

• US 8,943,548 B2
• Filed: 12/20/2006
• Issued: 01/27/2015
• Est. Priority Date: 12/21/2005
• Status: Active Grant

• Current Assignee: Onespan North America Incorporated (OneSpan, Inc.)
• Original Assignee: Vasco Data Security Incorporated (OneSpan, Inc.)
• Inventors: Drokov, Igor, Punskaya, Elena, Tahar, Emmanuel
• Primary Examiner(s): Lewis, Lisa
• Assistant Examiner(s): DOLLY, KENDALL LYNN
• Application Number:
  US12/158,292
• Publication Number:
  US 20080307515A1
• Time in Patent Office: 2,960 Days
• Field of Search: 726 3- 6, 726 16- 18, 707/652, 707/654, 707/803, 707/770, 707/609
• US Class Current: 726/2
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4093 Monitoring of device authentication
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/65 Environment-dependent, e.g. using captured environmental data
• CPC Class Codes: H04W 12/71 Hardware identity

Abstract

A method of authenticating a user. The method comprises the step of sending an authentication request to a remote authentication device and generating a first piece of authentication information. A mobile device receives the first piece of authentication information from either an access terminal or the remote authentication device. The mobile device of the user generating a second piece of authentication information which is at least partially based on the received first piece of authentication information. The second piece of authentication information is sent to the remote authentication devices and the second piece of authentication information validated. If the second piece of authentication information is successfully validated an authentication signal is generated.

Claims

1. A method of authenticating a user, the method comprising the steps of:

sending an authentication request to a remote authentication device;

at the remote authentication device, generating a first piece of authentication information based on the received authentication request;

receiving at a mobile device, the first piece of authentication information from an access terminal that is in communication with the remote authentication device, wherein the first piece of authentication information comprises an encrypted message;

generating, within the mobile device of the user, a second piece of authentication information which is at least partially based on the received first piece of authentication information, wherein generating comprises decrypting the encrypted message and including at least a portion of the decrypted message in the second piece of authentication information;

sending the second piece of authentication information to the remote authentication device;

validating the second piece of authentication information; and

if the second piece of authentication information is successfully validated, generating an authentication signal,

wherein the first piece of authentication information is presented as an image on a display means of the access terminal and captured therefrom using an optical acquiring means of the mobile device,

wherein the first piece of authentication information contains transactional information related to a transaction which the user wishes to make.

2. The method of claim 1, wherein the first piece of authentication information is captured from the access terminal using a digital camera on the mobile device.

3. The method of claim 1, wherein the step of generating the second piece of authentication information is done using one of International Mobile Equipment Identity (IMEI), information relating to the Subscriber Identity Module (SIM) or information specific to the mobile device of the user.

4. The method of claim 1, wherein the second piece of authentication information comprises biometric data.

5. A system for authenticating a user, the system comprising:

sending means for sending an authentication request to a remote authentication device;

generating means at the remote authentication device for generating a first piece of authentication information based on the authentication request;

receiving means for receiving at a mobile device, the first piece of authentication information from an access terminal that is in communication with the remote authentication device, wherein the first piece of authentication information comprises an encrypted message;

generating means for generating, within the mobile device of the user, a second piece of authentication information which is at least partially based on the received first piece of authentication information, wherein generating comprises decrypting the encrypted message and including at least a portion of the decrypted message in the second piece of authentication information;

sending means for sending the second piece of authentication information to the remote authentication device;

validating means for validating the second piece of authentication information; and

generating means for generating an authentication signal if the second piece of authentication information is successfully validated by the validating means,

wherein the system is arranged such that the first piece of authentication information is presented as an image on a display means of the access terminal and captured therefrom using an optical acquiring means of the mobile device,

wherein the first piece of authentication information contains transactional information related to a transaction which the user wishes to make.

6. The system of claim 5, wherein the system is arranged such that the first piece of authentication information is captured from the access terminal using a digital camera on the mobile device.

7. The system of claim 5, wherein the system is arranged such that the generating means generates the second piece of authentication information using one of the International Mobile Equipment Identity (IMEI), information relating to the Subscriber Identity Module (SIM) or information specific to the mobile device of the user.

8. The system of claim 5, wherein the second piece of authentication information comprises biometric data.

9. The system of claim 5, wherein the mobile device comprises:

an optical input means;

a processing means; and

a display means.