Methods and systems for authenticating users

• US 9,202,032 B2
• Filed: 10/03/2014
• Issued: 12/01/2015
• Est. Priority Date: 08/05/2009
• Status: Active Grant

• Current Assignee: Corporation DAON Technology
• Original Assignee: Daon Holdings Limited
• Inventors: White, Conor Robert, Peirce, Michael, Cramer, Jason Scott, Steiner, Chet Bradford, Diebes, Suzanna
• Primary Examiner(s): Powers, William
• Assistant Examiner(s): KAPLAN, BENJAMIN A
• Application Number:
  US14/505,535
• Publication Number:
  US 20150026771A1
• Time in Patent Office: 424 Days
• Field of Search: 726/7
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

A method of authenticating users to reduce transaction risks includes indicating a desire to conduct a transaction and determining whether the transaction requires access to protected resources. Moreover, the method determines whether inputted information is known, determines a state of a communications device when the inputted information is known, and transmits a biometric authentication request from a server to an authentication system when the state of the communications device is enrolled. Additionally, the method includes validating the communications device, capturing biometric authentication data in accordance with a biometric authentication data capture request with the communications device, biometrically authenticating the user, generating a one-time pass-phrase and storing the one-time pass-phrase on the authentication system when the user is authenticated, comparing the transmitted one-time pass-phrase against the stored one-time pass-phrase, and granting access to the protected resources when the transmitted and stored one-time pass-phrases match.

Claims

1. A method of authenticating users comprising:

extracting, by a processor, a risk level from an authentication request, the risk level being determined for a transaction desired to be conducted by a user;

determining an authentication data requirement corresponding to the risk level;

comparing captured authentication data against corresponding user enrollment biometric data, the captured authentication data being biometric data captured from the user in accordance with the authentication data requirement; and

validating the identity of the user when the captured authentication data and the user enrollment biometric data match, the desired transaction being conducted after the user is successfully validated.

2. A method of authenticating users in accordance with claim 1, said comparing step further comprising verifying that the captured authentication data is of sufficient quality for determining a comparison match.

3. A computing device for authenticating users comprising:

a processor;

a memory configured to store at least user enrollment data records, said computing device being associated with a network and said memory being in communication with said processor and having instructions stored thereon which, when executed by said processor, cause said processor to;

extract a risk level from an authentication request, the risk level being determined for a transaction desired to be conducted by a user;

determine an authentication data requirement corresponding to the risk level;

compare captured authentication data against corresponding user enrollment biometric data, the captured authentication data being biometric data captured from the user in accordance with the authentication data requirement; and

validate the identity of the user when the captured authentication data and the user enrollment biometric data match, the desired transaction being conducted after the user is successfully validated.

4. A computing device for authenticating users in accordance with claim 3 wherein when executed by said processor, the instructions further cause said processor to verify that the captured authentication data is of sufficient quality to determine a comparison match.

5. A computer program recorded on a non-transitory computer-readable recording medium included in a computing device for enabling increased accuracy of biometric authentication transaction results, the computer program being comprised of instructions, which when read and executed by the computing device, cause the computing device to:

extract a risk level from an authentication request, the risk level being determined for a transaction desired to be conducted by a user;

determine an authentication data requirement corresponding to the risk level;

compare captured authentication data against corresponding user enrollment biometric data, the captured authentication data being biometric data captured from the user in accordance with the authentication data requirement; and

validate the identity of the user when the captured authentication data and the user enrollment biometric data match, the desired transaction being conducted after the user is successfully validated.

6. A computer program in accordance with claim 5 further comprising instructions, which read and executed by the computing device, cause the computing device to verify that the captured authentication data is of sufficient quality to determine a comparison match.

7. A method of authenticating users comprising:

conducting, by a processor, a first authentication transaction with authentication data captured from a user to authenticate the user, the authentication data being biometric data;

conducting a second authentication transaction with authentication data captured from the user to authenticate the user after successfully authenticating the user in the first authentication transaction, the authentication data for the second transaction being different than the authentication data for the first transaction; and

validating the identity of the user after the user is successfully authenticated in the second authentication transaction.

8. A method of authenticating users in accordance with claim 7 further comprising verifying that the captured authentication data for each authentication transaction is sufficient to determine a comparison match.

9. A computing device for authenticating users comprising:

a processor; and

a memory configured to store data, said computing device being associated with a network and said memory being in communication with said processor and having instructions stored thereon which, when executed by said processor, cause said processor to;

conduct a first authentication transaction with authentication data captured from a user to authenticate the user, the authentication data being biometric data;

conduct a second authentication transaction with authentication data captured from the user to authenticate the user after successfully authenticating the user in the first authentication transaction, the authentication data for the second transaction being different than the authentication data for the first transaction; and

validate the identity of the user after the user is successfully authenticated in the second authentication transaction.

10. A computing device for authenticating users in accordance with claim 9 wherein when executed by said processor, the instructions further cause said processor to verify that the captured authentication data for each authentication transaction is sufficient to determine a comparison match.

11. A computing device for authenticating users in accordance with claim 9, said computing device being an authentication computer system.

12. A computing device for authenticating users in accordance with claim 9, said computing device being a communications device.

13. A computing device for authenticating users in accordance with claim 12, said communications device being a smart phone.

14. A computing device for authenticating users in accordance with claim 12, said communications device being a tablet computer.

15. A computing device for authenticating users in accordance with claim 12, said communications device being a laptop computer.

16. A computing device for authenticating users in accordance with claim 12, said communications device being a personal digital assistant.

17. A computer program recorded on a non-transitory computer-readable recording medium included in a computing device for enabling increased accuracy of biometric authentication transaction results, the computer program being comprised of instructions, which when read and executed by the computing device, cause the computing device to:

conduct a first authentication transaction with authentication data captured from a user to authenticate the user, the authentication data being biometric data;

conduct a second authentication transaction with authentication data captured from the user to authenticate the user after successfully authenticating the user in the first authentication transaction, the authentication data for the second transaction being different than the authentication data for the first transaction; and

validate the identity of the user after the user is successfully authenticated in the second authentication transaction.

18. A computer program in accordance with claim 17 further comprising instructions, which read and executed by the computing device, cause the computing device to verify that the captured authentication data for each authentication transaction is sufficient to determine a comparison match.