Adaptive policies and protections for securing financial transaction data at rest

• US 9,213,975 B2
• Filed: 09/22/2014
• Issued: 12/15/2015
• Est. Priority Date: 06/22/2010
• Status: Active Grant

• Current Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Original Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Inventors: Bailey, Samuel A. Jr.
• Primary Examiner(s): Harriman, Dant Shaifer
• Assistant Examiner(s): Getachew, Abiy
• Application Number:
  US14/492,771
• Publication Number:
  US 20150012979A1
• Time in Patent Office: 449 Days
• Field of Search: 726/7
• US Class Current: 1/1
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/325 using wireless networks
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G09C 1/04 with sign carriers or indicators moved relative to one another to positions determined by a permutation code, or key, so as to indicate the appropriate corresponding clear or ciphered text
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A system, method, and computer-readable medium for challenge-response authentication are provided. A plurality of codes is received over a communication network based on input provided by way of a user interface displaying a plurality of images. An alphanumeric string is generated based on the received plurality of codes and based on a table that associates each one of the plurality of codes with a respective one of the plurality of images and with a respective one of a plurality of alphanumeric characters. A determination is made as to whether to grant authorization based on whether the generated alphanumeric string matches an alphanumeric user identifier stored in a memory device in association with a user.

Claims

1. A method for challenge-response authentication, the method comprising:

receiving, over a communication network, a plurality of codes based on input provided through a user interface displaying a plurality of images;

generating an alphanumeric string from a plurality of alphanumeric characters, the alphanumeric string being generated based on (1) the received plurality of codes and (2) a table that associates each one of the plurality of codes with a respective one of the plurality of images and with a respective one of the plurality of alphanumeric characters, the plurality of codes being distinct from the plurality of alphanumeric characters; and

determining to grant authorization when the generated alphanumeric string matches an alphanumeric user identifier stored in a memory device in association with a user.

2. The method of claim 1, wherein generating the alphanumeric string includes matching each one of the received plurality of codes to a corresponding one of the plurality of alphanumeric characters based on the table.

3. The method of claim 1, wherein the input provided through the user interface includes an arrangement of the plurality of images.

4. The method of claim 3, wherein generating the alphanumeric string includes matching the received plurality of codes to corresponding ones of the plurality of alphanumeric characters based on the table, and arranging the corresponding ones of the plurality of alphanumeric characters in an order that corresponds to the arrangement of the plurality of images.

5. The method of claim 1, wherein each one of the plurality of codes is generated by using a pseudorandom number generator, and is populated in the table in association with the respective one of the plurality of images and with the respective one of a plurality of alphanumeric characters.

6. The method of claim 1, wherein a new table is generated (1) after determining to grant authorization, (2) after a predetermined number of authorization requests is received, or (3) after a predetermined amount of time has transpired since the table was previously generated.

7. The method of claim 1, wherein the user interface displaying the plurality of images displays the plurality of images as any one or a combination of:

a multidimensional grid of the plurality of images, a horizontal arrangement of the plurality of images, or a spatial overlay of the plurality of images.

8. A system for challenge-response authentication, the system comprising:

a memory;

a processor, coupled to the memory, configured to;

receive, over a communication network, a plurality of codes based on input provided through a user interface displaying a plurality of images;

generate an alphanumeric string from a plurality of alphanumeric characters, the alphanumeric string being generated based on (1) the received plurality of codes and (2) a table that associates each one of the plurality of codes with a respective one of the plurality of images and with a respective one of the plurality of alphanumeric characters, the plurality of codes being distinct from the plurality of alphanumeric characters; and

determine to grant authorization when the generated alphanumeric string matches an alphanumeric user identifier stored in a memory device in association with a user.

9. The system of claim 8, wherein the processor is configured to generate the alphanumeric string at least in part by matching each one of the received plurality of codes to a corresponding one of the plurality of alphanumeric characters based on the table.

10. The system of claim 8, wherein the input provided through the user interface includes an arrangement of the plurality of images.

11. The system of claim 10, wherein the processor is configured to generate the alphanumeric string at least in part by matching the received plurality of codes to corresponding ones of the plurality of alphanumeric characters based on the table, and arranging the corresponding ones of the plurality of alphanumeric characters in an order that corresponds to the arrangement of the plurality of images.

12. The system of claim 8, wherein each one of the plurality of codes is generated by using a pseudorandom number generator, and is populated in the table in association with the respective one of the plurality of images and with the respective one of a plurality of alphanumeric characters.

13. The system of claim 8, wherein a new table is generated (1) after determining to grant authorization, (2) after a predetermined number of authorization requests is received, or (3) after a predetermined amount of time has transpired since the table was previously generated.

14. The system of claim 8, wherein the user interface displaying the plurality of images displays the plurality of images as any one or a combination of:

a multidimensional grid of the plurality of images, a horizontal arrangement of the plurality of images, or a spatial overlay of the plurality of images.

15. A non-transitory computer-readable medium having stored thereon sequences of instructions, the sequences of instructions including instructions, which, when executed by a computer system, cause the computer system to:

receive, over a communication network, a plurality of codes based on input provided through a user interface displaying a plurality of images;

generate an alphanumeric string from a plurality of alphanumeric characters, the alphanumeric string being generated based on (1) the received plurality of codes and (2) a table that associates each one of the plurality of codes with a respective one of the plurality of images and with a respective one of the plurality of alphanumeric characters, the plurality of codes being distinct from the plurality of alphanumeric characters; and

determine to grant authorization when the generated alphanumeric string matches an alphanumeric user identifier stored in a memory device in association with a user.

16. The non-transitory computer readable medium of claim 15, wherein the alphanumeric string is generated at least in part by matching each one of the received plurality of codes to a corresponding one of the plurality of alphanumeric characters based on the table.

17. The non-transitory computer readable medium of claim 15, wherein the input provided through the user interface includes an arrangement of the plurality of images.

18. The non-transitory computer readable medium of claim 17, wherein the alphanumeric string is generated at least in part by matching the received plurality of codes to corresponding ones of the plurality of alphanumeric characters based on the table, and arranging the corresponding ones of the plurality of alphanumeric characters in an order that corresponds to the arrangement of the plurality of images.

19. The non-transitory computer readable medium of claim 15, wherein each one of the plurality of codes is generated by using a pseudorandom number generator, and is populated in the table in association with the respective one of the plurality of images and with the respective one of a plurality of alphanumeric characters.

20. The non-transitory computer readable medium of claim 15, wherein a new table is generated (1) after determining to grant authorization, (2) after a predetermined number of authorization requests is received, or (3) after a predetermined amount of time has transpired since the table was previously generated.