User authentication based on fob/indicia scan

• US 9,317,674 B2
• Filed: 02/07/2014
• Issued: 04/19/2016
• Est. Priority Date: 02/07/2014
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Grigg, David M., Burrell, Charles Jason, Bertanzetti, Peter John
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US14/175,615
• Publication Number:
  US 20150227726A1
• Time in Patent Office: 802 Days
• Field of Search: 726 4- 5, 726/7, 726 19- 20, 726 27- 28, 713/182, 705/16, 705/50, 707/770, 455/41.1
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

Embodiments of the invention are directed to systems, methods and computer program products for receiving a request from a user for access to at least one function associated with a first application; determining that access to at least one function requires user authentication; initiating sensing of an authentication validating carrier comprising a first credential; determining the first credential based at least in part on the sensed authentication validating carrier; validating the first credential, thereby resulting in a first successful user authentication; and granting access to at least one function associated with the first application based on the validation of the first successful user authentication.

Claims

1. An apparatus for authenticating a user, the apparatus comprising:

a memory;

a processor;

at least one sensor for continuously sensing an authentication validating carrier and communicating carrier information based on the authentication validating carrier to the processor, wherein the carrier information comprises a continuous stream of data; and

a module stored in the memory, executable by the processor, and configured to cause the processor to;

receive a first request from a user to access at least one first function associated with a first application;

determine that access to the at least one first function requires user authentication;

initiate sensing of the authentication validating carrier comprising a first credential, wherein initiating sensing of the authentication validating carrier comprises a continuous process;

determine the first credential based at least in part on the sensed authentication validating carrier, wherein determining the first credential is based at least in part on the carrier information, wherein determining the first credential comprises continuously analyzing the stream of data thereby resulting in the first credential;

validate the first credential, thereby resulting in a first successful user authentication; and

grant access to the at least one first function associated with the first application based at least in part on the first successful user authentication.

2. The apparatus of claim 1, wherein the at least one sensor comprises a camera;

wherein the carrier information comprises an image of indicia;

wherein the sensor is for sensing and communicating the image of indicia to the processor; and

wherein determining the first credential comprises decoding the image of indicia, thereby resulting in the first credential.

3. The apparatus of claim 1, wherein the at least one sensor comprises a microphone;

wherein the carrier information comprises an encoded audio message;

wherein the sensor is for sensing and communicating the encoded audio message to the processor; and

wherein determining the first credential comprises decoding the encoded audio message, thereby resulting in the first credential.

4. The apparatus of claim 1, wherein the at least one sensor is a near field communications (NFC) reader;

wherein the carrier information comprises a signal comprised of an encoded message emitted from a fob;

wherein the at least one sensor is for sensing and communicating the signal from the fob to the processor; and

wherein determining the first credential comprises decoding the encoded message, thereby resulting in the first credential.

5. The apparatus of claim 1, wherein the at least one sensor comprises a short range data transceiver;

wherein the carrier information comprises a signal comprised of an encoded message emitted from a short range data emitter;

wherein the at least one sensor is for sensing and communicating the signal from the short range data emitter to the processor; and

wherein determining the first credential comprises decoding the encoded message, thereby resulting in the first credential.

6. The apparatus of claim 1, wherein the at least one sensor comprises an accelerometer;

wherein the carrier information comprises movement from the apparatus;

wherein the at least one sensor is for sensing and communicating the movement from the apparatus to the processor; and

wherein determining the first credential comprises analyzing the movement from the apparatus thereby resulting in the first credential.

7. The apparatus of claim 1, wherein the at least one sensor comprises a light sensor;

wherein the carrier information comprises a pulsed light signal;

wherein the at least one sensor is for sensing and communicating the pulsed light signal to the processor;

wherein determining the first credential comprises analyzing the pulsed light signal thereby resulting in the first credential.

8. The apparatus of claim 1, wherein the first application comprises more than one function;

wherein the apparatus comprises more than one sensor and is configured to sense more than one authentication validating carrier;

wherein the functions associated with the first application comprise different levels of sensitivity;

wherein, the apparatus is configured to obtain and authenticate a specific authentication validating carrier depending on the first request.

9. The apparatus of claim 1, wherein the module is further configured to cause the processor to:

receive a second credential from the user;

validate the second credential, thereby resulting in a second successful user authentication; and

wherein granting access to the at least one first function associated with the first application is further based at least in part on the second successful user authentication.

10. The apparatus of claim 1, wherein the module is further configured to cause the processor to:

receive a second request from the user for access to at least one second function associated with a second application;

determine that access to at least one second function associated with the second application requires user authentication;

receive a second credential from the user;

validate the second credential, thereby resulting in a second successful user authentication; and

grant access to the at least one second function associated with the second application based on the second successful user authentication.

11. The apparatus of claim 10, wherein the access to at least one first function associated with the first application expires after an occurrence of an expiration event;

and

wherein the expiration event is at least one of a lapse of a period of time, an event associated with a third party application, an event associated with an operating system, and a user-initiated event.

12. The apparatus of claim 11, wherein the expiration of the at least one first function associated with the first application is extended based at least in part on successfully validating the second credential.

13. The apparatus of claim 12, wherein the number of times the expiration may be extended is limited as set by at least one of the user, the first application, the second application, a third party application, and an operating system.

14. The apparatus of claim 11, wherein the apparatus is further configured to deny access to the at least one first function associated with the first application if the second credential cannot be verified.

15. The apparatus as of claim 10, wherein the at least one first function associated with the first application is a subset of functions of the at least one second function associated with the second application.

16. The apparatus of claim 1, wherein validating the first credential comprises:

receiving an encrypted key from a remote server;

decrypting the encrypted key from the remote server using a common key;

encrypting the first credential using the decrypted key;

sending the encrypted first credential to the remote server using a network connection; and

receiving a message from the remote server indicating whether the first credential was effectively validated.

17. A method for authenticating a user, the method comprising:

receiving, by a computer processor, a request from a user to access at least one first function associated with a first application;

determining, by a computer processor, that access to the at least one first function requires user authentication;

initiating sensing, by a computer processor using a sensor, of an authentication validating carrier comprising a firsts credential, the sensor being configured to continuously sense the authentication validating carrier and communicate carrier information based on the authentication validating carrier to the processor, wherein the carrier information comprises a continuous stream of data, wherein initiating sensing of the authentication validating carrier comprises a continuous process;

determining, by a computer processor, the first credential based at least in part on the sensed authentication validating carrier, wherein determining the first credential is based at least in part on the carrier information, wherein determining the first credential comprises continuously analyzing the stream of data thereby resulting in the first credential;

validating, by a computer processor, the first credential, thereby resulting in a first successful user authentication; and

granting access, by a computer processor, to the at least one first function associated with the first application based at least in part on the first successful user authentication.

18. A computer program product for authenticating a user, the computer program product comprising:

a non-transitory computer-readable medium comprising;

a first set of codes for receiving a request from a user for access to at least one first function associated with a first application;

a second set of codes for determining that access to the at least one first function requires user authentication;

a third set of codes for initiating sensing, using a sensor, of an authentication validating carrier comprising a first credential, the sensor being configured to continuously sense the authentication validating carrier and communicate carrier information based on the authentication validating carrier to the processor, wherein the carrier information comprises a continuous stream of data, wherein initiating sensing of the authentication validating carrier comprises a continuous process;

a fourth set of codes for determining the first credential based at least in part on the sensed authentication validating carrier, wherein determining the first credential is based at least in part on the carrier information, wherein determining the first credential comprises continuously analyzing the stream of data thereby resulting in the first credential;

a fifth set of codes for validating the first credential, thereby resulting in a first successful user authentication; and

a sixth set of codes for granting access to the at least one first function associated with the first application based at least in part on the successful user authentication.