Network authentication of multiple profile accesses from a single remote device

• US 9,391,982 B1
• Filed: 02/27/2014
• Issued: 07/12/2016
• Est. Priority Date: 02/27/2014
• Status: Active Grant

• Current Assignee: Cullen/Frost Bankers, Inc.
• Original Assignee: Cullen/Frost Bankers, Inc.
• Inventors: Stead, James M., Muthukrishnan, Arun, Johnson, Michael R., Rivera, Laurie A., Bilyeu, Selina D.
• Primary Examiner(s): Zhao, Don
• Application Number:
  US14/192,419
• Time in Patent Office: 866 Days
• Field of Search: 726/9
• US Class Current: 1/1
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 40/02 Banking, e.g. interest calculation or account maintenance credit or loans G06Q40/03
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

A network authentication system and method is described for authenticating multiple profile accesses from a single remote device. A device remote from a web server, yet connected to the web server via, for example, the Internet, can allow multiple users to register their profiles within the device. The profiles are registered using a pre-existing user ID and password corresponding to, for example, the user'"'"'s financial accounts. Multiple profiles and, specifically, the indicia of those profiles, can appear on the display of the remote device allowing each user the ability to select their own registered profile. Access to a profile is granted when the user enters their private PIN. Once the PIN is entered, the private information such as financial account information will be securely forwarded from the web server to the remote device.

Claims

1. A device configured for communication with a web server via a communication network, wherein the web server comprises a memory containing at least two user profiles and at least two tokens corresponding to the at least two user profiles, said device comprising:

a user interface configured to receive only personal identification numbers (PINs) from a user and, specifically, a first PIN and a second PIN, respectively associated with a first profile indicator and a second profile indicator displayed on a display communicatively coupled to the user interface;

a communication unit operatively coupled to the communication network for receiving a first token corresponding to a first user profile and a second token corresponding to a second user profile from the web server via the communication network;

an encryption unit operatively coupled to the communication unit for encrypting the first token using the first PIN and encrypting the second token using the second PIN;

a second memory operatively coupled to the encryption unit for storing the first encrypted token and the second encrypted token;

a hardware processor operatively coupled to the second memory for fetching the first encrypted token and the second encrypted token upon the user selecting the first profile indicator and the second profile indicator on the display, respectively, and the user interface receiving the first PIN and the second PIN, respectively;

wherein said communication unit is configured for;

sending to the web server via the communication network a first password generated from a combination of the first encrypted token and the first PIN and also for sending a second password generated from a combination of the second encrypted token and the second PIN; and

receiving from the web server via the communication network the first user profile associated with the first password and the second user profile associated with the second password.

2. The device according to claim 1, wherein the user interface comprises a touch screen.

3. The device according to claim 1, wherein the user interface comprises a graphical user interface and an input device selected from a group consisting of a pop-up keyboard and a mouse.

4. The device according to claim 1, wherein the user interface is downloaded over the communication network as an application program appearing as an icon on the display of the device, wherein the first PIN and the second PIN are entered into fields of a screen displayed upon execution of the application program.

5. The device according to claim 1, wherein the communication network is a public telecommunications network or the Internet.

6. The device according to claim 1 is selected from a group consisting of a hand-held digital assistant, a smart phone, and a network client device.

7. The device according to claim 1, further comprising a decryption unit within the hardware processor to receive the first encrypted token and the second encrypted token that are fetched from the second memory, wherein the decryption unit is configured for decrypting the first encrypted token and the second encrypted token using the first PIN and the second PIN, respectively, before sending the decrypted forms of the first token and the second token to the communication unit as the first password and the second password.

8. The device according to claim 1, further comprising a timer that disables the first password and the second password after a timeout.

9. The device according to claim 1, wherein the first user profile and the second user profile comprise financial account information of two different users.

10. The device according to claim 1, wherein the first user profile and the second user profile comprise two different financial accounts of a single user.

11. The device according to claim 1, wherein the first PIN and the second PIN are not persistently maintained within the second memory.