Systems and methods for authenticating a user of a computer application, network, or device using a wireless device

• US 9,456,348 B2
• Filed: 09/28/2015
• Issued: 09/27/2016
• Est. Priority Date: 03/16/2007
• Status: Active Grant

• Current Assignee: Visa International Service Association (Visa, Inc.)
• Original Assignee: Visa International Service Association (Visa, Inc.)
• Inventors: Dennis, Charles L, Snyder, Randall A., Boyle, Patrick J
• Primary Examiner(s): THIAW, CATHERINE B
• Application Number:
  US14/867,382
• Publication Number:
  US 20160021537A1
• Time in Patent Office: 365 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A method and system for authenticating a user includes providing an invocation element capable of being activated by a single user action, receiving an indication that the invocation element has been activated, obtaining a location of a wireless device associated with the user, determining whether the wireless device is associated with an authorized user, approving the user to use the application based on a predetermined location criterion, and producing an indication that the user has been authenticated.

Claims

1. A method for authenticating a previously registered user of an application requiring secure access to the application using a mobile access point, a computerized authentication system, and a wireless device associated with the user, the method comprising:

providing an invocation element on one or more of the wireless device or the mobile access point, the invocation element capable of being activated by a single user action;

receiving an indication at the computerized authentication system that the invocation element has been activated;

obtaining a location of the wireless device;

determining whether the wireless device is associated with an authorized user based on a previously registered association between a wireless device identifier associated with the wireless device and an application identifier associated with the application using the computerized authentication system;

approving the user to use the application using the computerized authentication system based on a predetermined location criterion related to one or more of the obtained wireless device location or a location of the mobile access point, when the wireless device is associated with an authorized user; and

producing an indication on one or more of the mobile access point or the wireless device that the user has been authenticated when the user was approved using the computerized authentication system.

2. The method of claim 1, further comprising:

storing user identity data that includes a mobile directory number associated with the wireless device; and

enabling single-action authentication for the application,

wherein storing the user identity data and enabling single-action authentication are performed before providing the invocation element.

3. The method of claim 2, wherein the mobile directory number is the wireless device identifier.

4. The method of claim 1, wherein providing the invocation element includes presenting an electronic form that includes the invocation element.

5. The method of claim 4, wherein during a first presentation to the user, the electronic form includes a mobile directory number field and the method further includes entering a mobile directory number associated with the wireless device in the mobile directory number field before activating the invocation element.

6. The method of claim 5, wherein during the first presentation to the user, the electronic form also includes an additional field, and wherein the additional field must be populated by the user the first time the electronic form is presented to the user before the invocation element can be activated.

7. The method of claim 6, wherein the additional field is a password field.

8. The method of claim 6, wherein during a subsequent presentation to the user, the invocation element is capable of being activated without entry of information in the electronic form.

9. The method of claim 1, wherein the invocation element includes an authentication button presented on a display associated with the mobile access point and wherein the single user action includes selecting the authentication button with a user interface device associated with the mobile access point.

10. The method of claim 1, wherein the invocation element includes a button displayed on the wireless device and wherein the single user action includes selecting the button with the wireless device.

11. The method of claim 1, wherein the application is in data communication with the mobile access point over a network.

12. The method of claim 1, wherein providing the invocation element is implemented by remotely providing an electronic form to the user from the application to the mobile access point over a network.

13. The method of claim 1, wherein the step of providing the invocation element includes locally providing the invocation element on a display associated with the mobile access point from the application, wherein the mobile access point is a computer locally running the application.

14. A computerized authentication system for authenticating a previously registered user of an application requiring secure access to the application using a mobile access point and a wireless device associated with the user, the computerized authentication system comprising:

invocation element means for providing an invocation element capable of being activated by a single user action on one or more of the wireless device or the mobile access point;

indicator receiving means for receiving an indication at the authentication system that the invocation element has been activated;

location obtaining means for obtaining a location of the wireless device;

association means for determining whether the wireless device is associated with an authorized user based on a previously registered association between a wireless device identifier associated with the wireless device and an application identifier associated with the application;

approving means for approving the user to use the application based on a predetermined location criterion related to one or more of the obtained wireless device location or a location of the mobile access point, when the wireless device is associated with an authorized user; and

indication means for producing an indication on one or more of the mobile access point or the wireless device that the user has been authenticated when the user was approved.

15. The computerized authentication system of claim 14, further comprising:

storage means for storing user identity data that includes a mobile directory number associated with the wireless device; and

single-action enabling means for enabling single-action authentication for the application,

wherein the invocation element means is configured to provide the invocation element based on the enabled single-action authentication for the application, and wherein the association means is configured to determine whether the wireless device is associated with an authorized user based on the stored user identity data.

16. The computerized authentication system of claim 15, wherein the mobile directory number is the wireless device identifier.

17. The computerized authentication system of claim 14, wherein the invocation element means is configured to present an electronic form that includes the invocation element.

18. The computerized authentication system of claim 17, wherein during a first presentation to the user, the electronic form also includes a mobile directory number field, and wherein the system further includes mobile directory number receiving means for receiving a mobile directory number entered in the mobile directory number field wherein the association means is configured to determine whether the wireless device is associated with an authorized user based on the received mobile directory number.

19. The computerized authentication system of claim 18, wherein during the first presentation to the user, the electronic form also includes an additional field, and wherein the additional field must be populated by the user the first time the electronic form is presented to the user before the invocation element can be activated.

20. A system for authenticating a previously registered user of an application requiring secure access to the application using a mobile access point in data communication with the application and a wireless device associated with the user, the system comprising:

a memory; and

a processor in data communication with the memory, the mobile access poiand the wireless device, wherein the processor is configured to;

provide an invocation element capable of being activated by a single user action on one or more of the wireless device or the mobile access point;

receive an indication that the invocation element has been activated;

obtain a location of the wireless device;

determine whether the wireless device is associated with an authorized user based on a previously registered association between a wireless device identifier associated with the wireless device and an application identifier associated with the application;

approve the user to use the application based on a predetermined location criterion related to one or more of the obtained wireless device location or a location of the mobile access point, when the wireless device is associated with an authorized user; and

produce an indication on one or more of the mobile access point or the wireless device that the user has been authenticated when the user was approved.