Efficient prevention of fraud

• US 9,569,778 B2
• Filed: 05/03/2016
• Issued: 02/14/2017
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: EyeLock LLC (VOXX International Corporation)
• Original Assignee: EyeLock LLC (VOXX International Corporation)
• Inventors: Hanna, Keith J.
• Primary Examiner(s): POTRATZ, DANIEL B
• Application Number:
  US15/145,625
• Publication Number:
  US 20160247160A1
• Time in Patent Office: 287 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 18/24 Classification techniques
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/4015 using location information
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06V 40/12 Fingerprints or palmprints
• CPC Class Codes: G06V 40/1347 Preprocessing; Feature extraction
• CPC Class Codes: G06V 40/45 Detection of the body part being alive
• CPC Class Codes: G06V 40/67 by interactive indications to the user
• CPC Class Codes: G06V 40/70 Multimodal biometrics, e.g. combining information from different biometric modalities
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04N 19/426 using memory downsizing methods
• CPC Class Codes: H04N 19/65 using error resilience

Abstract

This disclosure is directed to methods and systems for managing difficulty of use and security for a transaction. A transaction manager operating on a computing device may determining a range of possible steps for a transaction comprising security measures available for the transaction. The transaction manager may identify a threshold for a security metric to be exceeded for authorizing the transaction, the security metric to be determined based on performance of steps selected for the transaction. The transaction manager may select for the transaction at least one step from the range of possible steps, based on optimizing between (i) a difficulty of use quotient of the transaction from subjecting a user to the at least one step, and (ii) the security metric relative to the determined threshold.

Claims

1. A method of managing difficulty-of-use and security for a transaction with a user, the method comprising:

determining, by a transaction manager operating on a computing device in use for the transaction with the user and in communication with one or more devices providing different security measures available for securing the transaction, a range of possible steps for the transaction corresponding to the security measures available for the transaction, wherein at least one of the one or more devices is enabled to acquire a biometric of the user as a security measure;

identifying a threshold for a security metric to be exceeded for authorizing the transaction, wherein the security metric is to be determined based on successful performance of a combination of steps selected for the transaction;

identifying, by the transaction manager, a plurality of combinations of steps from the range of possible steps for the transaction, that would each yield a corresponding security metric that exceeds the identified threshold if the performance of the corresponding combination of steps is successfully completed;

calculating a corresponding difficult-of-use for completing each of the identified combinations of steps that would yield the corresponding security metric that exceeds the identified threshold if the performance of the corresponding combination of steps is successfully completed;

selecting, for completion by the user in the transaction by using the one or more devices, a first combination of steps from the identified combinations of steps, that has a least calculated difficulty-of-use among those calculated for the identified combinations of steps, the selecting including a preference for inclusion of a step for liveness detection or biometric deterrence if available; and

allowing the transaction to complete if the user successfully completes the first combination of steps.

2. The method of claim 1, wherein each of the steps from the identified combinations of steps is assigned a score for difficulty-of-use based on at least one of:

an amount of action expected from the user, an amount of attention expected from the user, and an amount of time expected of the user, in performing the respective step.

3. The method of claim 1, comprising modifying remaining steps of the transaction, the modification responsive to a failure to satisfy a requirement of at least one step of the selected first combination of steps.

4. The method of claim 1, comprising identifying the threshold for the security metric based on at least one of:

a value of the transaction, risk associated with a person involved in the transaction, risk associated with a place or time of the transaction, risk associated with a type of the transaction, or security measures available for the transaction.

5. The method of claim 1, wherein selecting the first combination of steps comprises selecting, from the identified combinations of steps, the first combination of steps that has the least calculated difficulty-of-use as a first priority, and that yields a security metric that exceeds the identified threshold by a most amount as a second priority.

6. The method of claim 1, comprising updating the security metric responsive to at least one of:

a failure to satisfy a requirement of at least one selected step, or a modification in remaining steps of the transaction.

7. The method of claim 1, comprising acquiring biometric data as part of the selected first combination of steps, the biometric data comprising at least one of:

iris, face, voice, palm print, palm vein, or fingerprint.

8. The method of claim 1, comprising acquiring biometric data as part of the selected first combination of steps, the biometric data for at least one of liveness detection and biometric matching.

9. The method of claim 1, comprising acquiring biometric data as a prerequisite of at least one step of the selected first combination of steps.

10. The method of claim 1, comprising performing biometric matching as a prerequisite of at least one step of the selected first combination of steps.

11. The method of claim 1, comprising at least requiring a step for acquiring a first type of biometric data, in the event of a failure to satisfy a requirement of the selected first combination of steps.

12. The method of claim 1, comprising at least requiring a step for acquiring a second type of biometric data if a first type of biometric data is unavailable, of insufficient quality, or fails a liveness detection or biometric matching.

13. The method of claim 1, comprising performing liveness detection as part of the selected first combination of steps.

14. The method of claim 1, comprising performing liveness detection as a prerequisite of at least one step of the selected first combination of steps.

15. The method of claim 1, comprising at least requiring a step for performing liveness detection, in the event of a failure to satisfy a requirement of the selected first combination of steps.

16. The method of claim 1, comprising performing a deterrence activity as part of the selected first combination of steps.

17. The method of claim 1, comprising performing a deterrence activity as a prerequisite of at least one step of the selected first combination of steps.

18. The method of claim 1, comprising at least requiring a deterrence activity, in the event of a failure to satisfy a requirement of the selected first combination of steps.

19. A system for managing difficulty-of-use and security for a transaction with a user, the system comprising:

circuitry configured to implement a transaction manager operating on a computing device in use for the transaction with the user, the circuitry in communication with one or more devices providing different security measures available for securing the transaction, the circuitry further configured for;

determining, by the transaction manager, a range of possible steps for the transaction corresponding to the security measures available for the transaction, wherein at least one of the one or more devices is enabled to acquire a biometric of the user as a security measure;

identifying a threshold for a security metric to be exceeded for authorizing the transaction, wherein the security metric is to be determined based on successful performance of a combination of steps selected for the transaction;

identifying, by the transaction manager, a plurality of combinations of steps from the range of possible of steps for the transaction, that would each yield a corresponding security metric that exceeds the identified threshold if the performance of the corresponding combination of steps is successfully completed;

calculating a corresponding difficulty-of-use for completing each of the identified combinations of steps that would yield the corresponding security metric that exceeds the identified threshold if the performance of the corresponding combination of steps is successfully completed;

selecting, for completion by the user in the transaction by using the one or more devices, a first combination of steps from the identified combinations of steps, that has a least calculated difficulty-of-use among those calculated for the identified combinations of steps, the selecting including a preference for inclusion of a step for liveness detection or biometric deterrence if available; and

allowing the transaction to complete if the user successfully completes the first combination of steps.

20. The system of claim 19, wherein each of the steps from the identified combinations of steps is assigned a score for difficulty-of-use based on at least one of:

an amount of action expected from the user, an amount of attention expected from the user, and an amount of time expected of the user, in performing the respective step.