Secure identity authentication in an electronic transaction

• US 9,715,686 B2
• Filed: 01/12/2017
• Issued: 07/25/2017
• Est. Priority Date: 01/15/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Sadacharam, Saravanan, Viswanathan, Ram
• Primary Examiner(s): SHAW, BRIAN F
• Application Number:
  US15/404,792
• Publication Number:
  US 20170124553A1
• Time in Patent Office: 194 Days
• Field of Search: 726 5
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06Q 20/3223 Realising banking transactions through M-devices
• CPC Class Codes: G06Q 20/3276 using a pictured code, e.g. barcode or QR-code, being read by the M-device
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/405 Establishing or using transaction specific rules
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04W 12/06 Authentication

Abstract

An approach is provided for securely authenticating an identity of a user participating in an electronic transaction. A request for a biometric identifier/security question is converted to a first Quick Response (QR) code. Based on user attributes and a request from the user'"'"'s mobile device to a computer to initiate the transaction, the first QR code is disassembled into first and second portions. The first portion, but not the second portion, is sent to the mobile device. Responsive to the mobile device reassembling the first QR code, receiving and converting the biometric identifier/answer to the security question to a second QR code, disassembling the second QR code into first and second portions, and transmitting the first portion of the second QR code to the computer, the second QR code is reassembled. The transaction is authorized based on whether the biometric identifier/answer matches a data repository record.

Claims

1. A computer system comprising:

a central processing unit (CPU);

a memory coupled to the CPU; and

a computer-readable storage device coupled to the CPU, the storage device containing instructions that are executed by the CPU via the memory to implement a method of securely authenticating an identity of a user participating in an electronic transaction with an enterprise, the method comprising the steps of;

the computer system converting (1) a request for a biometric identifier or (2) a security question to a first complete Quick Response (QR) code, the request for the biometric identifier or the security question being selected to authenticate the identity of the user;

based on information that specifies attributes of (1) the user and (2) a request from a mobile device of the user to initiate the electronic transaction, the computer system disassembling the first complete QR code into first and second portions of the first complete QR code, the first portion of the first complete QR code selected by a QR code disassembly algorithm, and the first and second portions of the first complete QR code not having an element in common;

the computer system sending to the mobile device the first portion of the first complete QR code, but not the second portion of the first complete QR code, which prevents an entity other than the user and the enterprise from obtaining the request for the biometric identifier or the security question by intercepting or capturing network traffic that includes the electronic transaction;

in response to a scan of the first portion of the first complete QR code by the mobile device, a reassembly of the first complete QR code by the mobile device which employs the first portion of the first complete QR code and a QR code assembly algorithm, a display by the mobile device of the request for the biometric identifier or the security question, a receipt by the mobile device of the biometric identifier or an answer to the security question, a conversion of the biometric identifier or the answer to the security question to a second complete QR code, a disassembly of the second complete QR code into first and second portions of the second complete QR code by employing the QR code disassembly algorithm, and a transmission of the first portion of the second complete QR code from the mobile device to the computer system, the computer system reassembling the second complete QR code by employing the QR code assembly algorithm and the first portion of the second complete QR code, which prevents the entity other than the user and the enterprise from obtaining the biometric identifier or the answer to the security question by intercepting or capturing the network traffic that includes the electronic transaction;

the computer system determining whether the biometric identifier or the answer to the security question converted to the second complete QR code matches a record in a data repository that includes biometric identifiers or answers to security questions; and

if the biometric identifier or the answer to the security question converted to the second complete QR code matches the record in the data repository, the computer system authorizing the electronic transaction or if the biometric identifier or the answer to the security question converted to the second complete QR code does not match any record in the data repository, the computer system indicating the electronic transaction is not authorized.

2. The computer system of claim 1, wherein the reassembly of the first complete QR code by the mobile device is performed in response to:

the mobile device generating a plurality of initial potential QR codes of a plurality of requests for biometric identifiers or a plurality of security questions;

the mobile device deleting portions of the respective initial potential QR codes by employing the QR code disassembly algorithm and the information that specifies the attributes of the user and the request, each of the deleted portions matching a shape of the first portion of the first complete QR code;

the mobile device generating new potential QR codes by filling in the deleted portions with the first portion of the first complete QR code;

the mobile device determining that one of the new potential QR codes matches one of the initial potential QR codes in the plurality of initial potential QR codes; and

based on the one new potential QR code matching one of the initial potential QR codes, the mobile device determining the one new potential QR code is the reassembly of the first complete QR code.

3. The computer system of claim 1, wherein the step of reassembling the second complete QR code by employing the QR code assembly algorithm and the first portion of the second complete QR code includes:

the computer system generating a plurality of initial potential QR codes of a plurality of biometric identifiers or a plurality of answers to the security questions;

the computer system deleting portions of the respective initial potential QR codes by employing the QR code disassembly algorithm and information that specifies the attributes of the user and the transmission of the first portion of the second complete QR code, each of the deleted portions matching a shape of the first portion of the second complete QR code;

the computer system generating new potential QR codes by filling in the deleted portions with the first portion of the second complete QR code;

the computer system determining that one of the new potential QR codes matches one of the initial potential QR codes in the plurality of initial potential QR codes; and

based on the one new potential QR code matching one of the initial potential QR codes, the mobile device determining the one new potential QR code is a reassembly of the second complete QR code.

4. The computer system of claim 1, wherein the method further comprises the steps of:

the computer system completing a handshake with the mobile device; and

the computer system recording a timestamp of the handshake, wherein the information that specifies the attributes of the request to initiate the electronic transaction includes the timestamp, and wherein the step of disassembling the first complete QR code into the first and second portions of the first complete QR code includes selecting the first portion of the first complete QR code based at least in part on the recorded timestamp.

5. The computer system of claim 1, wherein the method further comprises:

prior to any transaction between the user and the enterprise, the computer system storing a plurality of security questions, receiving from the user and storing a plurality of biometric identifiers of the user or a plurality of answers to the security questions, and generating and storing a plurality of requests for the biometric identifiers;

subsequent to a receipt of the request to initiate the electronic transaction, the computer system determining the electronic transaction is a banking transaction for an amount of money that exceeds a threshold amount; and

based on the banking transaction being for an amount of money exceeding the threshold amount, the computer system utilizing a random number generator which randomly selects the request for the biometric identifier from the plurality of requests for the biometric identifiers or the security question from the plurality of security questions.

6. A mobile device comprising:

a central processing unit (CPU);

a memory coupled to the CPU; and

a computer-readable storage device coupled to the CPU, the storage device containing instructions that are executed by the CPU via the memory to implement a method of securely authenticating an identity of a user participating in an electronic transaction with an enterprise, the method comprising the steps of;

in response to a selection of a request for a biometric identifier or a security question to authenticate the identity of the user, a conversion of the selected request for the biometric identifier or the security question to a first complete Quick Response (QR) code, a disassembly of the first complete QR code into first and second portions of the first complete QR code by a QR code disassembly algorithm based on information that specifies attributes of (1) the user and (2) a request to a server computer of the enterprise to initiate the electronic transaction, the first and second portions of the first complete QR code not having an element in common, the mobile device receiving from the server computer the first portion of the first complete QR code, but not the second portion of the first complete QR code, which prevents an entity other than the user and the enterprise from obtaining the request for the biometric identifier or the security question by intercepting or capturing network traffic that includes the electronic transaction;

the mobile device scanning the first portion of the first complete QR code;

the mobile device reassembling the first complete QR code by employing a QR code assembly algorithm based on the first portion of the first complete QR code and the information that specifies the attributes of the user and the request to initiate the electronic transaction;

based on the reassembled first complete QR code, the mobile device displaying the request for the biometric identifier or the security question;

the mobile device receiving from the user the biometric identifier or an answer to the security question;

the mobile device converting the biometric identifier or the answer to the security question to a second complete QR code;

the mobile device disassembling the second complete QR code into first and second portions of the second complete QR code by employing the QR code disassembly algorithm based on the information that specifies the attributes of the user and information that specifies attributes of a request to complete an authentication of the identity of the user;

the mobile device sending the first portion of the second complete QR code to the server computer; and

in response to a reassembly by the server computer of the second complete QR code by employing the QR code assembly algorithm based on the first portion of the second complete QR code, the information that specifies the attributes of the user, and the information that specifies the attributes of the request to complete the authentication, which prevents the entity other than the user and the enterprise from obtaining the biometric identifier or the answer to the security question by intercepting or capturing the network traffic that includes the electronic transaction, and a determination of whether the biometric identifier or the answer to the security question matches a record in a data repository that includes biometric identifiers or answers to security questions, the mobile device receiving an indication that the electronic transaction is authorized if the biometric identifier or the answer to the security question matches the record in the data repository or the mobile device receiving an indication that the electronic transaction is not authorized if the biometric identifier or the answer to the security question does not match any record in the data repository.

7. The mobile device of claim 6, wherein the step of reassembling the first complete QR code is performed in response to:

the mobile device generating a plurality of initial potential QR codes of a plurality of requests for biometric identifiers or a plurality of security questions;

the mobile device deleting portions of the respective initial potential QR codes by employing the QR code disassembly algorithm and the information that specifies the attributes of the user and the request for the biometric identifier or the security question, each of the deleted portions matching a shape of the first portion of the first complete QR code;

the mobile device generating new potential QR codes by filling in the deleted portions with the first portion of the first complete QR code;

the mobile device determining that one of the new potential QR codes matches one of the initial potential QR codes in the plurality of initial potential QR codes; and

based on the one new potential QR code matching one of the initial potential QR codes, the mobile device determining the one new potential QR code is the reassembly of the first complete QR code.

8. The mobile device of claim 6, wherein the method further comprises the steps of:

the mobile device completing a handshake with the server computer; and

the mobile device recording a timestamp of the handshake, wherein the information that specifies the attributes of the request to initiate the electronic transaction includes the timestamp, and

wherein the step of reassembling the first complete QR code by employing the QR code assembly algorithm based on the first portion of the first complete QR code and the information that specifies the attributes of the user and the request to initiate the electronic transaction includes selecting the first portion of the first complete QR code based at least in part on the recorded timestamp.

9. A computer program product, comprising:

a computer-readable storage medium; and

a computer-readable program code stored in the computer-readable storage medium, the computer-readable program code containing instructions that are executed by a central processing unit (CPU) of a computer system to implement a method of securely authenticating an identity of a user participating in an electronic transaction with an enterprise, the method comprising the steps of;

in response to a selection of a request for a biometric identifier or a security question to authenticate the identity of the user, a conversion of the selected request for the biometric identifier or the security question to a first complete Quick Response (QR) code, a disassembly of the first complete QR code into first and second portions of the first complete QR code by a QR code disassembly algorithm based on information that specifies attributes of (1) the user and (2) a request to a server computer of the enterprise to initiate the electronic transaction, the first and second portions of the first complete QR code not having an element in common, the computer system receiving from the server computer the first portion of the first complete QR code, but not the second portion of the first complete QR code, which prevents an entity other than the user and the enterprise from obtaining the request for the biometric identifier or the security question by intercepting or capturing network traffic that includes the electronic transaction;

the computer system scanning the first portion of the first complete QR code;

the computer system reassembling the first complete QR code by employing a QR code assembly algorithm based on the first portion of the first complete QR code and the information that specifies the attributes of the user and the request to initiate the electronic transaction;

based on the reassembled first complete QR code, the computer system displaying the request for the biometric identifier or the security question;

the computer system receiving from the user the biometric identifier or an answer to the security question;

the computer system converting the biometric identifier or the answer to the security question to a second complete QR code;

the computer system disassembling the second complete QR code into first and second portions of the second complete QR code by employing the QR code disassembly algorithm based on the information that specifies the attributes of the user and information that specifies attributes of a request to complete an authentication of the identity of the user;

the computer system sending the first portion of the second complete QR code to the server computer; and

in response to a reassembly by the server computer of the second complete QR code by employing the QR code assembly algorithm based on the first portion of the second complete QR code, the information that specifies the attributes of the user, and the information that specifies the attributes of the request to complete the authentication, which prevents the entity other than the user and the enterprise from obtaining the biometric identifier or the answer to the security question by intercepting or capturing the network traffic that includes the electronic transaction, and a determination of whether the biometric identifier or the answer to the security question matches a record in a data repository that includes biometric identifiers or answers to security questions, the computer system receiving an indication that the electronic transaction is authorized if the biometric identifier or the answer to the security question matches the record in the data repository or the computer system receiving an indication that the electronic transaction is not authorized if the biometric identifier or the answer to the security question does not match any record in the data repository.

10. The computer program product of claim 9, wherein the step of reassembling the first complete QR code is performed in response to:

the computer system generating a plurality of initial potential QR codes of a plurality of requests for biometric identifiers or a plurality of security questions;

the computer system deleting portions of the respective initial potential QR codes by employing the QR code disassembly algorithm and the information that specifies the attributes of the user and the request for the biometric identifier or the security question, each of the deleted portions matching a shape of the first portion of the first complete QR code;

the computer system generating new potential QR codes by filling in the deleted portions with the first portion of the first complete QR code;

the computer system determining that one of the new potential QR codes matches one of the initial potential QR codes in the plurality of initial potential QR codes; and

based on the one new potential QR code matching one of the initial potential QR codes, the computer system determining the one new potential QR code is the reassembly of the first complete QR code.

11. The computer program product of claim 9, wherein the method further comprises the steps of:

the computer system completing a handshake with the server computer; and

the computer system recording a timestamp of the handshake, wherein the information that specifies the attributes of the request to initiate the electronic transaction includes the timestamp, and

wherein the step of reassembling the first complete QR code by employing the QR code assembly algorithm based on the first portion of the first complete QR code and the information that specifies the attributes of the user and the request to initiate the electronic transaction includes selecting the first portion of the first complete QR code based at least in part on the recorded timestamp.