Adaptive policies and protections for securing financial transaction data at rest

• US 9,847,995 B2
• Filed: 11/05/2015
• Issued: 12/19/2017
• Est. Priority Date: 06/22/2010
• Status: Active Grant

• Current Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Original Assignee: American Express Travel Related Services Company, Inc. (American Express Company)
• Inventors: Bailey, Jr., Samuel A.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Getachew, Abiy
• Application Number:
  US14/933,165
• Publication Number:
  US 20160057129A1
• Time in Patent Office: 775 Days
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06Q 20/322 Aspects of commerce using mobile devices [M-devices]
• CPC Class Codes: G06Q 20/325 using wireless networks
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G09C 1/04 with sign carriers or indicators moved relative to one another to positions determined by a permutation code, or key, so as to indicate the appropriate corresponding clear or ciphered text
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A system, method, and computer-readable medium for challenge-response authentication are provided. A plurality of codes is received over a communication network based on input provided by way of a user interface displaying a plurality of images. An alphanumeric string is generated based on the received plurality of codes and based on a table that associates each one of the plurality of codes with a respective one of the plurality of images and with a respective one of a plurality of alphanumeric characters. A determination is made as to whether to grant authorization based on whether the generated alphanumeric string matches an alphanumeric user identifier stored in a memory device in association with a user.

Claims

1. A method for challenge-response authentication, the method comprising:

receiving, by a terminal over a communication network, a plurality of codes and a first arrangement of a plurality of images, each one of the plurality of codes (i) corresponding to one of the plurality of images and (ii) corresponding to an alphanumeric character of a plurality of alphanumeric characters, the plurality of codes being distinct from the plurality of alphanumeric characters;

displaying the first arrangement of the plurality of images on a user interface of the terminal;

receiving an input through the user interface associated with the plurality of images the input comprising rearranging locations of the plurality of images on the user interface;

ordering the plurality of codes in a sequence based on the input received through the user interface; and

transmitting, by the terminal over the communication network, the sequence of the plurality of codes, wherein transmitting, by the terminal over the communication network, a request for a service to a service network; and

receiving, by the terminal over the communication network, access to the service on the service network when an alphanumeric string matches a user identifier, the alphanumeric string being generated from the plurality of alphanumeric characters based on the sequence of the corresponding the plurality of codes.

2. The method of claim 1, wherein the first arrangement of the plurality of images displayed on the user interface is any one or a combination of:

a multidimensional grid of the plurality of images, a horizontal arrangement of the plurality of images, or a spatial overlay of the plurality of images.

3. The method of claim 1, further comprising generating a second arrangement of the plurality of images based on the input received through the user interface, wherein the ordering step includes sequencing the plurality of codes based on the second arrangement of the plurality of images.

4. The method of claim 3, wherein:

the second arraignment includes at least two images of the plurality of images arranged in an order, and

the codes are ordered in the sequence in which the corresponding image is arranged in the second arrangement.

5. The method of claim 1, wherein:

the input received through the user interface includes the selection of at least two images of the plurality of images in an order, and

the sequence of the plurality of codes is based on the order in which the corresponding image was selected.

6. The method of claim 1, further comprising encrypting the sequence of codes transmitted over the communication network.

7. A system for challenge-response authentication, the system comprising:

a memory;

a user interface; and

a processor, coupled to the memory and the user interface, configured to;

receive, over a communication network, a plurality of codes and a first arrangement of a plurality of images, each one of the plurality of codes (i) corresponding to one of the plurality of images and (ii) corresponding to an alphanumeric character of a plurality of alphanumeric characters, the plurality of codes being distinct from the plurality of alphanumeric characters;

display the first arrangement of the plurality of images on the user interface;

receive an input through the user interface associated with the plurality of images, the input comprising rearranging locations of the plurality of images on the user interface;

order the plurality of codes in a sequence based on the input received through the user interface; and

transmit, over the communication network, the sequence of the plurality of codes, wherein transmitting, by the terminal over the communication network, a request for a service to a service network; and

receiving, by the terminal over the communication network, access to the service on the service network when an alphanumeric string matches a user identifier, the alphanumeric string being generated from the plurality of alphanumeric characters based on the sequence of the corresponding the plurality of codes.

8. The system of claim 7, wherein the first arrangement of the plurality of images displayed on the user interface is any one or a combination of:

a multidimensional grid of the plurality of images, a horizontal arrangement of the plurality of images, or a spatial overlay of the plurality of images.

9. The system of claim 7, wherein the processor is further configured to:

generate a second arrangement of the plurality of images based on the input received through the user interface, and

sequence the plurality of codes based on the second arrangement of the plurality of images.

10. The system of claim 9, wherein:

the second arraignment includes at least two images of the plurality of images arranged in an order, and

the codes are ordered in the sequence in which the corresponding image is arranged in the second arrangement.

11. The system of claim 7, wherein:

the input received through the user interface includes the selection of at least two images of the plurality of images in an order, and

the sequence of the plurality of codes is based on the order in which the corresponding image was selected.

12. The system of claim 7, wherein the processor is further configured to:

transmit, over the communication network, a request for a service to a service network; and

receive, over the communication network, access to the service on the service network when an alphanumeric string matches a user identifier, the alphanumeric string being generated from the plurality of alphanumeric characters based on the sequence of the corresponding the plurality of codes.

13. The system of claim 7, wherein the processor is further configured to encrypt the sequence of codes transmitted over the communication network.

14. A non-transitory computer-readable medium having stored thereon sequences of instructions, the sequences of instructions including instructions, which, when executed by a computer system, cause the computer system to:

receive, over a communication network, a plurality of codes and a first arrangement of a plurality of images, each one of the plurality of codes (i) corresponding to one of the plurality of images and (ii) corresponding to an alphanumeric character of a plurality of alphanumeric characters, the plurality of codes being distinct from the plurality of alphanumeric characters;

display the first arrangement of the plurality of images on a user interface;

receive an input through the user interface based on the plurality of images, the input comprising rearranging locations of the plurality of images on the user interface;

order the plurality of codes in a sequence associated with the input received through the user interface; and

transmit, over the communication network, the sequence of the plurality of codes, wherein transmitting, by the terminal over the communication network, a request for a service to a service network; and

receiving, by the terminal over the communication network, access to the service on the service network when an alphanumeric string matches a user identifier, the alphanumeric string being generated from the plurality of alphanumeric characters based on the sequence of the corresponding the plurality of codes.

15. The non-transitory computer readable medium of claim 14, wherein the first arrangement of the plurality of images displayed on the user interface is any one or a combination of:

a multidimensional grid of the plurality of images, a horizontal arrangement of the plurality of images, or a spatial overlay of the plurality of images.

16. The non-transitory computer readable medium of claim 14, the sequences of instructions including instructions, which, when executed by a computer system, further cause the computer system to:

generate a second arrangement of the plurality of images based on the input received through the user interface, and

sequence the plurality of codes based on the second arrangement of the plurality of images.

17. The non-transitory computer readable medium of claim 16, wherein:

the second arraignment includes at least two images of the plurality of images arranged in an order, and

the codes are ordered in the sequence in which the corresponding image is arranged in the second arrangement.

18. The non-transitory computer readable medium of claim 14, wherein:

the input received through the user interface includes the selection of at least two images of the plurality of images in an order, and

the sequence of the plurality of codes is based on the order in which the corresponding image was selected.

19. The non-transitory computer readable medium of claim 14, the sequences of instructions including instructions, which, when executed by a computer system, further cause the computer system to:

transmit, over the communication network, a request for a service to a service network; and

receive, over the communication network, access to the service on the service network when an alphanumeric string matches a user identifier, the alphanumeric string being generated from the plurality of alphanumeric characters based on the sequence of the corresponding the plurality of codes.

20. The non-transitory computer readable medium of claim 14, the sequences of instructions including instructions, which, when executed by a computer system, further cause the computer system to encrypt the sequence of codes transmitted over the communication network.