Enhancing transaction authentication with privacy and security enhanced internet geolocation and proximity

• US 10,581,834 B2
• Filed: 02/01/2017
• Issued: 03/03/2020
• Est. Priority Date: 11/02/2009
• Status: Active Grant

• Current Assignee: Payfone Incorporated
• Original Assignee: Early Warning Services, LLC
• Inventors: Ganesan, Ravi
• Primary Examiner(s): Fiorillo, James N
• Application Number:
  US15/422,137
• Publication Number:
  US 20170149769A1
• Time in Patent Office: 1,126 Days
• Field of Search: 709208, 709223, 709245, 709228, 726 5, 726 6, 726 7, 726 9, 726 28, 705 44
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

Transaction authentication with techniques and geolocation are combined to provide privacy and security enhanced geolocation. In an example implementation, a user initiates a transaction at a web service which in turns triggers a security server. The security server uses its always on connection with the combined client on user security device to perform geolocation, proximity and transaction authentication. These results may be used by the web service to make a decision on whether to proceed with the transaction.

Claims

1. A method, comprising:

receiving from a web server a request for a transaction initiated at a user device;

transmitting to the user device a one-time password derived from

     1) a secret shared with the web server and not shared with the user device, and

     2) details of the transaction

receiving from one or more slave servers one or more messages originating from the user device and passing respectively through the one or more slave servers, wherein the content of the one or more messages includes or is derived from the one-time password, each of the messages indicating a time of travel of the respective message from the user device to the respective one of the slave servers; and

based on the one or more times of travel indicated in the one or more messages, estimating a location of the user device.

2. The method of claim 1, wherein all of the steps are performed by a single master server.

3. The method of claim 1, wherein estimating the location of the user device comprises estimating an absolute geographic location of the user device.

4. The method of claim 1, wherein estimating the location of the user device comprises estimating a relative location of the user device, in relation to at least one of the slave servers.

5. The method of claim 1, wherein the one-time password is derived in part from one or more transaction details selected from the group of transaction details consisting of a type of the transaction and an amount of the transaction.

6. A method, comprising:

receiving from a web server a request for a transaction initiated at a first user device;

transmitting to a second user device a one-time password derived from

     1) a secret shared with the web server and not shared with the second user device, and

     2) details of the transaction;

receiving from one or more slave servers a first set of one or more messages originating from the first user device and passing respectively through the one or more slave servers, wherein the content of the one or more messages includes or is derived from the one-time password, each of the messages indicating a time of travel of the respective message from the first user device to the respective one of the slave servers; and

based on the one or more times of travel indicated in the first set of one or more messages, estimating a location of the first user device.

7. The method of claim 6, wherein the set of one or more messages is a first set of one or more messages, the method further comprising:

receiving from the one or more slave servers a second set of one or more messages originating from the second user device and passing respectively through the one or more slave servers, each of the messages indicating a time of travel of the respective message from the second user device to the respective one of the slave servers; and

based on the times indicated in the first and second sets of one or more messages, estimating the geographic proximity of the first and second user devices.

8. The method of claim 7, wherein all of the steps are performed by a single master server.

9. The method of claim 7, wherein the first and second user devices are reciprocal slaves.

10. The method of claim 7, wherein the content of the one or more messages in the second set includes or is derived from the one-time password.

11. The method of claim 6, wherein all of the steps are performed by a single master server.

12. The method of claim 6, wherein estimating the location of the user device comprises estimating an absolute geographic location of the user device.

13. The method of claim 6, wherein estimating the location of the user device comprises estimating a relative location of the user device, in relation to at least one of the slave servers.

14. A computerized system, comprising:

a processor; and

memory, the memory holding instructions that, when executed by the processor, cause the system to;

receive from a web server a request for a transaction initiated at a user device;

transmit to the user device or to a second user device a one-time password derived from

     1) a secret shared with the web server and not shared with the second user device, and

     2) details of the transaction;

receive from one or more slave servers one or more messages originating from the user device and passing respectively through the one or more slave servers, wherein the content of the one or more messages includes or is derived from the one-time password, each of the messages indicating a time of travel of the respective message from the user device to the respective one of the slave servers; and

based on the one or more times of travel indicated in the one or more messages, estimate a location of the user device.

15. The system of claim 14, wherein the instructions, when executed by the processor, cause the system to send the one-time password to the second user device.

16. The system of claim 15, wherein the set of one or more messages is a first set of one or more messages, and wherein the instructions, when executed by the processor, cause the system to:

receive from the one or more slave servers a second set of one or more messages originating from the second user device and passing respectively through the one or more slave servers, each of the messages indicating a time of travel of the respective message from the second user device to the respective one of the slave servers; and

based on the times indicated in the first and second sets of one or more messages, estimate the geographic proximity of the first and second user devices.

17. The system of claim 16, wherein the first and second user devices are reciprocal slaves.

18. The system of claim 14, wherein the instructions, when executed by the processor, cause the system to estimate an absolute geographic location of the user device.