Verification and authentication systems and methods

• US 20080086759A1
• Filed: 10/10/2006
• Published: 04/10/2008
• Est. Priority Date: 10/10/2006
• Status: Active Grant

• Current Assignee: Equifax, Inc.
• Original Assignee: Equifax, Inc.
• Inventors: Colson, Christen J.
• Granted Patent: US 8,239,677 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3226 : using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 : involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/40 : Network security protocols

Abstract

Embodiments of the present invention provide verification and/or authentication service engines that provide a customizable solution that can be “dialed” based on the risk level assigned to individual or grouped applications. The systems can also incorporate internal and external sources of data used to verify information provided by the user. It is dynamic and can pull information from a myriad of sources during the verification process, enabling credit reporting agencies (e.g., Equifax and others), FSPs, and other service providers to facilitate real-time approval and access to products and services.

Claims

1. A method of controlling access by a user to vendor information technology systems using a verification/authentication engine, comprising:

(a) receiving an inquiry from a vendor system to verify a particular user for a particular transaction, wherein the vendor has assigned the particular transaction a level of risk;

(b) wherein the vendor has specified an appropriate verification level to meet the assigned level of risk, comprising specifying a plurality of data sources which contain information about the user;

(c) querying the user, using questions generated based on data from at least two of the data sources;

(d) determining the extent to which the user correctly answers the questions; and

(e) determining whether to grant or deny access by the user to the vendor information technology systems based on the extent to which the user correctly answers the questions.

2. The method of claim 1, wherein the vendor has specified a number of questions from the data sources to be presented to the user.

3. The method of claim 1, wherein the vendor has specified a level of difficulty of questions from the data sources to be presented to the user.

4. The method of claim 1, wherein the verification/authentication engine generates a confidence level of the user'"'"'s identity based on the user'"'"'s answers to the questions.

5. The method of claim 4, wherein the verification/authentication engine provides the confidence level and/or a score to the vendor system and wherein the vendor system determines whether to grant or deny access by the user to the vendor information technology systems based at least in part on the confidence level provided.

6. The method of claim 4, wherein the confidence level is a percentage that the user is who the user claims to be.

7. The method of claim 4, wherein the confidence level is advice about whether to grant or deny access.

8. The method of claim 4, wherein the confidence level is a yes/no decision about whether or not to grant the user access.

9. The method of claim 1, wherein the vendor specifies a scoring level to accommodate for errors.

10. The method of claim 9, wherein the scoring level comprises a scoring algorithm.

11. The method of claim 1, wherein verification/authentication engine service pricing depends upon which and how many data sources are searched, whether the search pulls real-time data, whether the data searched is public or from the vendor'"'"'s own data sources, or a combination thereof.

12. The method of claim 1, wherein at least one data source includes credit-related data relevant to the user.

13. The method of claim 1, wherein the data sources comprise one or more of a credit reporting agency;

a small business information service;

demand deposit accounts (DDA) data;

Dunn &

Bradstreet;

credit reporting databases;

mail databases;

driver'"'"'s license databases;

online phone books;

who/where websites;

reunion, high school or college databases;

frequent flier databases;

investment and retirement account information;

insurance carrier information;

medical information;

passport data or other governmental information;

phone company or utility company information;

bill pay sites;

automobile registration sites;

funeral databases;

or databases internal to the vendor.

14. The method of claim 1, wherein security token manufacturers can integrate with the verification/authentication engine to distribute security devices only to users who achieve a certain confidence level.

15. The method of claim 1, wherein a digital certificate is issued to a user upon grant of access to the vendor information technology system.

16. The method of claim 1, where the verification/authentication engine is supporting a verification process.

17. The method of claim 1, where the verification/authentication engine is supporting an authentication process.

18. The method of claim 1, wherein at least one data source relates to an individual who is an officer or employee of a business.

19. The method of claim 1, wherein the user is a small business and wherein the data sources include sources that query data about the small business, as well as sources that query data about owners, principals, or employees of the small business.

20. The method of claim 1, wherein the verification/authentication engine is enabled over multiple channels.

21. The method of claim 20, wherein the multiple channels include one or more of the internet, an intranet, e-mail, instant messaging, phone or voice systems, cell phone, ATM, kiosk, scanner, point of sale terminal, mobile system, blackberry, handheld device, pocket PC, or wireless device.

22. The method of claim 1, wherein the verification/authentication engine can be customized to meet the needs of small, medium, and large vendor systems.

23. The method of claim 1, wherein the vendor'"'"'s specifying the plurality of data sources to be queried is based at least in part on cost of access to the data sources.

24. The method of claim 23, wherein the verification/authentication engine provides the vendor with a series of selections and scoring options relating to risk levels, data sources, prices, and channels.

25. The method of claim 1, wherein, once access is granted, a user can return to the vendor'"'"'s information technology system and request access to additional transactions and only answer questions that are applicable to the assigned level of risk of the additional transaction.

26. The method of claim 1, wherein the verification/authentication engine maintains an audit trail.

27. The method of claim 1, wherein the verification/authentication system is configured to verify and/or authenticate a user in order to provide access to aggregated accounts.

28. The method of claim 1, wherein the system uses a first channel and wherein, if the first channel fails, the system defaults to an alternate manual channel.

29. The method of claim 1, further comprising verifying that a device belongs to a certain individual or business before a pass code is sent.

30. The method of claim 1, wherein the at least two data sources comprise a single co-mingled database that has compiled information from various data sources and compiled the information in one location.

31. A verification/authentication engine adapted to control access by a user to vendor information technology systems, comprising:

(a) a risk-setting option, wherein the vendor specifies an appropriate risk level for verifying and/or authenticating the user; and

(b) a data source-setting option, wherein the vendor specifies at least two data sources to be searched in order to generate verification/authentication questions.

32. The verification/authentication engine of claim 31, further comprising

(c) a question-number setting option, wherein once the at least two data sources to be searched are specified, the vendor specifies the number of questions to be presented to the user from each source.

33. The verification/authentication engine of claim 31, wherein the engine

queries the user, using questions generated based on data from at least two of the data sources specified;

determines the extent to which the user correctly answers the questions; and

determines whether to grant or deny access by the user to the vendor information technology systems based on the extent to which the user correctly answers the questions.

34. The verification/authentication engine of claim 33, wherein the verification/authentication engine generates a confidence level of the user'"'"'s identity based on the user'"'"'s answers to the questions.

35. The verification/authentication engine of claim 34, wherein the verification/authentication engine provides the confidence level and/or a score to the vendor system and wherein the vendor system determines whether to grant or deny access by the user to the vendor information technology systems based at least in part on the confidence level provided.

36. The verification/authentication engine of claim 34, wherein the confidence level is a percentage that the user is who the user claims to be.

37. The verification/authentication engine of claim 34, wherein the confidence level is advice about whether to grant or deny access.

38. The verification/authentication engine of claim 34, wherein the confidence level is a yes/no decision about whether or not to grant the user access.

39. The verification/authentication engine of claim 33, further comprising a recognition option, wherein, once access is granted, a user can return to the vendor'"'"'s information technology system and request access to additional transactions and only answer questions that are applicable to the assigned level of risk of the additional transaction.

40. The verification/authentication engine of claim 31, further comprising a scoring-level option, wherein the vendor specifies a scoring level to accommodate for errors.

41. The verification/authentication engine of claim 40, wherein the scoring level comprises a scoring algorithm.

42. The verification/authentication engine of claim 31, further comprising a price-setting option, wherein the verification/authentication engine service pricing depends upon which and how many data sources are searched.

43. The verification/authentication engine of claim 31, wherein the vendor'"'"'s data source-setting option is based at least in part on cost of access to the data sources.

44. The verification/authentication engine of claim 31, further comprising a security-setting option, wherein the vendor specifies how the engine will interact with security token manufacturers to distribute security devices only to users who achieve a certain confidence level.

45. The verification/authentication engine of claim 31, wherein the verification/authentication engine can be customized to meet the needs of small, medium, and large vendor systems.

46. The verification/authentication engine of claim 31, further comprising an audit-trail option, wherein the verification/authentication engine maintains an audit trail of the data sources searched and questions asked.

47. The verification/authentication engine of claim 31, wherein the verification/authentication system is configured to verify and/or authenticate a user in order to provide access to aggregated accounts.

48. The verification/authentication engine of claim 31, wherein the engine is enabled over multiple channels.

49. The verification/authentication engine of claim 48, wherein the multiple channels comprise one or more of the internet, an intranet, e-mail, instant messaging, phone or voice systems, cell phone, ATM, kiosk, scanner, point of sale terminal, mobile system, blackberry, handheld device, pocket PC, or wireless device.

50. The verification/authentication engine of claim 48, further comprising a manual-option, wherein the engine uses a first channel and wherein, if the first channel fails, the system defaults to an alternate manual channel.