ON-LINE TRANSACTION AUTHENTICATION SYSTEM AND METHOD

• US 20080229098A1
• Filed: 03/12/2007
• Published: 09/18/2008
• Est. Priority Date: 03/12/2007
• Status: Abandoned Application

• Current Assignee: CIT Global, Inc. (CIT Global)
• Original Assignee: SIPS Inc.
• Inventors: Ishak, Hanney
• Application Number:
  US11/612,875
• Publication Number:
  US 20080229098A1
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards

Abstract

A system and method for authenticating an on-line user by authenticating the computing device being used by the user. The method may comprise reading device information from a computing device, creating a device credential from the device information; and, communicating the device credential to an authenticating body for authentication. The method may additionally comprise receiving personal information from a user; creating a user credential from the personal information and, communicating the user credential along with the device credential to the authenticating body for authentication.

Claims

1. A method for confirming the identity of an on-line user, the method comprising:

reading device information from a computing device;

creating a device credential from the device information; and

,

communicating the device credential to an authenticating body for authentication.

2. The method of claim 1 further comprising:

receiving personal information from a user;

creating a user credential from the personal information and,

communicating the user credential along with the device credential to the authenticating body for authentication.

3. The method of claim 1 wherein an authentication certificate is created from at least the device credential and the device credential is communicated to the authenticating body by communicating the authentication certificate.

4. The method of claim 3 wherein the authentication certificate further comprises a user credential comprised of personal information collected from the user.

5. The method of claim 3 wherein the authentication certificate is first encrypted and then communicated to the authenticating body.

6. A method for authenticating the identity of a user using an on-line computing device, the method comprising:

receiving a device credential from the computing device;

comparing the device credential with stored device information associated with the user; and

,

authenticating the user'"'"'s identity if the device credential matches the stored device information.

7. The method of claim 6 wherein a user credential is received along with the device credential, the user credential identifying the stored device information to be compared.

8. The method of claim 7 wherein the user credential and the device credential are received in the form of an encrypted authentication certificate.

9. The method of claim 6, the method further comprising:

comparing the device credential with a device black-list of device information,

whereby if the device credential matches device information on the device black-list, not authenticating the user.

10. The method of claim 7, the method further comprising:

comparing the device credential with a device black-list of device information;

comparing the user credential with a user black-list of user information;

whereby if either the device credential matches device information on the device black-list, or the user credential matches user information on the user black-list, not authenticating the user.

11. The method of claim 10 wherein if the user is not authenticated, updating the user black-list and the device black-list to include either of the device credential or the user credential that are not on the black-lists.

12. A system for authenticating a user'"'"'s identity in an on-line transaction, the system comprising:

an authenticating body for authenticating on-line transactions;

a computing device for use in conducting on-line transactions, the computing device being programmed to read device information from the computing device and to receive personal information from the user, and to communicate a user credential comprised from the personal information and a device credential comprised from the device information to the authenticating body;

a user database accessible by the authenticating body for storing and retrieving device information associated with the user'"'"'s personal information;

whereby the authenticating body authenticates the transaction by comparing the received user credential with the stored personal information to identify the user and comparing the received device credential with the stored device information associated with the identified user.