SYSTEM AND METHOD FOR USER CONFIRMATION OF ONLINE TRANSACTIONS

• US 20140289117A1
• Filed: 03/18/2014
• Published: 09/25/2014
• Est. Priority Date: 03/22/2013
• Status: Active Grant

• Current Assignee: Nok Nok Labs Incorporated
• Original Assignee: Nok Nok Labs Incorporated
• Inventors: Baghdasaryan, Davit
• Granted Patent: US 10,762,181 B2
• Time in Patent Office: Days
• US Class Current: 705/44
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 20/204 comprising interface for record bearing medium or carrier for electronic funds transfer or payment credit
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 20/3274 using a pictured code, e.g. barcode or QR-code, being displayed on the M-device
• CPC Class Codes: G06Q 20/3278 RFID or NFC payments by means of M-devices
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G07F 19/20 Automatic teller machines [ATMs]
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0822 : using key encryption key
• CPC Class Codes: H04L 9/0841 : involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3297 : involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/065 : Continuous authentication

Abstract

A system, apparatus, method, and machine readable medium are described for confirming a user transaction. For example, one embodiment of a method comprises: detecting at a relying party a transaction triggered by a first user over a network and performing one or more authentication techniques to authenticate the first user to the relying party over the network; identifying one or more other users who are required to confirm the transaction before allowing the transaction to be performed, the one or more other users being registered with the relying party; transmitting notifications to the one or more other users or a subset thereof indicating that a transaction has been triggered by the first user; and the one or more other users or subset thereof confirming the transaction by performing remote authentication with the relying party over the network.

Claims

1. A method for user authentication comprising:

detecting at a relying party a transaction triggered by a first user over a network and performing one or more authentication techniques to authenticate the first user to the relying party over the network;

identifying one or more other users who are required to confirm the transaction before allowing the transaction to be performed, the one or more other users being registered with the relying party;

transmitting notifications to the one or more other users or a subset thereof indicating that a transaction has been triggered by the first user; and

the one or more other users or subset thereof confirming the transaction by performing remote authentication with the relying party over the network.

2. The method as in claim 1 further comprising:

the one or more other users or subset thereof denying the transaction by not performing remote authentication with the relying party over the network.

3. The method as in claim 1 wherein the notifications comprise details of the transaction being attempted by the first user.

4. The method as in claim 1 wherein the notification comprises a link which, upon selection by the one or more other users or subset thereof, provides details of the transaction being attempted by the first user.

5. The method as in claim 1 further comprising:

determining whether the transaction requires confirmation by the one or more other users or subset thereof based on a set of variables associated with the transaction.

6. The method as in claim 5 wherein at least one of the variables comprises an amount of money involved in the transaction.

7. The method as in claim 1 wherein some of the notifications are transmitted using a first type of data communication protocol and some of the notifications are transmitted using a second type of data communication protocol.

8. The method as in claim 7 wherein the first type of data communication protocol comprises a text messaging protocol and the second type of data communication protocol comprises email.

9. The method as in claim 7 wherein the first type of data communication protocol and/or the second type of data communication protocol comprises a push notification protocol.

10. The method as in claim 1 wherein remote authentication with the relying party over the network comprises:

capturing biometric data or other authentication data input by a user on a client communicatively coupled to the relying party over the network; and

generating an assurance level that the user is a legitimate user based, at least in part, on the biometric data.

11. The method as in claim 10 wherein the biometric data is captured with a fingerprint authenticator, voice recognition authenticator, and/or face recognition authenticator.

12. The method as in claim 10 further comprising:

performing one or more non-intrusive authentication techniques; and

adjusting the assurance level based, at least in part, on the one or more non-intrusive authentication techniques.

13. The method as in claim 12 wherein one of the non-intrusive authentication techniques comprises:

detecting a current location of the client based on data from a location sensor; and

if the user is in an expected location, then adjusting the assurance level upward and if the user is in an unexpected location, the adjusting the assurance level downward.

14. The method as in claim 13 wherein another one of the non-intrusive authentication techniques comprises determining an amount of time since the last explicit user authentication and responsively adjusting the assurance level based on an amount of time which has elapsed.

23. The method as in claim 7 wherein the first type of data communication protocol and/or the second type of data communication protocol comprises a push notification protocol.

26. The system as in claim 10 further comprising:

non-intrusive authentication logic performing one or more non-intrusive authentication techniques; and

adjusting the assurance level based, at least in part, on the one or more non-intrusive authentication techniques.

27. The system as in claim 26 wherein one of the non-intrusive authentication techniques comprises:

detecting a current location of the client based on data from a location sensor; and

if the user is in an expected location, then adjusting the assurance level upward and if the user is in an unexpected location, the adjusting the assurance level downward.

28. The system as in claim 27 wherein another one of the non-intrusive authentication techniques comprises determining an amount of time since the last explicit user authentication and responsively adjusting the assurance level based on an amount of time which has elapsed.

15. A system for user authentication comprising:

a relying party detecting a transaction triggered by a first user over a network and performing one or more authentication techniques to authenticate the first user over the network;

a database containing user data, the relying party querying the database to identify one or more other users who are required to confirm the transaction before allowing the transaction to be performed, the one or more other users being registered with the relying party;

notification generation logic at the relying party transmitting notifications to the one or more other users or a subset thereof indicating that a transaction has been triggered by the first user; and

secure transaction program code executed on clients of the one or more other users or subset thereof confirming the transaction by performing remote authentication with the relying party over the network.

16. The system as in claim 15 wherein the one or more other users or subset thereof can deny the transaction by not performing remote authentication with the relying party over the network.

17. The system as in claim 15 wherein the notifications comprise details of the transaction being attempted by the first user.

18. The system as in claim 15 wherein the notification comprises a link which, upon selection by the one or more other users or subset thereof, provides details of the transaction being attempted by the first user.

19. The system as in claim 15 wherein the relying party determines whether the transaction requires confirmation by the one or more other users or subset thereof based on a set of variables associated with the transaction.

20. The system as in claim 19 wherein at least one of the variables comprises an amount of money involved in the transaction.

21. The system as in claim 15 wherein some of the notifications are transmitted using a first type of data communication protocol and some of the notifications are transmitted using a second type of data communication protocol.

22. The system as in claim 21 wherein the first type of data communication protocol comprises a text messaging protocol and the second type of data communication protocol comprises email.

24. The system as in claim 15 wherein remote authentication with the relying party over the network comprises:

an authentication engine capturing biometric data or other authentication data input by a user on a client communicatively coupled to the relying party over the network; and

generating an assurance level that the user is a legitimate user based, at least in part, on the biometric data.

25. The system as in claim 24 wherein the biometric data is captured with a fingerprint authenticator, voice recognition authenticator, and/or face recognition authenticator.