SECURE TRANSACTION AND ACCESS USING INSECURE DEVICE

• US 20160191514A1
• Filed: 07/22/2014
• Published: 06/30/2016
• Est. Priority Date: 07/28/2013
• Status: Active Grant

• Current Assignee: Eli Talmor, Rita Talmor
• Original Assignee: Eli Talmor, Rita Talmor
• Inventors: TALMOR, Eli, TALMOR, Rita
• Granted Patent: US 10,425,407 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/325 using wireless networks
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

The present invention enables secure transactions or access using insecure endpoint devices, such as computers, tablets and smart-phones. These insecure devices are potentially compromised with malicious software that may attack the user in every possible way. The present invention does not pretend to prevent malware. Instead, malware attacks against secure transactions and access are made obsolete. The present invention includes data, directly connected to transaction or access request to Relying-Party-Service-Provider, into authentication process of Identity-as-a-Service Provider. The present invention includes user authentication using mobile phone vs. Identity-Management-as-a-Service provider. The present invention also includes entering request for secure transaction or access to Relying-Party-Service-Provider, using insecure device. The present invention also includes two-way communication between Relying-Party-Service-Provider and Identity-Management-as-a-Service. The advantages of the present invention include, without limitation, that it is resilient to malware attack.

Claims

1. A system for secure transaction and access, comprising:

a user;

a mobile phone of the user;

an insecure endpoint device, for communication of the user with a Relying-Party-Service-Provider, and potentially compromised by malware;

an Identity-Management-as-a-Service for identity verification of the user; and

the Relying-Party-Service-Provider for transaction and access of the user.

2. The system of claim 1 where the user uses a voice channel of said mobile phone to interact with the Identity-Management-as-a-Service.

3. The system of claim 2 where the Identity-Management-as-a-Service performs a strong authentication of said interacting user, using the voice channel.

4. The system of claim 2 where said interaction includes a spoken PIN and a spoken authorization code, wherein said PIN is being assigned to the user following registration with the Identity-Management-as-a-Service and said authorization code ,determined by Relying-Party-Service-Provider, is directly connected to an access or transaction request of said user to the Relying-Party-Service-Provider.

5. The system of claim 2 where interaction includes a keypad-entered PIN and a keypad-entered authorization code, wherein said PIN is being assigned to the user following registration with the Identity-Management-as-a-Service and authorization code, determined by Relying-Party-Service-Provider, is directly connected to an access or transaction request of said user to the Relying-Party-Service-Provider.

6. The system of claim 3 where the strong authentication includes a Caller ID, the PIN and a Voice Biometrics match.

7. The system of claim 6 where the Voice Biometrics has the ability of rejecting the user'"'"'s voice replay and the user'"'"'s voice playback and the user'"'"'s voice synthesis, preceded by the user'"'"'s voice recording .

8. The system of claim 7 where the user receives the Identity-Management-a-Service response, wherein said response expires after a preset time interval.

9. The system of claim 8 where the user adds said response into the access or transaction request to the Relying-Party-Service-Provider, using the insecure endpoint device.

10. The system of claim 9 where the Relying-Party-Service-Provider receives said request from the insecure endpoint device.

11. The system of claim 10 where the Relying-Party-Service-Provider sends said response, added to said request, to the Identity-Management-as-a-Service.

12. The system of claim 11 where the Identity-Management-as-a-Service returns a user'"'"'s ID and the authorization code.

13. The system of claim 12 where Relying-Party-Service-Provider matches the user'"'"'s ID and the authorization code with the transaction or access request received from the insecure endpoint device.

14. The system of claim 1 where the insecure endpoint device may be one of the network-connected devices, such as:

personal computers, laptops, tablets, smart-phones and mobile phones, including the user'"'"'s mobile phone.

15. The system of claim 1 where the Relying-Party-Service-Provider may be one of the group consisting of Banks, Financial Services, Online Shops, Online Voting Sites, Enterprise Websites, Smart Home, Mobile and Web applications.

16. A method for secure transaction and access, comprising an interaction between a user;

a mobile phone of the user;

an insecure endpoint device, performing communication of the user with a Relying-Party-Service-Provider and potentially compromised by malware;

an Identity-Management-as-a-Service, performing identity verification of the user; and

a Relying-Party-Service-Provider, performing transaction and access of the user.

17. The method of claim 16 where the user uses a voice channel of said mobile phone to interact with the Identity-Management-as-a-Service.

18. The method of claim 16 where the Identity-Management-as-a-Service performs a strong authentication of the interacting user, using said voice channel.

19. The method of claim 17 where the interaction includes a spoken PIN and an authorization code, wherein said PIN is being assigned to the user following a registration with the Identity-Management-as-a-Service and said authorization code, determined by Relying-Party-Service-Provider, is directly connected to an access or transaction request of said user to the Relying-Party-Service-Provider.

20. The method of claim 17 where interaction includes a keypad-entered PIN and a keypad-entered authorization code, wherein said PIN is being assigned to the user following a registration with the Identity-Management-as-a-Service and said authorization code ,determined by Relying-Party-Service-Provider, is directly connected to an access or transaction request of said user to the Relying-Party-Service-Provider.

21. The method of claim 18 where the strong authentication includes a Caller ID, the PIN and a Voice Biometrics match.

22. The method of claim 21 where the Voice Biometrics has the ability of rejecting the user'"'"'s voice replay and the user'"'"'s voice playback and the user'"'"'s voice synthesis, preceded by the user'"'"'s voice recording .

23. The method of claim 22 where the user receives the Identity-Management-a-Service response, wherein said response expires after a preset time interval.

24. The method of claim 23 where the user adds said response into the access or transaction request to the Relying-Party-Service-Provider, using the insecure endpoint device.

25. The method of claim 24 where the Relying-Party-Service-Provider receives said request from the insecure endpoint device.

26. The method of claim 25 where the Relying-Party-Service-Provider sends said response to the Identity-Management-Service Provider.

27. The method of claim 26 where the Identity-Management-as-a-Service returns a user'"'"'s ID and the authorization code.

28. The method of claim 27 where Relying-Party-Service-Provider matches the user'"'"'s ID and the authorization code with the transaction or access request received from insecure endpoint device.

29. The method of claim 16 where the insecure endpoint device may be one of the network-connected devices, such as:

personal computers, laptops, tablets, smart-phones and mobile phones, including user'"'"'s mobile phone.

30. The method of claim 16 where the Relying-Party-Service-Provider may be one of the group consisting of Banks, Financial Services, Online Shops, Online Voting Sites, Enterprise Websites, Smart Home, Mobile and Web applications.