User authentication system and methods thereof

• US 7,231,657 B2
• Filed: 08/21/2002
• Issued: 06/12/2007
• Est. Priority Date: 02/14/2002
• Status: Active Grant

• Current Assignee: CGI Technologies and Solutions Incorporated (CGI Group)
• Original Assignee: American Management Systems, Incorporated (CGI, Inc.)
• Inventors: Honarvar, Laurence Toraj, Witte, Brandon Raymond, Fatigante, Steve Chance, Harless, Gary Lynn
• Primary Examiner(s): Moise; Emmanuel L.
• Assistant Examiner(s): Fields; Courtney D.
• Application Number:
  US10/224,564
• Publication Number:
  US 20030154406A1
• Time in Patent Office: 1,756 Days
• Field of Search: 726/2, 726/5, 726/10, 726/20, 726/27, 726/4, 726/17, 713/176, 713/186, 709/225
• US Class Current: 726/2
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: G07C 9/37 using biometric data, e.g. fingerprints, iris scans or voice recognition

Abstract

A computer system to authenticate users of vendors supplying services and/or products to the users, the system having programmed processors providing authentication rules, authenticating users according to the authentication rules responsive to user authentication requests, configuring the authentication rules in real-time, thereby allowing real-time customization of the system, providing multi-factor user authentication processes, using any data sources providing information about and/or known to the users to authenticate the users, thereby providing a data agnostic system, and authentication strategies correspond to the authentication rules, thereby allowing the system to support authentication strategy experimentation.

Claims

1. A system authenticating users, comprising:

a programmed processor

generating authentication rules for defining configuration parameters for a user authentication process, based upon specifying a configuration parameter for one or more authentication sub-processes of information validation, fraud detection or identity verification, for one or more data sources, or for one or more authentication factors, or any combinations thereof, according to input user authentication process creation information,

authenticating users according to the authentication rules responsive to user authentication requests, and

configuring the authentication rules in real-time, thereby allowing real-time authentication process customization in the system.

2. The system of claim 1,

wherein the authentication rules define the user authentication process using any data sources providing information about the user, information known to the user, or both, to authenticate the users, thereby providing a data agnostic system;

wherein the authentication rules define two or more authentication factors, thereby providing a multi-factor user authentication process; and

wherein authentication strategies correspond to the authentication rules, thereby allowing the system to support authentication strategy experimentation.

3. The system of claim 1, wherein the authentication rules define the user authentication process using any data sources providing information about the user, information known to the user, or both, to authenticate the users, thereby providing a data agnostic system.

4. The system of claim 1, wherein the authentication rules define a multi-factor authentication process to authenticate the users.

5. The system of claim 1, wherein authentication strategies correspond to the authentication rules, thereby allowing the system to support authentication strategy experimentation.

6. The system of claim 1, wherein multi-step user authentication processes according to authorization requirements of vendors correspond to the authentication rules.

7. The system of claim 1, wherein the authentication rules further comprise one or more of data source mapping rules defining interfaces with the data sources and permission rules defining access privileges to the authentication rules.

8. The system of claim 1, wherein the programmed processor further simulates authentication of the users according to the authentication rules.

9. The system of claim 1, wherein the programmed processor further allows automatic and/or manual real-time versioning of the authentication rules and the users are authenticated according to a version of the authentication rules.

10. The system of claim 1, wherein the programmed processor further correlates status information with the authentication rules.

11. The system of claim 1, wherein the authentication rules comprise permission rules based upon organization information of vendors and the programmed processor further manages access to the authentication rules according to the permission rules.

12. The system of claim 1, wherein the programmed processor further generates user authentication examinations based upon the authentication rules in real-time.

13. The system of claim 1, wherein the authentication rules correspond to interactive-user-authentication question parameters.

14. The system of claim 1, wherein authentication strategies correspond to the authentication rules which are modified responsive to performance data of the authentication strategies in real-time, thereby optimizing the system in real-time responsive to the performance data.

15. The system of claim 1, wherein the specifying configuration for the one or more data sources comprises data source parameters specifying the data sources.

16. The system of claim 1, wherein the specifying configuration for the one or more data sources comprises data source parameters specifying the data source by type.

17. The system of claim 16, wherein the data source type comprises geographic data sources.

18. The system of claim 16, wherein the data source type comprises demographic data sources.

19. The system of claim 16, wherein the data source type comprises political data sources.

20. The system of claim 16, wherein the data source type comprises government-supplied data sources.

21. The system of claim 1, wherein the authentication rules define the user authentication process using real-time behavior information, feeling information, or both, of the users.

23. The system of claim 1, wherein the authentication rules define the user authentication process based upon multiple-choice user authentication questions that have none-of-the-above as an answer choice when data about the user from a data source is not required to ask the question, data about the user is not available, or both.

24. The system of claim 1, wherein the programmed processor further provides a display graphical user interface comprising a selection navigation area to select user authentication processes used to authenticate the users and to select configurations of the processes.

25. The system of claim 1, wherein the programmed processor further provides a displayed graphical user interface comprising a side navigation area allowing selection of user authentication processes used to authenticate the users and tabbed folders providing configuration information corresponding to selected user authentication processes, thereby allowing configuration of the user authentication processes.

26. The system of claim 1, wherein the authentication rules correspond to user authentication question parameters specifying questions, question grouping, question group priority, question type, question query order, question priority, question answer options, question point assignments, question time to answer, question retry criteria, question language and/or whether data about the user is not required to ask a question.

27. The system of claim 1, wherein the authentication rules correspond to user authentication question multiple-choice answer options comprising numeric answer ranges, number of answer choices, context sensitive wrong answer choices and/or none-of-the-above as an answer choice.

28. The system of claim 1, wherein the programmed processor further automatically generates authentication examinations according to the authentication rules and allows monitoring of transaction records corresponding to the examinations in real-time.

29. The system of claim 1, wherein the authentication rules define the user authentication process using user authentication questions and define grouping the user authentication questions according to predictability of the questions in question groups.

30. The system of claim 1,

wherein the authentication rules define the user authentication process using user authentication questions, define grouping the user authentication questions, define assigning correct answer points to each group, a question in a group, or both, and

wherein the authenticating the users comprises calculating authentication confidence scores based upon the points scored by the users.

32. The system of claim 1,

wherein the authentication rules define the user authentication process using user authentication questions, define grouping the user authentication questions, define assigning equal, variable, or both correct answer points to each group, a question in a group or both, and

wherein the authenticating the users comprises calculating authentication confidence scores based upon the points scored by the users.

33. The system of claim 1, wherein the programmed processor further communicates directly with vendor computers that interface with the users or communicates with the vendor computers via redirection of the users by the vendor computers to the programmed processor, thereby allowing open connectivity between the vendor computers and the system.

34. The system of claim 2, wherein the multi-factor user authentication processes comprise verifying what a user has using one or more of digital certificates and personal identification documents of the users.

35. The system of claim 2, wherein the multi-factor user authentication processes comprise verifying what a user is by using one or more biometric verifications of fingerprint scan, keystroke patterns, retinal scan, face recognition and DNA analysis.

36. The system of claim 2, wherein the multi-factor user authentication processes comprise verifying what a user knows using one or more of responses to user authentication questions, real-time behavior information, real-time feeling information, or any combinations thereof, of the users.

37. The system of claim 2, wherein the authentication rules correspond to vendor-configured multi-step authentication processes comprising sequentially, simultaneously, or both, accessing data sources providing information about, information known, or both, to the user to authenticate the users within an authentication session.

38. The system of claim 1, wherein the programmed processor further communicates with vendor computers using business-to-business transactions or using user-interface redirection.

39. The system of claim 1, wherein the programmed processor further correlates identifiers as live, retired, working, or any combinations thereof, as an operation status of user authentication processes used to authenticate the users.

40. The system of claim 1, wherein the programmed processor further manages authentication of the users in compliance with applicable consumer privacy laws.

41. The system of claim 1,

wherein the authentication rules define the user authentication process using user authentication questions, and define randomly selecting or selecting according to a fixed order the user authentication questions to authenticate the users.

42. The system of claim 1, wherein the authentication rules correspond to authentication retry parameters specifying retry criteria of user authentication processes.

43. The system of claim 2, wherein the strategy experimentation comprises assigning the authentication strategies to a business transaction, aggregating and evaluating performance data of the strategies for the business transaction, thereby allowing optimization of the system responsive to the performance data.

44. The system of claim 2, wherein the strategy experimentation comprises assigning the authentication strategies to a business transaction, aggregating performance data of the strategies for the business transaction, and evaluating the performance data according to a champion challenger method.

45. The system of claim 2, wherein the strategy experimentation comprises assigning an authentication strategy to a group of users for a business transaction, aggregating performance data of the strategy for each group, aggregating and evaluating the performance data of the strategy at various levels of the strategy, thereby allowing optimization of the system responsive to the performance data.

46. The system of claim 2, wherein the strategy experimentation comprises assigning an authentication strategy to a group of users for a business transaction, aggregating performance data of the strategy for each group, aggregating the performance data of the strategy for authentication question groups and authentication questions within each group of the strategy and optimizing the strategy responsive to the performance data.

47. The system of claim 1, wherein the authentication rules define the user authentication process using user authentication questions, and define grouping and selecting the user authentication questions according to a priority based upon one or more of predictability and the data sources corresponding to the questions.

48. The system of claim 1, wherein the specifying configuration for the one or more data sources comprises data source parameters specifying data sources providing information about, information known, or both, to the user to authenticate the users for a vendor or for each user authentication process of the vendor.

49. The system of claim 1, wherein the programmed processor further maintains the authentication rules via a web browser-based interface.

50. The system of claim 1, wherein the authentication rules define the user authentication process using user authentication questions having context sensitive wrong answers to authenticate the users.

51. The system of claim 1, wherein the authentication rules define limiting authentication of the users according to one or more frequency and time criteria based upon attempted, answered, or both, authentication questions and attempted, completed, or both, authentication sessions.

52. The system of claim 1, wherein authentication confidence scoring strategies correspond to the authentication rules, thereby allowing the system to support different scoring algorithms.

53. The system of claim 1, wherein the authentication rules correspond to authorization parameters specifying authorization decisions according to authentication confidence scoring algorithms of a vendor.

54. The system of claim 1, wherein the authentication rules define the user authentication process using filtered user authentication questions.

55. The system of claim 1, wherein the programmed processor further provides filtered user authentication transaction reporting in real-time.

56. The system of claim 1, wherein the programmed processor further allows a system/solution provider and/or a vendor to manage the authentication rules in real-time.

57. The system of claim 1, wherein the programmed processor further automatically loads test authentication processes with key fields and the programmed processor simulates authentication of the users according to the test authentication processes.

58. The system of claim 1, wherein the programmed processor stores user authentication transactions in real-time, thereby allowing the system to report, in real-time, the transactions via any interface with the system.

59. The system of claim 1, wherein the authentication rules define the user authentication process using user authentication questions, and define grouping and retrieving a number of user authentication questions from the group to authenticate the users.

60. The system of claim 1, wherein the authentication rules define the authentication process using user authentication question and define determining a number of user authentication questions to be generated to authenticate the users.

61. The system of claim 1, wherein the authentication rules define the authentication process using user authentication questions and define generating the user authentication questions having multiple-choice answers with only one answer correct, true/false answers, multi-select answers, fill in the blank answers, or any combinations thereof.

62. The system of claim 1, wherein the programmed processor further provides test authentication processes, simulates authentication of the users according to the test authentication processes, and provides correct answers in the simulation.

63. The system of claim 1, wherein the programmed processor further allows operation of the system as a user authentication service or deployment as a software product.

64. The system of claim 2, wherein the strategy experimentation comprises aggregating performance data of the authentication strategies and the programmed processor further optimizes the authentication rules responsive to the performance data.

71. The system of claim 2, wherein multi-factor authentication strategies correspond to the authentication rules and the programmed processor further aggregates performance data of the strategies to measure effectiveness of the strategies and modifies the authentication rules in real-time responsive to the performance data, thereby optimizing the system responsive to the performance data in real-time.

73. The system according to claim 1,

wherein the authenticating users comprises authenticating users of vendors providing services, products, or both, to the users, and the programmed processor further

configures a display screen to provide a graphical user interface comprising a side navigation area containing at least a first selection location providing selectable user authentication processes for a vendor and tabbed folders providing selectable configuration parameters corresponding to selected user authentication processes of the vendor, thereby allowing authentication process selection, customization, simulation, and submission to a production environment to authenticate users by the vendor.

74. The system of claim 73, wherein the side navigation area allows selection of at least one or more of simulation of the user authentication processes, printing of the configuration parameters of the user authentication processes, auditing of user authentication transactions of the user authentication processes, and obtaining status information of the user authentication processes.

75. The system according to claim 1, wherein the authentication rules define the user authentication process based upon a single set of interactive user authentication questions generated from at least two or more data sources providing information about, information known, or both, to the user.

76. The system of claim 75, wherein the data sources comprise credit history, user profile, fraud, geographic, demographic, government-supplied, political, biometric, or digital certificate, or any combinations thereof data sources.

77. The system of claim 75, wherein the questions are generated from a geographic data source comprising geographic area information pertaining to a geographic area known by a user.

78. The system of claim 77, wherein the geographic area information comprises one or more of street name information, street intersection information, landmark information, governmental information, or any combinations thereof.

79. The system of claim 75, wherein the questions are generated from a political data source comprising political information relating to a geographic area known by a user.

80. The system of claim 79, wherein the political information comprise politician information and/or political party information.

81. The system of claim 75, wherein the questions are generated from a user-profile data source comprising vehicle information, household information, employer history information, residence history information, tax information, shopping tendency information, or any combinations thereof.

22. The system of 21, wherein the user real-time information is based upon user facial patterns, mannerisms, body movements, perspiration levels, anxiety levels, emotions, mental data, voice distress data, or polygraph data, or any combinations thereof.

31. The system of 29, wherein the user authentication questions are grouped according to a common association of the questions in each group.

65. A system authenticating users, comprising a programmed processor

generating authentication rules for defining configuration parameters for a user authentication process, based upon specifying a configuration parameter for one or more authentication sub-processes of information validation, fraud detection or identity verification, for one or more data sources, or for one or more authentication factors, or any combinations thereof, according to input user authentication process creation information;

and

generating user authentication examinations using any data sources, which provide information about, information known, or both to a user, according to the authentication rules, thereby providing a data agnostic system.

66. The system of claim 65, wherein the user authentication examinations are multi-factor.

67. The system of claim 65, wherein the authentication rules correspond to authentication strategies, thereby allowing the system to support authentication strategy experimentation.

68. An apparatus, comprising:

a programmed processor

generating authentication rules for defining configuration parameters for a user authentication process, based upon specifying a configuration parameter for one or more authentication sub-processes of information validation, fraud detection or identity verification, for one or more data sources, or for one or more authentication factors, or any combinations thereof, according to input user authentication process creation information; and

generating multi-factor authentication examinations to authenticate users, based upon the generated authentication rules.

69. The system of claim 68, wherein authentication strategies correspond to the authentication rules, thereby allowing the system to support authentication strategy experimentation.

70. A system authenticating users, comprising:

a programmed processor

generating authentication rules that correspond to authentication strategies for defining configuration parameters for a user authentication process, based upon specifying a configuration parameter for one or more authentication sub-processes of information validation, fraud detection or identity verification, for one or more data sources, or for one or more authentication factors, or any combinations thereof, according to input user authentication process creation information;

aggregating performance data of the authentication rules; and

modifying the strategies responsive to the performance data, thereby optimizing the system responsive to the performance data.

72. A system authenticating users, comprising:

an authentication rule designer generating authentication rules for defining configuration parameters for a user authentication process, based upon specifying a configuration parameter for one or more authentication sub-processes of information validation, fraud detection or identity verification, for one or more data sources, or for one or more authentication factors, or any combinations thereof, according to real-time input authentication process configuration parameter information, thereby customizing the system in real-time; and

an authentication engine generating an authentication examination according to the authentication rules for authenticating the user.

82. A system authenticating users, comprising:

authentication rules means for generating configurable authentication rules defining configuration parameters for a user authentication process, based upon specifying a configuration parameter for one or more authentication sub-processes of information validation, fraud detection or identity verification, for one or more data sources, or for one or more authentication factors, or any combinations thereof, according to input user authentication process creation information; and

data agnostic authentication means for generating authentication examinations for authentication of users based upon the configuration parameter for the data sources.

83. A system authenticating a user, comprising:

authentication rules means for generating configurable authentication rules defining configuration parameters for a user authentication process, based upon specifying a configuration parameter for one or more authentication sub-processes of information validation, fraud detection or identity verification, for one or more data sources, or for one or more authentication factors, or any combinations thereof, according to input user authentication process creation information; and

multi-factor authentication means for generating multi-factor authentication examinations authenticating the user based upon two or more authentication factors, according to the authentication rules.