Method for secure user and transaction authentication and risk management

• US 8,789,153 B2
• Filed: 01/21/2011
• Issued: 07/22/2014
• Est. Priority Date: 01/27/2010
• Status: Active Grant

• Current Assignee: Payfone Incorporated
• Original Assignee: Authentify, Inc. (Early Warning Services, LLC)
• Inventors: Ganesan, Ravi
• Primary Examiner(s): Gee, Jason K.
• Assistant Examiner(s): SARKER, SANCHIT K
• Application Number:
  US13/011,587
• Publication Number:
  US 20110185405A1
• Time in Patent Office: 1,278 Days
• Field of Search: 726/3, 726/4, 726/5, 726/6, 713/150, 713/168, 380/155
• US Class Current: 726/6
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

To provide a user signature on a network transaction, a security server receives transaction information representing a transaction between a network user and a network site, such as a website. The security server calculates a one-time-password based on the received transaction information and a secret shared by the security server and the network site, but not by the user. The security server transmits the calculated one-time-password for application as the user'"'"'s signature on the transaction. The one-time-password is independently calculable by the network site based on the shared secret.

Claims

1. A method of providing a user signature on a network transaction, comprising:

receiving, by a security server, transaction information representing a transaction between a network user and a network site;

calculating, by the security server, a one-time-password based on (i) the received transaction information and (ii) a secret shared by the security server and the network site, but not by the user, wherein the one-time-password is independently calculable by the network site based on the shared secret and the transaction information; and

transmitting, by the security server, the calculated one-time-password for application as the user'"'"'s signature on the transaction and verification by the network site;

wherein the calculated one-time-password is transmitted, by the security server to one user network device, for presentation on a window displayed by that user network device and entry by the user onto a network page associated with the network site and displayed on another user network device.

2. The method of claim 1, wherein:

the network site is a web site; and

the transaction information is received from a web page associated with the network site and displayed on a network device associated with the user.

3. The method of claim 1, wherein:

the one user network device is of a type that is different than the other user network device.

4. The method of claim 3, wherein:

the one user network device is a personal mobile network device, and

the other user network device is a computer.

5. The method of claim 3, wherein:

the one user network device is a mobile smart phone; and

the other user network device is a desktop computer.

6. The method of claim 1, further comprising:

storing, at the security server, a log of transactions between the user and the network site.

7. The method of claim 6, further comprising:

computing, by the security server, a risk profile of the user based on the stored transactions log.

8. The method of claim 6, further comprising:

transmitting, by the security server to a third party, the stored transactions log for risk analysis.

9. A method of providing a user signature on a network transaction, comprising:

receiving, by one user agent on a user network device from a security server, a one-time-password corresponding to (i) transaction information representing a transaction between a user and a network site and (ii) a secret shared by the security server and the network site, but not by the user, wherein the one-time-password is independently calculable by the network site based on the shared secret and the transaction related information;

transferring the one time password from the one user agent to another user agent on another different user network device; and

transmitting, by the other user agent to the network site, the calculated one-time-password as the user'"'"'s signature on the transaction for verification by the network site.

10. The method of claim 9, wherein:

the one user agent is a window displayed on the user network device; and

the other user agent is a network page associated with the network site and displayed on the other different user network device.

11. A method of authenticating a user on a network, comprising:

receiving, by a security server, a request of a network site to have a user authenticated;

calculating, by the security server, a one-time-password based on a secret shared by the security server and the network site, but not by the user, wherein the one-time-password is independently calculable by the network site based on the shared secret; and

transmitting, by the security server to a window displayed on a network device of the user, the calculated one-time-password for entry by the user onto a network page associated with the network site and displayed on another network device of the user, and for subsequent verification by the network site to thereby authenticate the user.

12. The method of claim 11, further comprising:

also receiving, by the security server, transaction information relating to a transaction between the user and the network site; and

wherein the one-time-password is calculated based also on the transaction information.

13. The method of claim 11, wherein:

the user network device is of a type that is different than the other user network device.

14. The method of claim 13, wherein:

the user network device is a mobile smart phone; and

the other user network device is a computer.

15. A method of authenticating a user on a network, comprising:

receiving, by a user agent on a network device of a user, a one-time-password corresponding to a secret shared by a security server and a network site, but not by the user;

transferring, by the user, the received one-time-password from the user agent on the network device to another user agent on another network device; and

transmitting, by the other user agent to the network site, the transferred one-time-password for subsequent verification by the network site to thereby authenticate the user;

wherein the one-time-password is independently calculable by the network site based on the shared secret.

16. The method of claim 15, wherein:

the user agent is a window displayed on the user network device; and

the other user agent is a network page associated with the network site and displayed on the other user network device.