Verification and authentication systems and methods

• US 8,793,777 B2
• Filed: 06/29/2012
• Issued: 07/29/2014
• Est. Priority Date: 10/10/2006
• Status: Active Grant

• Current Assignee: Equifax, Inc.
• Original Assignee: Equifax, Inc.
• Inventors: Colson, Christen J.
• Primary Examiner(s): MOORTHY, ARAVIND K
• Application Number:
  US13/537,437
• Publication Number:
  US 20120266227A1
• Time in Patent Office: 760 Days
• Field of Search: 726/7, 726/15, 726/22, 713/162, 713/165, 713/168, 713/170, 713/182, 705/51, 705/64, 705/67, 709/225, 709/228, 709/229
• US Class Current: 726/7
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3226 : using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 : involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/40 : Network security protocols

Abstract

Embodiments of the present invention provide verification and/or authentication service engines that provide a customizable solution that can be “dialed” based on the risk level assigned to individual or grouped applications. The systems can also incorporate internal and external sources of data used to verify information provided by the user. It is dynamic and can pull information from a myriad of sources during the verification process, enabling credit reporting agencies (e.g., Equifax and others), FSPs, and other service providers to facilitate real-time approval and access to products and services.

Claims

1. A method of controlling access by an entity to vendor information technology systems, the method comprising:

receiving, by a verification/authentication engine executed on a server device, an inquiry from a vendor system to verify the entity for a transaction;

determining, by the verification/authentication engine, that the entity is a small business rather than an individual;

based on an identification of a channel through which the entity selects to access the vendor system, querying, by the verification/authentication engine, the entity using questions generated based on data from at least two data sources of a plurality of data sources containing information about the entity;

determining, by the verification/authentication engine, at least one of a confidence level or a score based on the extent to which the entity correctly answers the questions; and

sending, by the verification/authentication engine, the at least one of the confidence level or the score to the vendor system configured to determine whether to grant or deny access by the entity to the vendor system based on the at least one of the confidence level or the score.

2. The method of claim 1, further comprising determining a level of difficulty for the questions based on a channel type for the channel.

3. The method of claim 2, wherein determining the level of difficulty for the questions based on the channel type comprises:

determining that the channel type is a point-of-sale channel; and

increasing the level of difficulty based on the determining that the channel type is the point-of-sale channel.

4. The method of claim 1, further comprising determining that a risk level associated with the transaction requires verification via real-time data and wherein the at least two data sources include the real-time data.

5. The method of claim 1, further comprising:

generating the questions based on data about owners or principals of the small business.

6. The method of claim 5, further comprising generating a digital certificate for the entity based on determining that the entity is the small business, wherein the digital certificate comprises:

a verification level at which the entity was verified; and

an expiration date of the digital certificate,

wherein the digital certificate is capable of being stored on a user device and provided to a plurality of vendor systems.

7. The method of claim 5, further comprising

selecting, by the verification/authentication engine, an assigned level of risk for the transaction and a verification level to meet the assigned level of risk, wherein the assigned level of risk and the verification level are selected based on input received from the vendor system;

querying the entity based on the assigned level of risk and the verification level.

8. The method of claim 1, further comprising identifying a constraint associated with providing answers to the questions over the channel and selecting the data for generating the questions based on the constraint.

9. The method of claim 8, further comprising identifying a constraint associated with an input device via which answers are provided to the questions and selecting the data for generating the questions based on the constraint.

10. The method of claim 8, further comprising identifying a constraint associated with an output device via which the questions are displayed and selecting the data for generating the questions based on the constraint.

11. A method of controlling access by an entity to vendor information technology systems, the method comprising:

receiving, by a verification/authentication engine executed on a server device, an inquiry from a vendor system to verify the entity for a transaction;

determining, by the verification/authentication engine, that the entity is a small business rather than an individual;

selecting, by the verification/authentication engine, an assigned level of risk for the transaction and a verification level to meet the assigned level of risk, and a plurality of data sources containing information about the entity, wherein the assigned level of risk, the verification level, and the plurality of data sources are selected based on input received from the vendor system;

querying, by the verification/authentication engine, the entity using questions generated based on data from at least two data sources of the plurality of data sources, wherein the data describes owners or principals of the small business;

determining, by the verification/authentication engine, at least one of a confidence level or a score based on the extent to which the entity correctly answers the questions; and

sending, by the verification/authentication engine, the at least one of the confidence level or the score to the vendor system configured to determine whether to grant or deny access by the entity to the vendor system based on the at least one of the confidence level or the score.

12. The method of claim 11, further comprising querying the entity based on an identification of a channel through which the entity selects to access the vendor system.

13. The method of claim 12, further comprising determining a level of difficulty for the questions based on a channel type for the channel.

14. The method of claim 13, wherein determining the level of difficulty for the questions based on the channel type comprises:

determining that the channel type is a point-of-sale channel; and

increasing the level of difficulty based on the determining that the channel type is the point-of-sale channel.

15. The method of claim 11, further comprising determining that a risk level associated with the transaction requires verification via real-time data and wherein the at least two data sources include the real-time data.

16. A system comprising:

an authentication server capable of communicating with a vendor system, the authentication server comprising a verification/authentication engine configured for;

receiving an inquiry from the vendor system to verify an entity for a transaction;

determining that the entity is a small business rather than an individual;

based on an identification of a channel through which the entity selects to access the vendor system, querying the entity using questions generated based on data from at least two data sources of a plurality of data sources containing information about the entity;

determining at least one of a confidence level or a score based on the extent to which the entity correctly answers the questions; and

sending the at least one of the confidence level or the score to the vendor system configured to determine whether to grant or deny access by the entity to the vendor system based on the at least one of the confidence level or the score.

17. The system of claim 16, wherein the verification/authentication engine is further configured for:

determining that the channel is a point-of-sale channel; and

increasing a level of difficulty for the questions based on the determining that the channel is the point-of-sale channel.

18. The system of claim 16, wherein the verification/authentication engine is further configured for determining that a risk level associated with the transaction requires verification via real-time data and wherein the at least two data sources include the real-time data.

19. The system of claim 16, wherein the verification/authentication engine is further configured for:

generating the questions based on data about owners or principals of the small business.

20. The system of claim 19, wherein the verification/authentication engine is further configured for generating a digital certificate for the entity based on determining that the entity is the small business, wherein the digital certificate comprises:

a verification level at which the entity was verified; and

an expiration date of the digital certificate,

wherein the digital certificate is capable of being stored on a user device and provided to a plurality of vendor systems.