Flexible quasi out of band authentication architecture

• US 8,887,247 B2
• Filed: 05/20/2014
• Issued: 11/11/2014
• Est. Priority Date: 05/14/2010
• Status: Active Grant

• Current Assignee: Payfone Incorporated
• Original Assignee: Authentify, Inc. (Early Warning Services, LLC)
• Inventors: Ganesan, Ravi
• Primary Examiner(s): Tiv, Backhean
• Assistant Examiner(s): STILTNER, WEIWEI YE
• Application Number:
  US14/282,169
• Publication Number:
  US 20140289132A1
• Time in Patent Office: 175 Days
• Field of Search: 726/4
• US Class Current: 726/4
• CPC Class Codes: G06F 21/36 by graphic or iconic representation
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: H04L 41/04 Network management architectures or arrangements
• CPC Class Codes: H04L 41/344 Out-of-band transfers
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

To obtain user approval of network transactions at different levels of security, a network site selects a form in which a transaction with be presented to the user from a group of transaction presentation forms including presentation of the transaction in a browser pop-up window on a user network device, in a security software application window on the user network device, and in a security application window on another user network device. The network site also selects a type of approval of the transaction required from the user from a group of transaction approval types including approval requiring no action by the user after presentation of the transaction, the user to actively approve the presented transaction, and the user to sign the presented transaction. The transaction, the selected transaction presentation form, and the selected type of user transaction approval, are transmitted to obtain approval of the transaction by the user.

Claims

1. A network server for presenting network transactions requiring different levels of security to a user for approval, comprising:

a communications port configured to receive a transaction having a predetermined security level from a network site transacting with the user;

a processor configured to direct (1) presentation of the transaction to the user in one of a group of presentation forms including at least two of (i) a first form of presentation corresponding to presentation of the transaction in a browser pop-up window on a first network device associated with the user, (ii) a second form of presentation corresponding to presentation of the transaction in a security software application window on the first network device, and (iii) a third form of presentation corresponding to presentation of the transaction in a security application window on a second network device associated with the user and different than the first network device, wherein the one presentation form corresponds to the predetermined security level for the transaction, and (2) a request for approval of the transaction by the user corresponding to one of a group of transaction approval types including at least two of (i) a first type approval requiring no action by the user after presentation of the transaction, (ii) a second type approval requiring the user to actively approve the presented transaction, and (iii) a third type approval requiring the user to sign the presented transaction;

wherein the communications port is further configured to receive an identifier of the one transaction presentation form and the one transaction approval type from the network site;

wherein the one transaction approval type corresponds to the predetermined security level for the transaction.

2. The server according to claim 1, wherein the first network device is a computer and the second network device is a mobile communications device.

3. The server according to claim 1, wherein the first network device is a desktop computer and the second network device is a smart mobile phone.

4. The server according to claim 1, wherein:

the one transaction approval type is the third type approval; and

the processor is further configured to compute a personal identification number (PIN) based on a secret shared only by the network site and the network server, and not by the user, and direct presentation of the computed PIN to the user for use as a signature of the user on the transaction.

5. The server according to claim 1, wherein:

the one transaction approval type is the second type approval;

the communications port is further configured to and

the processor is further configured to receive an indication of approval of the presented transaction from the user, and direct transmission of the received indication of approval to the network site.

6. The server according to claim 1, wherein:

the processor is further configured to receive comfort indicia from the user, and direct presentation of the received comfort indicia to the user in the one presentation form, with the transaction.

7. The server according to claim 1, wherein the processor is further configured to (1) direct the presentation of the transaction to the user in the one presentation form and (2) direct the request for approval of the transaction by the user corresponding to the one transaction approval type without being requested to do so by the user.

8. The server according to claim 1, wherein the processor is further configured to (1) direct the presentation of the transaction to the user in the one presentation form and (2) direct the request for approval of the transaction by the user corresponding to the one transaction approval type responsive to receipt of a request of the user.