Methods and systems for authenticating users

• US 9,202,028 B2
• Filed: 03/18/2013
• Issued: 12/01/2015
• Est. Priority Date: 08/05/2009
• Status: Active Grant

• Current Assignee: Corporation DAON Technology
• Original Assignee: Daon Holdings Limited
• Inventors: White, Conor Robert, Peirce, Michael, Cramer, Jason Scott, Steiner, Chet Bradford, Diebes, Suzanna
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): KAPLAN, BENJAMIN A
• Application Number:
  US13/845,444
• Publication Number:
  US 20130227666A1
• Time in Patent Office: 988 Days
• Field of Search: 726/7
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

A method of authenticating users to reduce transaction risks includes indicating a desire to conduct a transaction and determining whether the transaction requires access to protected resources. Moreover, the method determines whether inputted information is known, determines a state of a communications device when the inputted information is known, and transmits a biometric authentication request from a server to an authentication system when the state of the communications device is enrolled. Additionally, the method includes validating the communications device, capturing biometric authentication data in accordance with a biometric authentication data capture request with the communications device, biometrically authenticating the user, generating a one-time pass-phrase and storing the one-time pass-phrase on the authentication system when the user is authenticated, comparing the transmitted one-time pass-phrase against the stored one-time pass-phrase, and granting access to the protected resources when the transmitted and stored one-time pass-phrases match.

Claims

1. A method for authenticating users comprising:

obtaining a unique user identifier from a user;

determining whether the obtained unique user identifier matches a user identifier and, upon determining a match, determining a risk level corresponding to a transaction;

determining a capture level for the determined risk level;

after inputting the capture level into a processor, determining a biometric authentication data requirement corresponding to the capture level with the processor;

validating the user with data corresponding to the biometric authentication data requirement; and

conducting the transaction after successfully validating the user.

2. A method of authenticating users in accordance with claim 1, said determining a risk level step comprising determining a different risk level for different transactions.

3. A method of authenticating users in accordance with claim 1, said determining a biometric authentication data requirement step comprising determining more demanding biometric authentication data requirements as the risk level increases.

4. A method of authenticating users in accordance with claim 1, said determining a risk level step comprising:

determining a risk factor for the transaction and a risk level adjustment for the risk factor; and

adjusting the determined risk level according to the risk level adjustment.

5. A method of authenticating users in accordance with claim 1 further comprising:

determining that a plurality of transactions is pending;

determining the risk level for each pending transaction; and

determining a maximum risk level to be the determined risk level.

6. A method for authenticating users in accordance with claim 1, further comprising validating the user with authentication data after the user is successfully validated in said validating step, the authentication data being different than the data corresponding to the biometric authentication data requirement.

7. A method for authenticating users comprising:

determining a risk level corresponding to a transaction desired to be conducted by a user and including the determined risk level in an authentication request;

determining a capture level for the determined risk level;

after inputting the capture level into a processor, determining an authentication data requirement corresponding to the capture level with the processor; and

validating the user with data corresponding to the authentication data requirement.

8. A method for authenticating users in accordance with claim 7, further comprising determining whether a unique user identifier matches a user identifier and when there is a match conducting said determining a risk level step.

9. A method for authenticating users in accordance with claim 7, further comprising determining the authentication data requirement includes different biometric types as the risk level increases.

10. A method for authenticating users in accordance with claim 7, said determining an authentication data requirement step further comprising adjusting the determined risk level according to a risk level adjustment for the transaction.

11. A method for authenticating users in accordance with claim 7, said validating step comprising comparing biometric data captured from the user against user biometric data with the processor, wherein the captured and user biometric data correspond to the authentication data requirement.

12. A method for authenticating users in accordance with claim 7, said validating step comprising comparing biometric data captured from the user against corresponding user biometric data with a second processor remote from the processor.

13. A method for authenticating users in accordance with claim 7, said determining an authentication data requirement step comprising comparing the determined risk level against an authentication policy with the processor to determine a matching risk level, wherein the authentication data requirement corresponds to the matching risk level.

14. A method for authenticating users in accordance with claim 7, said determining an authentication data requirement step comprising comparing the determined risk level against an authentication policy with a second processor remote from the processor, wherein the authentication data requirement corresponds to the matching risk level.

15. A method for authenticating users in accordance with claim 7, wherein:

said validating step comprises comparing biometric data captured from the user against corresponding user biometric data with the processor, the processor being included in an authentication system; and

said determining an authentication data requirement step comprises comparing the determined risk level against an authentication policy with a second processor included in a communications device, the communications device being remote from the authentication system.

16. A method for authenticating users comprising:

determining a risk level for a transaction desired to be conducted by a user and including the determined risk level in an authentication request;

extracting the risk level from the authentication request with a processor; and

determining an authentication data requirement corresponding to the risk level.

17. A method for authenticating users in accordance with claim 16 further comprising conducting the transaction after successfully validating the user with data corresponding to the authentication data requirement.

18. A method for authenticating users in accordance with claim 17 further comprising:

conducting a first authentication transaction with face biometric data captured from a user to authenticate the user;

conducting a second authentication transaction with authentication data captured from the user to authenticate the user after successfully authenticating the user in the first authentication transaction, the authentication data for the second transaction being different than the authentication data for the first transaction; and

validating the user after the user is successfully authenticated in the second authentication transaction.

19. A method for authenticating users comprising:

conducting, by a processor, a first authentication transaction with face biometric data captured from a user to authenticate the user;

conducting a second authentication transaction with authentication data captured from the user to authenticate the user after successfully authenticating the user in the first authentication transaction, the authentication data for the second transaction being different than the authentication data for the first transaction; and

validating the user after the user is successfully authenticated in the second authentication transaction.