Caller validation

• US 9,521,141 B2
• Filed: 02/12/2014
• Issued: 12/13/2016
• Est. Priority Date: 02/12/2014
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Pillay, Sanjay
• Primary Examiner(s): MOORTHY, ARAVIND K
• Application Number:
  US14/179,228
• Publication Number:
  US 20150229631A1
• Time in Patent Office: 1,035 Days
• Field of Search: 726/4, 726/5, 713/169, 713/182
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A computer system supports a validation system that enables a business client to validate a business associate who has called the client using a pass phrase. The computer system manages one or more pass phrases that have been previously configured by the business client. The client can then challenge a caller (the purported business associate) with the phrase or keyword to make sure the caller is actually the authorized business associate before providing any sensitive information. Management of phrases and/or keywords may include a computer-executable process where in the client may set up phrases (for example, a challenge question and a corresponding answer) or keyword through an on-line application, telephone, e-mail or any other suitable communication mechanism. The business client may have an option to change, delete or create phrases and/or keywords at any time through appropriate security measures.

Claims

1. An apparatus comprising:

at least one memory device;

at least one data storage device;

at least one processor coupled to the at least one memory device and configured to perform, based on instructions stored in the at least one memory device;

configuring a pass phrase based on a first input from an intended business client to a business associate;

storing phrase information in the at least one data storage device, wherein the phrase information is indicative of the pass phrase and wherein the pass phrase comprises a valid challenge question and a corresponding answer;

initiating, by the apparatus, a communication connection from the business associate to a called business client;

in response to a challenge request from the called business client to the business associate over the communication connection, retrieving the phrase information from the at least one data storage device based on the challenge request;

determining, from the retrieved phrase information, whether the challenge request from the called business client comprises the valid challenge question based on the first input from the intended business client;

in response to the determining, generating an indicator indicative whether the called business client is the intended business client; and

sending, by the apparatus, a responding answer from the business associate to the intended business client, wherein a degree of trust of the business associate is established with the intended business client based on the corresponding answer to the valid challenge question, and wherein the indicator is indicative that the called business client is the intended business client.

2. The apparatus of claim 1, wherein the at least one processor is further configured to perform:

retrieving, from the at least one data storage device, a destination identification for the intended business client; and

initiating the communication connection from the business associate to the called business client using the destination identification.

3. The apparatus of claim 1, wherein the at least one processor is further configured to perform:

receiving the phrase information from the intended business client, wherein the phrase information includes a first answer to a first question;

determining whether the intended business client is valid before accepting the phrase information; and

in response to the determining, storing the phrase information in the at least one data storage device.

4. The apparatus of claim 3, wherein the at least one processor is further configured to perform:

repeating the receiving, the determining, and the storing for a second question and a second answer configured by the intended business client.

5. A computer-assisted method for validating a caller for a called person, the method comprising:

configuring a first pass phrase from a first input from an intended business client to a business associate;

storing first phrase information in the at least one data storage device, wherein the first phrase information is indicative of the first pass phrase and wherein the first pass phrase comprises a first valid challenge request and a first corresponding response;

initiating a communication connection from the business associate to a called business client;

in response to a received challenge request from the called business client to the business associate over the communication connection, retrieving the first phrase information from the at least one data storage device based on the received challenge request;

determining, from the retrieved phrase information, whether received challenge request from the called business client comprises the first valid challenge request, wherein the first valid challenge request was previously configured by the intended business client;

in response to the determining, generating an indicator indicative whether the called business client is the intended business client; and

when the indicator is indicative that the called business client is the intended business client, sending a responding answer from the business associate to the intended business client, wherein a degree of trust of the business associate is established with the intended business client based on the first corresponding response to the first valid challenge request.

6. The method of claim 5, further comprising:

configuring a second pass phrase based on a second input from the intended business client.

7. The method of claim 6, further comprising:

retrieving second phrase information indicative of a second pass phrase, wherein;

the business associate receives a second challenge request from the intended business client over the communication connection to provide a second challenge response that matches with the second pass phrase.

8. The method of claim 5, further comprising:

when a challenge response does not match with the first pass phrase, receiving, from the intended business client, a configuration request to reset the first pass phrase; and

retrieving reset information indicative of the reset first pass phrase, wherein;

the business associate receives a subsequent challenge request from the intended business client to provide a subsequent challenge response that matches with the reset first phrase; and

the business associate provides the reset first challenge response based on the retrieved reset information via the communication connection.

9. The method of claim 5, wherein:

the configuring comprises receiving a first answer to a first question;

the first received challenge request includes the first question;

the retrieving comprises obtaining the first answer; and

the first corresponding challenge response includes the first answer.

10. The method of claim 9, wherein:

the first answer comprises a representation of a speech waveform of the intended business client articulating the first answer; and

the first corresponding response comprises the representation of the speech waveform.

11. The method of claim 9, further comprising:

receiving, from the intended business client, contents indicative of the first question, wherein the intended business client is able to personalize the first question.

12. The method of claim 9, further comprising:

modifying the first answer to the first question.

13. The method of claim 9, further comprising:

deleting the first answer and the first question; and

creating a different answer to a different question.

14. The method of claim 5, wherein the configuring comprises:

receiving a speech waveform indicative of a first answer to a first question; and

converting the speech waveform to the first information.

15. The method of claim 14, wherein the first phrase information comprises a textual converted representation of the speech waveform.

16. The method of claim 5, wherein the configuring comprises:

verifying the intended business client before accepting the first input from the intended business client.

17. The method of claim 5, wherein:

the configuring comprises uploading graphical content from information provided by the intended business client;

the first received challenge request is directed to the graphical content; and

the retrieving comprises displaying the graphical content that is indicative of the first pass phrase.

18. A non-transitory computer-readable storage medium storing computer-executable instructions that, when executed, cause a processor at least to perform operations comprising:

configuring a first pass phrase from a first input from a intended business client to a business associate, wherein the first pass phrase comprises a first valid challenge question and a first answer;

storing first phrase information in at least one data storage device, wherein the first phrase information is indicative of the first pass phrase;

retrieving, from the at least one data storage device, a destination identification for the intended business client;

initiating a communication connection from the business associate to a called business client using the destination identification;

receiving, by the business associate from the called business client, a challenge request;

in response to the receiving, retrieving the first phrase information from the at least one data storage device based on the challenge request;

determining, from the retrieved first phrase information, whether the challenge request from the called business client comprises the first valid challenge question based on the first input from the intended business client;

in response to the determining, generating an indicator indicative whether the called business client is the intended business client;

in response to the retrieving, responding, by the business associate, with the first answer to the intended business client over the communication connection; and

sending, by the apparatus, a responding answer from the business associate to the intended business client, wherein a degree of trust of the business associate is established with the intended business client based on the first answer to the first valid challenge question, and wherein the indicator is indicative that the called business client is the intended business client.

19. The non-transitory computer-readable storage medium of claim 18, wherein the computer-executable instructions, when executed, cause the processor to perform:

configuring a second pass phrase from a second input from the intended business client; and

retrieving second phrase information indicative of a second pass phrase, wherein;

the business associate receives a second challenge question from the intended business client over the communication connection to provide a second challenge response matching with the second pass phrase.

20. The non-transitory computer-readable storage medium of claim 18, wherein the computer-executable instructions, when executed, cause the processor to perform:

when a challenge response does not match with the first pass phrase, receiving, from the intended business client, a configuration request to reset the first pass phrase; and

retrieving reset information indicative of the reset first pass phrase, wherein;

the business associate receives a subsequent challenge request from the intended business client to provide a subsequent challenge response that matches with the reset first phrase; and

the business associate provides the subsequent challenge response based on the retrieved reset information via the communication connection.