Multi-factor authentication techniques

• US 9,578,022 B2
• Filed: 03/13/2013
• Issued: 02/21/2017
• Est. Priority Date: 08/21/2001
• Status: Expired due to Term

• Current Assignee: Smartcom Labs OY
• Original Assignee: Bookit Oy Ajanvarauspalvelu
• Inventors: Salonen, Jukka
• Primary Examiner(s): Shepperd, Eric W
• Application Number:
  US13/800,641
• Publication Number:
  US 20140282958A1
• Time in Patent Office: 1,441 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

An authentication technique with a teaching phase and authentication phase. In the teaching phase, authentication information is collected for a user in at least two categories, wherein one category relates to measurable physical characteristics of the user, another category relates to communication resources available to the user; and a third category relates to knowledge possessed by the user. In the authentication phase, some of the collected authentication information is used to formulate challenge(s) for presentation to the user. Response(s) to the formulated challenge(s) is/are received from the user and correctness of the received response is determined based at least partially on comparison with at least a portion of the collected authentication information. A correctness metric is calculated for the response(s). The user is authenticated if the correctness metric meets or exceeds a first threshold value.

Claims

1. A data processing system comprising:

a memory that stores program code instructions and data;

a processing system including at least one processing unit, wherein the processing system executes at least a portion of the program code instructions and processes the data;

wherein the memory includes at least one authentication element executable by the processing system, wherein the at least one authentication element instructs the processing system to;

perform at least one teaching phase with respect to at least one user, wherein, in the at least one teaching phase, authentication information is collected for the user in at least two of the following at least three categories;

a first category on measurable physical characteristics of the user including at least image data for an image of the user performing at least one physical gesture;

a second category on communication resources provided by a mobile device associated with the user; and

a third category on knowledge possessed by the user, and

perform at least one authentication phase with respect to the at least one user, wherein, the at least two categories of collected authentication information comprises at least the first category,

wherein, in the at least one authentication phase, at least a portion of the collected authentication information is used to formulate at least one challenge for presentation to the user,

wherein at least one response to the formulated challenge is received from the user and correctness of the received response is determined based at least partially on comparison with at least a portion of the collected authentication information,

wherein at least one correctness metric is calculated for the at least one response received from the user; and

wherein the user is authenticated if the at least one calculated correctness metric meets or exceeds a first threshold value.

2. The data processing system of claim 1, wherein the user is an authentication subject whose identity is to be authenticated by the data processing system.

3. The data processing system of claim 2, wherein the memory includes at least one authentication element executable by the processing system, wherein the at least one authentication element is implemented in part on a server accessible to multiple users and at least one mobile device associated with the user to be authenticated.

4. The data processing system of claim 2, wherein the at least one authentication element operates in the mobile device associated with the user to be authenticated.

5. The data processing system of claim 1, wherein the user is associated with a mobile device having at least one network address.

6. The data processing system of claim 1, wherein the processing system includes at least one server accessible to multiple users with respective mobile devices and the at least one authentication element operates in the at least one server.

7. The data processing system of claim 1, wherein the first threshold value is based on a value and/or nature of a transaction for which the user'"'"'s identity is to be authenticated.

8. The data processing system of claim 1, wherein the first threshold value is based on a prior history of the user.

9. The data processing system of claim 1, wherein the at least one authentication element instructs the processing system to:

in the at least one teaching phase, collect authentication information for the user in three of the at least three categories; and

in the at least one authentication phase, use the collected authentication information in three of the at least three categories.

10. The data processing system of claim 9, wherein the at least one authentication element instructs the processing system to collect and use the authentication information in at least three of the at least three categories if a value and/or nature of a transaction meets a set of predetermined criteria.

11. The data processing system of claim 1, wherein the at least one authentication element instructs the processing system to randomly select at least one category to be used in the at least authentication phase.

12. The data processing system of claim 1, wherein the authentication information in the first category further comprises at least one of biometric information and voice characteristics.

13. The data processing system of claim 12, wherein the biometric information comprises at least image data captured by the mobile device associated with the user.

14. The data processing system of claim 13, wherein the voice characteristics comprises at least one voice recording captured by the mobile device associated with the user.

16. The data processing system of claim 12, wherein the at least one authentication element is further configured to:

collect multiple data sets of biometric information;

randomly select at least one of the multiple data sets;

challenge the user to respond with captured image data that corresponds to the selected at least one data set.

17. The data processing system of claim 16, wherein at least some of the data sets comprise image data.

18. The data processing system of claim 1, wherein the authentication information in the second category comprises at least one of:

at least one cellular network address;

multiple different communication channels using the at least one cellular network address;

at least one e-mail address; and

at least one social network address.

19. The data processing system of claim 18, wherein the authentication information in the second category comprises multiple data sets, and wherein the at least one authentication element is configured to randomly select at least one of the multiple data sets.

20. The data processing system of claim 1, wherein the authentication information in the third category comprises at least one of:

username/password/PIN code;

factual questions/answers;

user'"'"'s location; and

timing information.

21. The data processing system of claim 1, wherein the authentication information in the third category comprises multiple data sets and the at least one authentication element is configured to randomly select at least one of the multiple data sets.

22. The data processing system of claim 1, wherein the authentication of the user'"'"'s identity is valid for only a specific place and/or time.

23. The data processing system of claim 1, wherein the at least one authentication element instructs the processing system to:

in the at least one teaching phase, associate at least one piece of authentication information to an indication of emergency; and

in the at least one authentication phase, respond to detection of the indication of emergency by notifying at least one authority of the emergency.

24. The data processing system of claim 1, wherein the communication resources provided by the mobile device associated with the user comprise at least one telecommunication resource.

25. The data processing system of claim 24, wherein the at least one telecommunication resource comprises authentication information, which is varied in a manner that is unpredictable by outsiders.

26. The data processing system of claim 25, wherein the varied authentication information comprises at least one address of the user'"'"'s mobile device in a mobile communication network.

27. The data processing system of claim 25, wherein the varied authentication information comprises at least one link to a further network address.

28. The data processing system of claim 25, wherein the varied authentication information comprises at least one communication channel.

29. The data processing system of claim 1, wherein, the at least two categories of collected authentication information comprises at least the second category.

15. The data processing system of 12, wherein the biometric information comprises image data associated with at least one of a user'"'"'s face, and a user'"'"'s iris.

30. A method comprising:

storing program code instructions and data in a memory;

executing at least a portion of the program code instructions and processing at least a portion of the data by a processing system that includes at least one processing unit;

wherein said executing instructs the processing system to;

perform at least one teaching phase with respect to at least one user, wherein, in the at least one teaching phase, authentication information is collected for the user in at least two of the following at least three categories;

a first category on measurable physical characteristics of the user including at least image data for an image of the user performing at least one physical gesture;

a second category on communication resources provided by a mobile device associated with the user; and

a third category on knowledge possessed by the user,

perform at least one authentication phase with respect to the at least one user,

wherein, the at least two categories of collected authentication information comprises at least the first category,

wherein, in the at least one authentication phase, at least a portion of the collected authentication information is used to formulate at least one challenge for presentation to the user,

wherein at least one response to the formulated challenge is received from the user and correctness of the received response is determined based at least partially on comparison with at least a portion of the collected authentication information,

wherein at least one correctness metric is calculated for the at least one response received from the user, and

wherein the user is authenticated if the at least one calculated correctness metric meets or exceeds a first threshold value.

31. The method of claim 30, wherein, the at least two categories of collected authentication information comprises at least the second category.

32. A non-transitory memory device comprising program code instructions and data, wherein executing at least a portion of the program code instructions and processing at least a portion of the data by a processing system that includes at least one processing unit instructs the processing system to:

perform at least one teaching phase with respect to at least one user, wherein, in the at least one teaching phase, authentication information is collected for the user in at least two of the following at least three categories;

a first category on measurable physical characteristics of the user including at least image data for an image of the user performing at least one physical gesture;

a second category on communication resources provided by a mobile device associated with the user; and

a third category on knowledge possessed by the user, and

perform at least one authentication phase with respect to the at least one user,

wherein, the at least two categories of collected authentication information comprises at least the first category,

wherein, in the at least one authentication phase, at least a portion of the collected authentication information is used to formulate at least one challenge for presentation to the user,

wherein at least one response to the formulated challenge is received from the user and correctness of the received response is determined based at least partially on comparison with at least a portion of the collected authentication information,

wherein at least one correctness metric is calculated for the at least one response received from the user, and

wherein the user is authenticated if the at least one calculated correctness metric meets or exceeds a first threshold value.

33. The non-transitory memory device of claim 32, wherein, the at least two categories of collected authentication information comprises at least the second category.

34. A data processing system comprising:

a memory that stores program code instructions and data;

a processing system including at least one processing unit, wherein the processing system executes at least a portion of the program code instructions and processes the data;

wherein the memory includes at least one authentication element that is implemented in part on a server accessible to multiple users and at least one mobile device associated with a user, the user being an authentication subject whose identity is to be authenticated by the data processing system, wherein the at least one authentication element executable by the processing system instructs the processing system to;

perform at least one teaching phase with respect to at least one user, wherein, in the at least one teaching phase, authentication information is collected for the user in at least two of the following at least three categories;

a first category on measurable physical characteristics of the user including at least image data for an image of the user performing at least one physical gesture;

a second category on communication resources provided by a mobile device associated with the user; and

a third category on knowledge possessed by the user;

wherein, the at least two categories of collected authentication information comprises the first category;

perform at least one authentication phase with respect to the at least one user,

wherein, in the at least one authentication phase, at least a portion of the collected authentication information is used to formulate at least one challenge for presentation to the user,

wherein at least one response to the formulated challenge is received from the user and correctness of the received response is determined based at least partially on comparison with at least a portion of the collected authentication information,

wherein at least one correctness metric is calculated for the at least one response received from the user; and

wherein the user is authenticated if the at least one calculated correctness metric meets or exceeds a first threshold value.

35. The data processing system of claim 34, wherein, the at least two categories of collected authentication information comprises at least the second category.