US20090228370A1 - Systems and methods for identification and authentication of a user - Google Patents

Systems and methods for identification and authentication of a user Download PDF

Info

Publication number
US20090228370A1
US20090228370A1 US12/470,203 US47020309A US2009228370A1 US 20090228370 A1 US20090228370 A1 US 20090228370A1 US 47020309 A US47020309 A US 47020309A US 2009228370 A1 US2009228370 A1 US 2009228370A1
Authority
US
United States
Prior art keywords
user
merchant
account number
computer
username
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US12/470,203
Inventor
Rajesh G. Shakkarwar
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Verient Inc
Original Assignee
Verient Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Verient Inc filed Critical Verient Inc
Priority to US12/470,203 priority Critical patent/US20090228370A1/en
Publication of US20090228370A1 publication Critical patent/US20090228370A1/en
Assigned to VERIENT, INC. reassignment VERIENT, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: SHAKKARWAR, RAJESH G.
Abandoned legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/40Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/409Device specific authentication in transaction processing
    • G06Q20/4097Device specific authentication in transaction processing using mutual authentication between devices and transaction partners
    • G06Q20/40975Device specific authentication in transaction processing using mutual authentication between devices and transaction partners using encryption therefor
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/30Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/341Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/40Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/40Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401Transaction verification
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00Commerce
    • G06Q30/018Certifying business or products
    • G06Q30/0185Product, service or business identity fraud
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00Commerce
    • G06Q30/06Buying, selling or leasing transactions
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00Commerce
    • G06Q30/06Buying, selling or leasing transactions
    • G06Q30/0601Electronic shopping [e-shopping]
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • GPHYSICS
    • G07CHECKING-DEVICES
    • G07FCOIN-FREED OR LIKE APPARATUS
    • G07F7/00Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/10Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
    • G07F7/1008Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
    • GPHYSICS
    • G07CHECKING-DEVICES
    • G07FCOIN-FREED OR LIKE APPARATUS
    • G07F7/00Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/10Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
    • G07F7/1025Identification of user by a PIN code

Definitions

  • the present invention generally relates to computer security and more specifically to systems and methods for identifying and authenticating a user.
  • the buyer simply types a credit card number into an on-line payment webpage to pay for the goods or services provided by an on-line merchant.
  • the buyer uses an on-line payment service to pay for the goods or services provided by an on-line merchant.
  • the on-line payment service allows the buyer to pay the on-line merchant via the Internet using funds that are available in a bank account or on a credit card.
  • the on-line payment service holds the account information, not the on-line merchant, and therefore the on-line payment service may protect the buyer from unlawful use of the buyer's account.
  • on-line payment services are effective in providing a more secure means of on-line payment between the buyer and the on-line merchant as compared to paying by a credit card number or a personal check
  • on-line payment services typically require a single factor of authentication to verify that the buyer is actually the owner of the account.
  • the on-line payment service may require the buyer to input an email address and a password to make an on-line payment.
  • the single factor of authentication such as the email address and password, can be easily stolen by a computer hacker. This may result in the unlawful use of the buyer's account, which is a common form of identity theft.
  • On-line banking allows a customer to perform routine transactions, such as account transfers, balance inquiries, bill payments, and stop-payment requests from a remote computer.
  • some banks allow their customers to apply for loans and credit cards on-line as well.
  • a bank Similar to on-line payment services, to access the account information or apply for a loan or a credit card on-line, a bank usually requires only one factor of authentication to verify that an on-line customer is actually the owner of the account. For example, the bank may require the customer to input a username and a password to access the account. Again, the single factor of authentication, such as the username and password, can be easily stolen by a computer hacker, which may result in the unlawful use of the customer's account.
  • the present invention generally relates to a computer security system for use in the identification and authentication of a user prior to an on-line transaction.
  • a method for facilitating a secure transaction over a network includes collecting a username and password associated with a user of the machine. The method further includes verifying that the username and password matches a previously collected username and password in an identity profile. The method also includes collecting device data from a user machine to uniquely identify the machine. Additionally, the method includes verifying that the device data matches previously collected device data in the identity profile.
  • a computer-readable medium including a set of instructions that when executed by a processor cause the processor to facilitate a secure transaction over a network.
  • the processor performs the step collecting a username and password associated with a user of the machine.
  • the processor also performs the step of transmitting the username and password to a server machine in order to verify that the username and password matches a previously collected username and password in an identity profile.
  • the processor performs the step of collecting device data from a user machine to uniquely identify the machine.
  • the processor performs the step of transmitting the device data to the server machine in order to verify that the device data matches a previously collected device data in the identity profile.
  • a system for facilitating a secure transaction includes a computing device having a processor and a memory, wherein the memory includes a security agent program configured to collect a username and password associated with a user of the computing device and transmit the username and password.
  • the security agent is also configured to collect device data from the computing device to uniquely identify the computing device and transmit the device data.
  • the system further includes a server machine that includes a user profiles database and configured to receive the username and password from the computing device and verify that the username and password matches previously collected username and password in the identity profile stored in user profiles database.
  • the server machine is further configured to receive the device data from the computing device and verify that the device data matches previously collected device data in an identity profile stored in user profiles database.
  • FIG. 1 is a conceptual block diagram of a system configured to identify and authenticate the identity of a user, according to one embodiment of the invention.
  • FIG. 2 is a flow chart of method steps for enrolling a user in a security service, according to one embodiment of the invention.
  • FIG. 3 is a flow chart of method steps for securely accessing a user account, according to one embodiment of the invention.
  • FIGS. 4A and 4B are a flow chart of method steps for making a secured payment, according to one embodiment of the invention.
  • FIG. 5 is a conceptual block diagram of a system through which a secured payment may be made, according to one embodiment of the invention.
  • FIGS. 6-8 are conceptual illustrations depicting how the security agent of FIG. 1 interacts with a merchant payment web page when a secured payment is made, according to one embodiment of the invention.
  • the invention relates to a computer security system for use in the identification and authentication of a user prior to an on-line transaction.
  • the system will be described herein in relation to a single user. However, it should be understood that the systems and methods described herein may be employed with any number of users without departing from the principles of the present invention.
  • the description of the invention is separated into four sections: the architecture, the enrollment process, a secure access transaction, and a secure payment transaction.
  • FIG. 1 is a conceptual block diagram of a system 100 configured to identify and authenticate the identity of a user, according to one embodiment of the invention.
  • the system 100 includes a user machine 105 , which may be any type of individual computing device such as, for example, a desk-top computer, a lap-top computer, a hand-held phone device, or a personal digital assistant.
  • the user machine 105 is configured to be a communication link between the user and the other components in the system 100 .
  • the user machine 105 includes a security agent 110 .
  • the security agent 110 is a software entity that runs on the user machine 105 .
  • the security agent 110 is configured to create an identity profile 115 of a user and of user machine 105 , collect certain data from the user machine 105 or manage secure access or secure payment transactions made from user machine 105 . Additionally, the security agent 110 is designed to offer protection against phishing, pharming, Trojan programs or worms.
  • the user machine 105 includes the profile 115 , which represents the identity of the user.
  • the profile 115 is unique for each user. As described in further detail herein, once the profile 115 has been created for the user, the identity of the user can be subsequently verified by a series of interactions between the security agent 110 and the authentication server 125 based on the profile 115 .
  • the profile 115 includes data about the user and the user machine 105 and can be used to establish a multifactor identification for the user whenever the user attempts to conduct transactions via the user machine 105 .
  • the first factor of authentication is a username and/or password, which relates to “what the user knows.”
  • the second factor of authentication is unique information about the user machine 105 , which relates to “what the user has.”
  • the third factor of authentication is unique information about the user, such as biometric identity, which relates to “who the user is.”
  • the username and/or password is created by the user after the identity of the user is established.
  • the username and/or password are typically a combination of characters and numbers, which the user can easily remember.
  • the user machine 105 transmits the username and/or password in a cryptographically protected form, so access to the actual username and/or password will be difficult for a snooper who gains internal access to the user machine 105 .
  • the unique information about the user machine 105 is generally a combination of select information associated with the user machine 105 .
  • the information may be static or dynamic.
  • the information may include the International Mobile Equipment Identity (IMEI), which is a number unique to every mobile phone, the International Mobile Subscriber Identity (IMSI), which is a unique number associated with network mobile phone users, and/or the geolocation of the user machine 105 , which is a real-world geographic location of a network connected computer or mobile device.
  • IMEI International Mobile Equipment Identity
  • IMSI International Mobile Subscriber Identity
  • the information about the user machine 105 may also include machine-level attributes.
  • the information may include various parameters available through a PCI configuration space, like the Device ID or the Vendor ID for different system devices, the data residing in the SMM memory space, or other memory hardware attributes, such as memory type, memory clock speed, amount of memory, hard drive serial number, size of hard drive, maker of hard drive etc., and/or chipset information or graphics card information, which can be used to read hidden and/or unhidden registers within those subsystems.
  • the information may include data at different locations in firmware or BIOS or information available in a Microcode patch or a checksum of a portion of the firmware within the user machine 105 .
  • the information about the user machine 105 may also be system-level attributes.
  • the information may include a MAC address, hard drive serial number, hardware configuration information, such as interrupt routing, GPIO routing, PCI Device Select routing or a hardware configuration map, operating system registry, CPU type, CPU version or CPU clock speed.
  • the information about the user machine 105 may also include system pattern extraction.
  • the information may include a directory structure and/or a list of installed applications, such as a word processor or other computer tools.
  • the third factor of authentication consists of unique information about the user, such as a biometric identity.
  • the biometric data may include the specific typing pattern of the user since each user's typing behavior is unique. Typically, typing authentication works by requesting that a user seeking access to a computer or a password-protected file just type a short passage into the computer so that the user's typing pattern can be analyzed and matched against a known pattern. Additionally, the biometric data may also be generated by a biometric device, such as a fingerprint device or an iris pattern device, included within the user machine 105 .
  • the system 100 further includes a network 120 , which may be any type of data network, such as a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), or the Internet.
  • the network 120 is configured to act as a communication pathway between the user machine 105 , the authentication server 125 , and an institution server 140 .
  • the authentication server 125 stores a copy of the profile 115 generated during the enrollment process in a user profiles database 130 . Additionally, the authentication server 125 interacts with the agent 110 via the network 120 during the secure access transaction and the secure payment transaction, as described below.
  • the institution server 140 stores sensitive information for the user e.g. financial account information, confidential data, etc.
  • the institution server 140 may be part of a bank, a building society, a credit union, a stock brokerage, or other businesses holding sensitive data. Generally, the institution server 140 interacts with the agent 110 via the network 120 during the enrollment process, a secure access transaction or a secure payment transaction, as described below.
  • FIG. 2 is a flow chart of method steps for enrolling a user in a security service, according to one embodiment of the invention.
  • the enrollment process 200 is used to verify the identity of the user, establish multi-factors of authentication and bind the verified identity of the user to the multi-factors of authentication.
  • verifying the user identity during the enrollment process 200 may include having the user answer specific personal questions e.g. amount of last check deposited, date of last withdrawal, previous residential address, etc.
  • the answers are then checked against a known answer from a data source, such as the institution and/or third party consumer data base to verify that the user is who the user claims to be.
  • a data source such as the institution and/or third party consumer data base
  • Some examples of the multi factors of authentication are—the identification of the user, the identification of the machine, the biometric identity of the user, etc.
  • the enrollment process is a one-time process for each user. After the enrollment process 200 is complete, the user is able to perform the secure access transaction 300 or the secure payment transaction 400 , described below, without having to repeat the enrollment steps.
  • the process of verifying identity significantly reduces the chance of a malicious party claiming to be the user.
  • the process of binding the verified identity to the multi-factors of authentication eliminates the cumbersome process of proving the identity of the user at every transaction while providing the same level of security as though the user answered the identity questions, such as the specific personal questions each time.
  • the enrollment process 200 begins in step 205 , where the user accesses an enrollment webpage.
  • the enrollment webpage is generated by the institution server 140 and downloaded to the user machine 105 when the user attempts to electronically access an account held with the institution.
  • the enrollment webpage is configured to educate the user about the enrollment process and subsequently start the user identification process of step 210 .
  • step 210 the user is asked specific personal questions in which only the user knows the answer in order to generate a verified user identity.
  • the questions may relate to dynamic data that frequently changes and is known only by the institution, such as “when was your last deposit,” “what was the last check number,” “who was the check written to” or “who last deposited money in the financial institution”, “what was your last take home pay amount.”
  • the personal questions may relate to static data that does not change, such as “what car did you drive before your current car,” “what is your social security number, date of birth, mother's maiden name” or “what address did you live at before your current address.”
  • step 215 the answers given by the user is compared to known answers in a data source, such as data at the institution or data held at third party data bases, to verify the identity of the user.
  • an exception process is activated.
  • the exception process may include a verification of the user over the phone. Additionally, the exception process may include the user making a personal appearance at a specific location.
  • the exception process in step 220 may be any type of process known in the art to verify the identity of the user.
  • the security agent 110 is downloaded to the user machine 105 after the identity of the user is established.
  • the security agent 110 is downloaded directly from the institution server 140 via the network 120 .
  • the security agent 110 is downloaded via the network 120 from the authentication server 125 .
  • the security agent 110 is configured to interact with both the authentication server 125 and the institution server 140 .
  • a user name and password is selected to establish the first factor of authentication.
  • the user selects the user name and password.
  • the authentication server 125 or the institution sever 140 generates the user name and/or the password.
  • the user name and/or password are used during the secure access transaction 300 and the secure payment transaction 400 , described below.
  • the information may include any number of different types of data associated with the user machine 105 .
  • the information may include the IMEI or the IMSI which relate to mobile devices.
  • the information may include the geolocation of the user machine 105 .
  • the information may also include machine level attributes, such as a Device ID, a Vendor ID, data at a SMM memory space, a memory type, a memory clock, hard drive serial number, chipset information, data at different locations in firmware, or information available in Microcode patch, a checksum of firmware, or BIOS.
  • the information may include system level attributes, such as a MAC address, a hard drive serial number, interrupt routing, GPIO routing, PCI DevSel routing, a map of hardware configuration, or an operating system registry. Additionally, the information may relate to system pattern extraction, such as a directory structure or a list of installed applications. No matter what type of select data is extracted from the user machine 105 , the data or a combination of different types of data should be unique to the user machine 105 in order to establish the second factor of authentication.
  • system level attributes such as a MAC address, a hard drive serial number, interrupt routing, GPIO routing, PCI DevSel routing, a map of hardware configuration, or an operating system registry.
  • system pattern extraction such as a directory structure or a list of installed applications. No matter what type of select data is extracted from the user machine 105 , the data or a combination of different types of data should be unique to the user machine 105 in order to establish the second factor of authentication.
  • the biometric information is collected in order to establish the third factor of identity.
  • the biometric data may include specific typing patterns of the user or biometric data generated by a biometric device, such as a fingerprint device or an iris pattern device.
  • step 245 the verified user identity from step 215 is connected (or bound) to the user identity profile 115 which generally comprises the data collected in steps 230 - 240 .
  • the connecting (or binding) of the verified user identity to the factors of authentication allows the user to engage in the secure access transaction 300 or the secure payment transaction 400 without having to repeat the enrollment steps.
  • the binding of the identity with the factors of authentication eliminates the cumbersome process of proving the identity of the user at every transaction while providing the same level of security as though the user answered the identity questions (the specific personal questions) every time.
  • a copy of the profile 115 is stored in the user profiles database 130 in the authentication server 125 .
  • the security agent 110 interacts with the authentication server 125 by comparing the data from the user and the user machine with the user profile 115 stored in the user profiles database 130 to establish the identity of the user before proceeding with the transaction.
  • the user is able to use the secure access transaction 300 and the secure payment transaction 400 without providing any sensitive personal data, such as a credit card number, a debit card number, etc.
  • the user interacts directly with an institution to verify the identity of the user. Then the institution issues a one-time credential, such as an account number and/or password. The one-time credential is used during the authentication process of the user to establish the identity of the user before proceeding with the secure access transaction 300 or the secure payment transaction 400 .
  • FIG. 3 is a flow chart of method steps for securely accessing a user account, according to one embodiment of the invention.
  • the secure access transaction 300 is a transaction where the user attempts to electronically access an account held at the institution via the institution server 140 .
  • an institution may be a financial institution, a government agency, a medical institution or a business.
  • the security agent 110 interacts with the authentication server 125 via the network 120 to ensure that the user is properly authenticated prior to giving the user access to the relevant accounts held at the institution.
  • the secure access transaction 300 begins with the security agent 110 interacting with the user at a log-on webpage of the institution.
  • the security agent 110 automatically activates after the security agent 110 detects the log-on webpage of the institution.
  • the security agent may detect the institution log-on webpage by reading the source code of the webpage, such as the HTML code or by reading a trigger, such as a header or an identification number embedded in the log-on webpage.
  • the user activates the security agent 110 to perform the secure access transaction 300 .
  • the user may select a button on the webpage to activate the security agent 110 .
  • the institution activates the security agent 110 and requires the user to use the security agent 110 during the secure access transaction 300 .
  • the security agent 110 prompts the user to enter his or her username and/or password in order to determine the first factor of authentication.
  • the username and/or password entered in step 305 is compared to the username and/or password previously stored in the user profiles database 130 . If the username and/or password does not match the user profile in the user profiles database 130 , then an exception process is activated in step 315 to determine that the user is who the user claims to be.
  • the exception process in step 315 may be any type of standard industry process known in the art to aid a user who has forgotten a user name and/or password. For instance, the exception process may include requiring the user to go through the enrollment process 200 again to create a new user name and/or password. The exception process may also include having the user answer a security question in order to determine that the user is who the user claims to be.
  • the exception process may also include sending the user name and/or password to a user email address or sending a text message to a user cellphone.
  • the security agent 110 collects information which is associated with the user machine 105 in order to establish the second factor of authentication.
  • the information associated with the user machine 105 may include a variety of different information, such as information related to the IMEI, the IMSI, the geolocation, machine level attributes, system level attributes, or system pattern extraction.
  • the security agent 110 collects biometric information from the user in order to establish the third factor of identity.
  • the biometric data may include specific typing patterns of the user or biometric data generated by a biometric device, such as a fingerprint device or an iris pattern device.
  • a biometric device such as a fingerprint device or an iris pattern device.
  • the authentication server 125 verifies that the identity data collected in steps 320 and 325 matches the data included in the user profile previously stored in the user profiles database 130 on the authentication server 125 . If the identity data collected in steps 320 and 325 does not match the user profile in the user profiles database 130 , then an exception process is activated in step 340 . Depending on the type of mismatch, the exception process in step 340 may include limited access to the account or the exception process may require the collection of additional data or that the user to go through the enrollment process 200 again.
  • the user may still be allowed access to the account after collecting additional data. If there is a large mismatch, then the user may be required to go through the enrollment process 200 again in order to establish the identity of the user and the factors of authentication. If the identity data collected in steps 320 and 325 does match the user profile in the user profiles database 130 , then the user is allowed access in step 345 to the account at the institution.
  • FIGS. 4A and 4B are a flow chart of method steps for making a secure payment
  • FIG. 5 is a conceptual block diagram of a system 500 through which a secure payment may be made, according to one embodiment of the invention.
  • the secure payment transaction 400 is a transaction where the user purchases a product or a service from an on-line merchant 505 .
  • the security agent 110 interacts with the authentication server 125 via the network 120 to ensure that the user is properly identified and authenticated prior to the user finalizing the purchase of the product or the service from the on-line merchant 505 .
  • the security agent 110 also is configured to interact with the different elements of system 500 to facilitate the actual on-line payment.
  • the institution server 140 is represented as a user financial institution server.
  • the secure payment transaction 400 begins with the security agent 110 interacting with the user at a payment webpage of the online merchant 505 .
  • the security agent 110 automatically activates after the security agent 110 detects the payment webpage of the online merchant 505 .
  • the security agent may detect the online merchant 505 payment webpage by reading the source code of the webpage, such as the HTML code for credit card information e.g. card type, expiry date, CVV2 code, etc. or by reading a trigger, such as a header or an identification number embedded in the payment webpage.
  • the user activates the security agent 110 to perform the secure payment transaction 400 .
  • the user may select a button on the webpage to activate the security agent 110 .
  • the online merchant 505 activates the security agent 110 and requires the user to use the security agent 110 during the secure payment transaction 400 .
  • the security agent 110 prompts the user to enter his or her username and/or password in order to determine the first factor of authentication.
  • the user enters his or her username and/or password through the standard key entry method of the user machine 105 .
  • the security agent 110 prompts the user to enter a username and/or password directly in a box 615 by using a keypad 610 on the security agent 110 .
  • the keypad 610 is manipulated by using a mouse (not shown) to push the buttons on the keypad 610 . Placing the keypad 610 on the security agent 110 is a security mechanism designed to prevent a keylogger from monitoring and stealing the password.
  • a keylogger may be able to monitor the keystrokes of the user and steal the password.
  • the location of the keys on keypad 610 will systematically change between uses to prevent a mouse logger from monitoring and stealing the password.
  • the security agent 110 directly communicates with the authentication server 125 rather than through a conventional webpage, the threat of “phishing” by presenting the user with bogus webpages is eliminated.
  • the security mechanisms set forth herein may be equally applicable to any transaction that involves the security agent 110 , such as the enrollment process 200 or the secure access transaction 300 .
  • the security agent 110 is also configured to encrypt the data transmissions generated by the security agent 110 as the security agent 110 interacts with other components in the system.
  • the security agent 110 has a cryptographic system that uses two keys, such as a public key that is known by other components in the system 500 and a private key that is known only to the recipient of the data transmission. For instance when the security agent 110 wants to send a secure data transmission to the authentication server 125 , the security agent 110 uses the public key to encrypt the data. The authentication server 125 then uses the private key to decrypt the data.
  • An important element of this cryptographic system is that the public and private keys are related in such a way that only the public key can be used to encrypt data and only the corresponding private key can be used to decrypt the data.
  • the public private key pair may be randomly changed for each session or from time to time.
  • the security mechanisms set forth herein may be equally applicable to any transaction that involves the security agent 110 , such as the enrollment process 200 or the secure access transaction 300 .
  • step 410 the username and/or password entered in step 405 is compared to the username and/or password previously stored in the user profiles database 130 . If the username and/or password does not match the data in the user profiles database 130 , then an exception process is activated in step 415 to determine that the user is who the user claims to be.
  • the exception process in step 415 may be any type of standard industry process known in the art to aid a user who has forgotten a user name and/or password.
  • the exception process may include requiring the user to go through the enrollment process 200 again to create a new user name and/or password.
  • the exception process may also include having the user answer a security question in order to determine that the user is who the user claims to be.
  • the exception process may also include sending the user name and/or password to a user email address or sending a text message to a user cellphone.
  • the security agent 110 collects information which is associated with the user machine 105 in order to establish the second factor of authentication.
  • the information associated with the user machine 105 may include a variety of different information, such as information related to the IMEI, the IMSI, the geolocation, machine level attributes, system level attributes, or system pattern extraction.
  • the security agent 110 collects biometric information from the user in order to establish the third factor of authentication.
  • the biometric data may include specific typing patterns of the user or biometric data generated by a biometric device, such as a fingerprint device or an iris pattern device.
  • the authentication server 125 verifies that the identity data collected in steps 420 and 425 matches the data included in the user profile previously stored in the user profiles database 130 on the authentication server 125 . If the identity data collected in steps 420 and 425 does not match the user profile in the user profiles database 130 , then an exception process is activated in step 440 . Depending on the type of mismatch, the exception process in step 440 may allow a payment of a reduced amount to be made during the secured payment transaction or the exception process may require the user to go through the enrollment process 200 again.
  • the security agent connects to the user financial institution server 140 in step 445 via the network 120 .
  • the security agent 110 requests financial account information from the institution server 140 about the user's account(s) held at the institution.
  • the financial information relates to the different accounts that are available to make a payment to the on-line merchant 505 , such as a savings account or a checking account.
  • the financial information may include credit cards, lines of credit, equity lines of credit, and the like.
  • a bank line of credit can be established during the enrollment process or during the merchant transaction process. The bank line of credit then can be considered a virtual credit card for purposes of the merchant transaction. Therefore, in addition to a conventional credit card, this virtual credit card and/or savings account and/or checking account may be used as a payment means for the on-line transaction in step 460 , below.
  • step 455 the user selects an account for payment in the secure payment transaction 400 .
  • the security agent 110 displays an account list 705 which is a list of accounts available to pay the on-line merchant 505 .
  • the security agent 110 becomes an automatic teller machine, whereby the user selects the account from the list of accounts presented by the security agent 110 , and then the security agent 110 facilitates the payment to the on-line merchant 505 , as discussed below.
  • the authentication server 125 creates a one-time use personal account number which is used in the secured payment transaction 400 .
  • the one-time use personal account number is a sixteen digit number. Similar to the conventional credit card number, the one-time use personal account number includes a number prefix, commonly referred to as Network Identification Number, which is the sequence of digits at the beginning of the number that indicates the entity to which a credit card number belongs.
  • the authentication server 125 creates an expiration date which is used in the secured payment transaction 400 . In another embodiment, the authentication server 125 creates a one time use security code.
  • the one-time use personal account number is entered into the merchant webpage.
  • the security agent 110 populates a payment field 810 of the payment page 625 of the on-line merchant 505 with the one-time use personal account number.
  • the security agent 110 populates an expiration date field 815 of the payment page 625 of the on-line merchant 505 with the expiration date.
  • the security agent 110 may hide data in the payment field 810 with a phrase such as “securepay,” as shown in FIG. 8 .
  • the security agent 110 can hide data in the payment field 810 of the payment page 625 with “*********” reflecting the format of a conventional credit card number.
  • the user may populate the payment field 810 with the one-time use personal account number.
  • the user may populate the expiration date field 815 with the expiration date.
  • the user may select a button on the payment page 625 to input the one-time use personal account number.
  • the utilization of the one-time use personal account number has several benefits.
  • the one-time use personal account number has the same format as a conventional credit card number and therefore the on-line merchant 505 does not have to modify the format of the payment webpage 625 in order to accept the payment from the security agent 110 .
  • Another benefit of the one-time use personal account number is that the personal account number can only be used one time and therefore even if the number is stolen, the personal account number has no value beyond the current transaction. Further, the number cannot be processed through traditional credit card processing networks due to the format of the number.
  • the one-time personal account number is sent to a payment processor 510 .
  • the payment processor 510 extracts server data from the one-time personal account number, such as the Network Identification Number, which is the sequence of digits at the beginning of the one-time use personal account number, in order to determine the personal account number belongs to the authentication server 125 .
  • the payment processor 510 sends the one-time personal account number and transaction details to the authentication server 125 .
  • the transaction details may include the merchant name, the merchant ID, and the amount of the transaction.
  • the authentication server 125 replaces the one-time personal account number with a user real personal account number that relates to the account which the user selected in step 455 .
  • the authentication server 125 sends the real personal account number and the transaction details to the user financial institution for authorization.
  • the user financial institution server 140 verifies that the user account has sufficient funds to cover the payment transaction. If there are insufficient funds in the selected account, then the security agent 110 prompts the user to select another account for payment. If there are sufficient funds in the selected account, then a payment authorization is sent to the payment processor 510 and security agent 110 in step 495 .
  • the institution server 140 interacts with the merchant financial server 515 via the settlement network 520 to transfer the funds from the institution server 140 to the merchant financial server 515 .

Abstract

The present invention generally relates to a computer security system for use in the identification and authentication of a user prior to an on-line transaction. In one aspect, a method for facilitating a secure transaction over a network is provided. The method includes collecting a username and password associated with a user of the machine. The method further includes verifying that the username and password matches a previously collected username and password in an identity profile. The method also includes collecting device data from a user machine to uniquely identify the machine. Additionally, the method includes verifying that the device data matches previously collected device data in the identity profile. In another aspect, a computer-readable medium including a set of instructions that when executed by a processor cause the processor to facilitate a secure transaction over a network is provided. In yet a further aspect, a system for facilitating a secure transaction is provided.

Description

    CROSS-REFERENCE TO RELATED APPLICATIONS
  • This application is a continuation of, and claims priority benefit to, U.S. patent application Ser. No. 11/562,353, filed Nov. 21, 2006, the subject matter of which is hereby incorporated herein by reference.
  • BACKGROUND OF THE INVENTION
  • 1. Field of the Invention
  • The present invention generally relates to computer security and more specifically to systems and methods for identifying and authenticating a user.
  • 2. Description of the Related Art
  • Internet commerce has increased dramatically over the last several years. As a result, several different on-line payment methods have been created. In one payment method, the buyer simply types a credit card number into an on-line payment webpage to pay for the goods or services provided by an on-line merchant. In another payment method, the buyer uses an on-line payment service to pay for the goods or services provided by an on-line merchant. The on-line payment service allows the buyer to pay the on-line merchant via the Internet using funds that are available in a bank account or on a credit card. The on-line payment service holds the account information, not the on-line merchant, and therefore the on-line payment service may protect the buyer from unlawful use of the buyer's account.
  • Even though on-line payment services are effective in providing a more secure means of on-line payment between the buyer and the on-line merchant as compared to paying by a credit card number or a personal check, on-line payment services typically require a single factor of authentication to verify that the buyer is actually the owner of the account. For example, the on-line payment service may require the buyer to input an email address and a password to make an on-line payment. However, the single factor of authentication, such as the email address and password, can be easily stolen by a computer hacker. This may result in the unlawful use of the buyer's account, which is a common form of identity theft.
  • In addition to Internet commerce, many banks now offer on-line banking which allows customers to access their accounts via the Internet. On-line banking allows a customer to perform routine transactions, such as account transfers, balance inquiries, bill payments, and stop-payment requests from a remote computer. In addition, some banks allow their customers to apply for loans and credit cards on-line as well. Similar to on-line payment services, to access the account information or apply for a loan or a credit card on-line, a bank usually requires only one factor of authentication to verify that an on-line customer is actually the owner of the account. For example, the bank may require the customer to input a username and a password to access the account. Again, the single factor of authentication, such as the username and password, can be easily stolen by a computer hacker, which may result in the unlawful use of the customer's account.
  • As the foregoing illustrates, there is a need in the art for a way to verify the identities of on-line customers that is more secure than current approaches.
  • SUMMARY OF THE INVENTION
  • The present invention generally relates to a computer security system for use in the identification and authentication of a user prior to an on-line transaction. In one aspect, a method for facilitating a secure transaction over a network is provided. The method includes collecting a username and password associated with a user of the machine. The method further includes verifying that the username and password matches a previously collected username and password in an identity profile. The method also includes collecting device data from a user machine to uniquely identify the machine. Additionally, the method includes verifying that the device data matches previously collected device data in the identity profile.
  • In another aspect, a computer-readable medium including a set of instructions that when executed by a processor cause the processor to facilitate a secure transaction over a network is provided. The processor performs the step collecting a username and password associated with a user of the machine. The processor also performs the step of transmitting the username and password to a server machine in order to verify that the username and password matches a previously collected username and password in an identity profile. Further, the processor performs the step of collecting device data from a user machine to uniquely identify the machine. Additionally, the processor performs the step of transmitting the device data to the server machine in order to verify that the device data matches a previously collected device data in the identity profile.
  • In yet a further aspect, a system for facilitating a secure transaction is provided. The system includes a computing device having a processor and a memory, wherein the memory includes a security agent program configured to collect a username and password associated with a user of the computing device and transmit the username and password. The security agent is also configured to collect device data from the computing device to uniquely identify the computing device and transmit the device data. The system further includes a server machine that includes a user profiles database and configured to receive the username and password from the computing device and verify that the username and password matches previously collected username and password in the identity profile stored in user profiles database. The server machine is further configured to receive the device data from the computing device and verify that the device data matches previously collected device data in an identity profile stored in user profiles database.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • So that the manner in which the above recited features of the present invention can be understood in detail, a more particular description of the invention, briefly summarized above, may be had by reference to embodiments, some of which are illustrated in the appended drawings. It is to be noted, however, that the appended drawings illustrate only typical embodiments of this invention and are therefore not to be considered limiting of its scope, for the invention may admit to other equally effective embodiments.
  • FIG. 1 is a conceptual block diagram of a system configured to identify and authenticate the identity of a user, according to one embodiment of the invention.
  • FIG. 2 is a flow chart of method steps for enrolling a user in a security service, according to one embodiment of the invention.
  • FIG. 3 is a flow chart of method steps for securely accessing a user account, according to one embodiment of the invention.
  • FIGS. 4A and 4B are a flow chart of method steps for making a secured payment, according to one embodiment of the invention.
  • FIG. 5 is a conceptual block diagram of a system through which a secured payment may be made, according to one embodiment of the invention.
  • FIGS. 6-8 are conceptual illustrations depicting how the security agent of FIG. 1 interacts with a merchant payment web page when a secured payment is made, according to one embodiment of the invention.
  • DETAILED DESCRIPTION
  • In general, the invention relates to a computer security system for use in the identification and authentication of a user prior to an on-line transaction. The system will be described herein in relation to a single user. However, it should be understood that the systems and methods described herein may be employed with any number of users without departing from the principles of the present invention. The description of the invention is separated into four sections: the architecture, the enrollment process, a secure access transaction, and a secure payment transaction. To better understand the novelty of the system of the present invention and the methods of use thereof, reference is hereafter made to the accompanying drawings.
  • Architecture
  • FIG. 1 is a conceptual block diagram of a system 100 configured to identify and authenticate the identity of a user, according to one embodiment of the invention. The system 100 includes a user machine 105, which may be any type of individual computing device such as, for example, a desk-top computer, a lap-top computer, a hand-held phone device, or a personal digital assistant. Generally, the user machine 105 is configured to be a communication link between the user and the other components in the system 100. The user machine 105 includes a security agent 110. Generally, the security agent 110 is a software entity that runs on the user machine 105. As described in further detail herein, the security agent 110, among other things, is configured to create an identity profile 115 of a user and of user machine 105, collect certain data from the user machine 105 or manage secure access or secure payment transactions made from user machine 105. Additionally, the security agent 110 is designed to offer protection against phishing, pharming, Trojan programs or worms.
  • As also shown, the user machine 105 includes the profile 115, which represents the identity of the user. The profile 115 is unique for each user. As described in further detail herein, once the profile 115 has been created for the user, the identity of the user can be subsequently verified by a series of interactions between the security agent 110 and the authentication server 125 based on the profile 115. The profile 115 includes data about the user and the user machine 105 and can be used to establish a multifactor identification for the user whenever the user attempts to conduct transactions via the user machine 105. The first factor of authentication is a username and/or password, which relates to “what the user knows.” The second factor of authentication is unique information about the user machine 105, which relates to “what the user has.” The third factor of authentication is unique information about the user, such as biometric identity, which relates to “who the user is.”
  • As will be discussed below in the enrollment process, the username and/or password is created by the user after the identity of the user is established. The username and/or password are typically a combination of characters and numbers, which the user can easily remember. In one embodiment, the user machine 105 transmits the username and/or password in a cryptographically protected form, so access to the actual username and/or password will be difficult for a snooper who gains internal access to the user machine 105.
  • With respect to the second factor of authentication, the unique information about the user machine 105 is generally a combination of select information associated with the user machine 105. The information may be static or dynamic. For instance, the information may include the International Mobile Equipment Identity (IMEI), which is a number unique to every mobile phone, the International Mobile Subscriber Identity (IMSI), which is a unique number associated with network mobile phone users, and/or the geolocation of the user machine 105, which is a real-world geographic location of a network connected computer or mobile device. The information about the user machine 105 may also include machine-level attributes. For instance, the information may include various parameters available through a PCI configuration space, like the Device ID or the Vendor ID for different system devices, the data residing in the SMM memory space, or other memory hardware attributes, such as memory type, memory clock speed, amount of memory, hard drive serial number, size of hard drive, maker of hard drive etc., and/or chipset information or graphics card information, which can be used to read hidden and/or unhidden registers within those subsystems. Further, the information may include data at different locations in firmware or BIOS or information available in a Microcode patch or a checksum of a portion of the firmware within the user machine 105.
  • In addition to the foregoing, the information about the user machine 105 may also be system-level attributes. For instance, the information may include a MAC address, hard drive serial number, hardware configuration information, such as interrupt routing, GPIO routing, PCI Device Select routing or a hardware configuration map, operating system registry, CPU type, CPU version or CPU clock speed. The information about the user machine 105 may also include system pattern extraction. For instance, the information may include a directory structure and/or a list of installed applications, such as a word processor or other computer tools.
  • The third factor of authentication consists of unique information about the user, such as a biometric identity. The biometric data may include the specific typing pattern of the user since each user's typing behavior is unique. Typically, typing authentication works by requesting that a user seeking access to a computer or a password-protected file just type a short passage into the computer so that the user's typing pattern can be analyzed and matched against a known pattern. Additionally, the biometric data may also be generated by a biometric device, such as a fingerprint device or an iris pattern device, included within the user machine 105.
  • The system 100 further includes a network 120, which may be any type of data network, such as a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), or the Internet. The network 120 is configured to act as a communication pathway between the user machine 105, the authentication server 125, and an institution server 140. The authentication server 125 stores a copy of the profile 115 generated during the enrollment process in a user profiles database 130. Additionally, the authentication server 125 interacts with the agent 110 via the network 120 during the secure access transaction and the secure payment transaction, as described below. The institution server 140 stores sensitive information for the user e.g. financial account information, confidential data, etc. The institution server 140 may be part of a bank, a building society, a credit union, a stock brokerage, or other businesses holding sensitive data. Generally, the institution server 140 interacts with the agent 110 via the network 120 during the enrollment process, a secure access transaction or a secure payment transaction, as described below.
  • Enrollment Process
  • FIG. 2 is a flow chart of method steps for enrolling a user in a security service, according to one embodiment of the invention. Although the method steps are described in the context of the system of FIG. 1, any system configured to perform the method steps, in any order, is within the scope of the invention. Generally, the enrollment process 200 is used to verify the identity of the user, establish multi-factors of authentication and bind the verified identity of the user to the multi-factors of authentication. As will be discussed herein, verifying the user identity during the enrollment process 200 may include having the user answer specific personal questions e.g. amount of last check deposited, date of last withdrawal, previous residential address, etc. The answers are then checked against a known answer from a data source, such as the institution and/or third party consumer data base to verify that the user is who the user claims to be. Some examples of the multi factors of authentication are—the identification of the user, the identification of the machine, the biometric identity of the user, etc. It should be noted that the enrollment process is a one-time process for each user. After the enrollment process 200 is complete, the user is able to perform the secure access transaction 300 or the secure payment transaction 400, described below, without having to repeat the enrollment steps. The process of verifying identity significantly reduces the chance of a malicious party claiming to be the user. The process of binding the verified identity to the multi-factors of authentication eliminates the cumbersome process of proving the identity of the user at every transaction while providing the same level of security as though the user answered the identity questions, such as the specific personal questions each time.
  • The enrollment process 200 begins in step 205, where the user accesses an enrollment webpage. In one embodiment, the enrollment webpage is generated by the institution server 140 and downloaded to the user machine 105 when the user attempts to electronically access an account held with the institution. The enrollment webpage is configured to educate the user about the enrollment process and subsequently start the user identification process of step 210.
  • In step 210, the user is asked specific personal questions in which only the user knows the answer in order to generate a verified user identity. The questions may relate to dynamic data that frequently changes and is known only by the institution, such as “when was your last deposit,” “what was the last check number,” “who was the check written to” or “who last deposited money in the financial institution”, “what was your last take home pay amount.” The personal questions may relate to static data that does not change, such as “what car did you drive before your current car,” “what is your social security number, date of birth, mother's maiden name” or “what address did you live at before your current address.” In step 215, the answers given by the user is compared to known answers in a data source, such as data at the institution or data held at third party data bases, to verify the identity of the user. If the answers do not match the known answers in the data source, then, in step 220, an exception process is activated. The exception process may include a verification of the user over the phone. Additionally, the exception process may include the user making a personal appearance at a specific location. The exception process in step 220 may be any type of process known in the art to verify the identity of the user.
  • In step 225, the security agent 110 is downloaded to the user machine 105 after the identity of the user is established. In one embodiment, the security agent 110 is downloaded directly from the institution server 140 via the network 120. In another embodiment, the security agent 110 is downloaded via the network 120 from the authentication server 125. In any case, the security agent 110 is configured to interact with both the authentication server 125 and the institution server 140.
  • In step 230, a user name and password is selected to establish the first factor of authentication. In one embodiment, the user selects the user name and password. In another embodiment, the authentication server 125 or the institution sever 140 generates the user name and/or the password. In any case, the user name and/or password are used during the secure access transaction 300 and the secure payment transaction 400, described below.
  • In step 235, unique information from the user machine 105 is extracted by the security agent 110 to establish the second factor of authentication. As set forth above, the information may include any number of different types of data associated with the user machine 105. Again, the information may include the IMEI or the IMSI which relate to mobile devices. The information may include the geolocation of the user machine 105. The information may also include machine level attributes, such as a Device ID, a Vendor ID, data at a SMM memory space, a memory type, a memory clock, hard drive serial number, chipset information, data at different locations in firmware, or information available in Microcode patch, a checksum of firmware, or BIOS. Further, the information may include system level attributes, such as a MAC address, a hard drive serial number, interrupt routing, GPIO routing, PCI DevSel routing, a map of hardware configuration, or an operating system registry. Additionally, the information may relate to system pattern extraction, such as a directory structure or a list of installed applications. No matter what type of select data is extracted from the user machine 105, the data or a combination of different types of data should be unique to the user machine 105 in order to establish the second factor of authentication.
  • In step 240, the biometric information is collected in order to establish the third factor of identity. As set forth herein, the biometric data may include specific typing patterns of the user or biometric data generated by a biometric device, such as a fingerprint device or an iris pattern device. Although each factor of authentication was discussed in steps 230, 235 and 240, it should be understood, however, that any of the factors may be an optional factor of authentication in the enrollment process 200 without departing from principles of the present invention.
  • In step 245, the verified user identity from step 215 is connected (or bound) to the user identity profile 115 which generally comprises the data collected in steps 230-240. The connecting (or binding) of the verified user identity to the factors of authentication allows the user to engage in the secure access transaction 300 or the secure payment transaction 400 without having to repeat the enrollment steps. In other words, the binding of the identity with the factors of authentication eliminates the cumbersome process of proving the identity of the user at every transaction while providing the same level of security as though the user answered the identity questions (the specific personal questions) every time.
  • In step 250, a copy of the profile 115 is stored in the user profiles database 130 in the authentication server 125. During the secure access transaction 300 and the secure payment transaction 400, the security agent 110 interacts with the authentication server 125 by comparing the data from the user and the user machine with the user profile 115 stored in the user profiles database 130 to establish the identity of the user before proceeding with the transaction. It should be noted that in one embodiment the user is able to use the secure access transaction 300 and the secure payment transaction 400 without providing any sensitive personal data, such as a credit card number, a debit card number, etc. In another embodiment, the user interacts directly with an institution to verify the identity of the user. Then the institution issues a one-time credential, such as an account number and/or password. The one-time credential is used during the authentication process of the user to establish the identity of the user before proceeding with the secure access transaction 300 or the secure payment transaction 400.
  • Secure Access Transaction
  • FIG. 3 is a flow chart of method steps for securely accessing a user account, according to one embodiment of the invention. Although the method steps are described in the context of the system illustrated in FIG. 1, any system configured to perform the method steps in any order is within the scope of the invention. Generally, the secure access transaction 300 is a transaction where the user attempts to electronically access an account held at the institution via the institution server 140. Some examples of an institution may be a financial institution, a government agency, a medical institution or a business. During the secure access transaction 300, the security agent 110 interacts with the authentication server 125 via the network 120 to ensure that the user is properly authenticated prior to giving the user access to the relevant accounts held at the institution.
  • The secure access transaction 300 begins with the security agent 110 interacting with the user at a log-on webpage of the institution. In one embodiment, the security agent 110 automatically activates after the security agent 110 detects the log-on webpage of the institution. For instance, the security agent may detect the institution log-on webpage by reading the source code of the webpage, such as the HTML code or by reading a trigger, such as a header or an identification number embedded in the log-on webpage. In another embodiment, the user activates the security agent 110 to perform the secure access transaction 300. For instance, the user may select a button on the webpage to activate the security agent 110. In a further embodiment, the institution activates the security agent 110 and requires the user to use the security agent 110 during the secure access transaction 300.
  • In step 305, the security agent 110 prompts the user to enter his or her username and/or password in order to determine the first factor of authentication. In step 310, the username and/or password entered in step 305 is compared to the username and/or password previously stored in the user profiles database 130. If the username and/or password does not match the user profile in the user profiles database 130, then an exception process is activated in step 315 to determine that the user is who the user claims to be. The exception process in step 315 may be any type of standard industry process known in the art to aid a user who has forgotten a user name and/or password. For instance, the exception process may include requiring the user to go through the enrollment process 200 again to create a new user name and/or password. The exception process may also include having the user answer a security question in order to determine that the user is who the user claims to be. The exception process may also include sending the user name and/or password to a user email address or sending a text message to a user cellphone.
  • In step 320, the security agent 110 collects information which is associated with the user machine 105 in order to establish the second factor of authentication. As previously set forth herein, the information associated with the user machine 105 may include a variety of different information, such as information related to the IMEI, the IMSI, the geolocation, machine level attributes, system level attributes, or system pattern extraction.
  • In step 325, the security agent 110 collects biometric information from the user in order to establish the third factor of identity. Again, the biometric data may include specific typing patterns of the user or biometric data generated by a biometric device, such as a fingerprint device or an iris pattern device. Although each factor of authentication was discussed in steps 305, 320 and 325, it should be understood, however, that any of the factors may be an optional factor of authentication in the secure access transaction 300 without departing from principles of the present invention.
  • In steps 330 and 335, the authentication server 125 verifies that the identity data collected in steps 320 and 325 matches the data included in the user profile previously stored in the user profiles database 130 on the authentication server 125. If the identity data collected in steps 320 and 325 does not match the user profile in the user profiles database 130, then an exception process is activated in step 340. Depending on the type of mismatch, the exception process in step 340 may include limited access to the account or the exception process may require the collection of additional data or that the user to go through the enrollment process 200 again. For instance, if there is small mismatch, such as a wrong geolocation due to the user travelling or a different hard drive serial number due the user upgrading the user machine, then the user may still be allowed access to the account after collecting additional data. If there is a large mismatch, then the user may be required to go through the enrollment process 200 again in order to establish the identity of the user and the factors of authentication. If the identity data collected in steps 320 and 325 does match the user profile in the user profiles database 130, then the user is allowed access in step 345 to the account at the institution.
  • Secure Payment Transaction
  • FIGS. 4A and 4B are a flow chart of method steps for making a secure payment, and FIG. 5 is a conceptual block diagram of a system 500 through which a secure payment may be made, according to one embodiment of the invention. Although the method steps are described in the context of the system illustrated in FIG. 5, any system configured to perform the method steps in any order is within the scope of the invention. Generally, the secure payment transaction 400 is a transaction where the user purchases a product or a service from an on-line merchant 505. During the secure payment transaction 400, the security agent 110 interacts with the authentication server 125 via the network 120 to ensure that the user is properly identified and authenticated prior to the user finalizing the purchase of the product or the service from the on-line merchant 505. The security agent 110 also is configured to interact with the different elements of system 500 to facilitate the actual on-line payment. Additionally, in the secure payment transaction 400, the institution server 140 is represented as a user financial institution server.
  • The secure payment transaction 400 begins with the security agent 110 interacting with the user at a payment webpage of the online merchant 505. In one embodiment, the security agent 110 automatically activates after the security agent 110 detects the payment webpage of the online merchant 505. For instance, the security agent may detect the online merchant 505 payment webpage by reading the source code of the webpage, such as the HTML code for credit card information e.g. card type, expiry date, CVV2 code, etc. or by reading a trigger, such as a header or an identification number embedded in the payment webpage. In another embodiment, the user activates the security agent 110 to perform the secure payment transaction 400. For instance, the user may select a button on the webpage to activate the security agent 110. In a further embodiment, the online merchant 505 activates the security agent 110 and requires the user to use the security agent 110 during the secure payment transaction 400.
  • In step 405, the security agent 110 prompts the user to enter his or her username and/or password in order to determine the first factor of authentication. In one embodiment, the user enters his or her username and/or password through the standard key entry method of the user machine 105. In another embodiment, referring now to FIG. 6, the security agent 110 prompts the user to enter a username and/or password directly in a box 615 by using a keypad 610 on the security agent 110. The keypad 610 is manipulated by using a mouse (not shown) to push the buttons on the keypad 610. Placing the keypad 610 on the security agent 110 is a security mechanism designed to prevent a keylogger from monitoring and stealing the password. In other words, if the password were entered into the box 615 by using a standard keyboard (not shown), then a keylogger may be able to monitor the keystrokes of the user and steal the password. As a further security mechanism, the location of the keys on keypad 610 will systematically change between uses to prevent a mouse logger from monitoring and stealing the password. Additionally, since the security agent 110 directly communicates with the authentication server 125 rather than through a conventional webpage, the threat of “phishing” by presenting the user with bogus webpages is eliminated. One skilled in the art will recognize that the security mechanisms set forth herein may be equally applicable to any transaction that involves the security agent 110, such as the enrollment process 200 or the secure access transaction 300.
  • The security agent 110 is also configured to encrypt the data transmissions generated by the security agent 110 as the security agent 110 interacts with other components in the system. In one embodiment, the security agent 110 has a cryptographic system that uses two keys, such as a public key that is known by other components in the system 500 and a private key that is known only to the recipient of the data transmission. For instance when the security agent 110 wants to send a secure data transmission to the authentication server 125, the security agent 110 uses the public key to encrypt the data. The authentication server 125 then uses the private key to decrypt the data. An important element of this cryptographic system is that the public and private keys are related in such a way that only the public key can be used to encrypt data and only the corresponding private key can be used to decrypt the data. As a further security mechanism, the public private key pair may be randomly changed for each session or from time to time. One skilled in the art will recognize that the security mechanisms set forth herein may be equally applicable to any transaction that involves the security agent 110, such as the enrollment process 200 or the secure access transaction 300.
  • In step 410, the username and/or password entered in step 405 is compared to the username and/or password previously stored in the user profiles database 130. If the username and/or password does not match the data in the user profiles database 130, then an exception process is activated in step 415 to determine that the user is who the user claims to be. The exception process in step 415 may be any type of standard industry process known in the art to aid a user who has forgotten a user name and/or password. For instance, the exception process may include requiring the user to go through the enrollment process 200 again to create a new user name and/or password. The exception process may also include having the user answer a security question in order to determine that the user is who the user claims to be. The exception process may also include sending the user name and/or password to a user email address or sending a text message to a user cellphone.
  • In step 420, the security agent 110 collects information which is associated with the user machine 105 in order to establish the second factor of authentication. As previously set forth herein, the information associated with the user machine 105 may include a variety of different information, such as information related to the IMEI, the IMSI, the geolocation, machine level attributes, system level attributes, or system pattern extraction.
  • In step 425, the security agent 110 collects biometric information from the user in order to establish the third factor of authentication. Again, the biometric data may include specific typing patterns of the user or biometric data generated by a biometric device, such as a fingerprint device or an iris pattern device. Although each factor of authentication was discussed in steps 405, 420 and 425, it should be understood, however, that any of the factors may be an optional factor of authentication in the secure payment transaction 400 without departing from principles of the present invention.
  • In steps 430 and 435, the authentication server 125 verifies that the identity data collected in steps 420 and 425 matches the data included in the user profile previously stored in the user profiles database 130 on the authentication server 125. If the identity data collected in steps 420 and 425 does not match the user profile in the user profiles database 130, then an exception process is activated in step 440. Depending on the type of mismatch, the exception process in step 440 may allow a payment of a reduced amount to be made during the secured payment transaction or the exception process may require the user to go through the enrollment process 200 again. For instance, if there is small mismatch, such as a wrong geolocation due to the user travelling or a different hard drive serial number due the user upgrading the user machine, then the user may still be allowed to make an online payment after collecting additional data. If there is a large mismatch, then the user may be required to go through the enrollment process 200 again in order to establish the identity of the user and the factors of authentication before proceeding in the secure payment transaction 400. If the identity data collected in steps 420 and 425 does match the user profile in the user profiles database 130, then the security agent connects to the user financial institution server 140 in step 445 via the network 120.
  • In step 450, the security agent 110 requests financial account information from the institution server 140 about the user's account(s) held at the institution. Typically, the financial information relates to the different accounts that are available to make a payment to the on-line merchant 505, such as a savings account or a checking account. Additionally, the financial information may include credit cards, lines of credit, equity lines of credit, and the like. In one embodiment, a bank line of credit can be established during the enrollment process or during the merchant transaction process. The bank line of credit then can be considered a virtual credit card for purposes of the merchant transaction. Therefore, in addition to a conventional credit card, this virtual credit card and/or savings account and/or checking account may be used as a payment means for the on-line transaction in step 460, below.
  • In step 455, the user selects an account for payment in the secure payment transaction 400. Referring now to FIG. 7, after the security agent 110 obtains the financial information from the institution server 140, the security agent 110 displays an account list 705 which is a list of accounts available to pay the on-line merchant 505. Essentially, the security agent 110 becomes an automatic teller machine, whereby the user selects the account from the list of accounts presented by the security agent 110, and then the security agent 110 facilitates the payment to the on-line merchant 505, as discussed below.
  • In step 460, the authentication server 125 creates a one-time use personal account number which is used in the secured payment transaction 400. The one-time use personal account number is a sixteen digit number. Similar to the conventional credit card number, the one-time use personal account number includes a number prefix, commonly referred to as Network Identification Number, which is the sequence of digits at the beginning of the number that indicates the entity to which a credit card number belongs. In one embodiment, the authentication server 125 creates an expiration date which is used in the secured payment transaction 400. In another embodiment, the authentication server 125 creates a one time use security code.
  • In step 465, the one-time use personal account number is entered into the merchant webpage. In one embodiment, the security agent 110 populates a payment field 810 of the payment page 625 of the on-line merchant 505 with the one-time use personal account number. In another embodiment, the security agent 110 populates an expiration date field 815 of the payment page 625 of the on-line merchant 505 with the expiration date. In one embodiment, the security agent 110 may hide data in the payment field 810 with a phrase such as “securepay,” as shown in FIG. 8. Alternatively, the security agent 110 can hide data in the payment field 810 of the payment page 625 with “*********” reflecting the format of a conventional credit card number. In another embodiment, the user may populate the payment field 810 with the one-time use personal account number. In another embodiment, the user may populate the expiration date field 815 with the expiration date. In a further embodiment, the user may select a button on the payment page 625 to input the one-time use personal account number.
  • The utilization of the one-time use personal account number has several benefits. For instance, the one-time use personal account number has the same format as a conventional credit card number and therefore the on-line merchant 505 does not have to modify the format of the payment webpage 625 in order to accept the payment from the security agent 110. Another benefit of the one-time use personal account number is that the personal account number can only be used one time and therefore even if the number is stolen, the personal account number has no value beyond the current transaction. Further, the number cannot be processed through traditional credit card processing networks due to the format of the number.
  • Referring back to FIG. 4B, in step 470, the one-time personal account number is sent to a payment processor 510. In step 475, the payment processor 510 extracts server data from the one-time personal account number, such as the Network Identification Number, which is the sequence of digits at the beginning of the one-time use personal account number, in order to determine the personal account number belongs to the authentication server 125. In step 480, the payment processor 510 sends the one-time personal account number and transaction details to the authentication server 125. The transaction details may include the merchant name, the merchant ID, and the amount of the transaction.
  • In step 485, the authentication server 125 replaces the one-time personal account number with a user real personal account number that relates to the account which the user selected in step 455. In step 490, the authentication server 125 sends the real personal account number and the transaction details to the user financial institution for authorization. At this point, the user financial institution server 140 verifies that the user account has sufficient funds to cover the payment transaction. If there are insufficient funds in the selected account, then the security agent 110 prompts the user to select another account for payment. If there are sufficient funds in the selected account, then a payment authorization is sent to the payment processor 510 and security agent 110 in step 495. In step 498, the institution server 140 interacts with the merchant financial server 515 via the settlement network 520 to transfer the funds from the institution server 140 to the merchant financial server 515.
  • While the foregoing is directed to embodiments of the present invention, other and further embodiments of the invention may be devised without departing from the basic scope thereof, and the scope thereof is determined by the claims that follow.

Claims (44)

1. A computer-implemented method for performing a payment transaction, the method comprising:
creating a one-time use personal account number for a transaction with a merchant;
replacing the one-time personal account number with a user real personal account number; and
sending the user real personal account number and details associated with the transaction to a financial institution server for approval.
2. The method of claim 1, wherein the user real personal account number is associated with a user account held at a financial institution.
3. The method of claim 1, further comprising the step of obtaining payment type information from the financial institution server.
4. The method of claim 1, further comprising the step of prompting a user to select a payment type to be used for paying the merchant.
5. The method of claim 1, wherein the merchant is an on-line merchant.
6. The method of claim 5, further comprising the step of transmitting the one-time use personal account number to the on-line merchant through a merchant webpage.
7. The method of claim 6, further comprising the step of sending the one-time personal account number and the details associated with the transaction to a server machine.
8. The method of claim 1, further comprising the steps of:
receiving a first username and a first password input into a computer system by a user;
accessing a database that stores a user profile associated with the user that includes a second username and a second password previously collected from the user when the user enrolled a user account;
verifying that the first username matches the second username included in the user profile and that the first password matches the second password included in the user profile; and
allowing the user to access the user account from the computer system to purchase a product or a service from the merchant.
9. The method of claim 1, further comprising the steps of collecting first biometric data from a user and verifying that the first biometric data matches second biometric data previously collected from the user and included in a user profile.
10. The method of claim 9, wherein the first biometric data includes typing patterns of the user, fingerprint data, or iris pattern data.
11. The method of claim 1, further comprising the step of allowing a user to access a user account without providing sensitive personal data.
12. The method of claim 11, further comprising the step of detecting a webpage related to the user attempting to access the user account.
13. The method of claim 12, wherein the step of detecting comprises reading a source code of the webpage or detecting a trigger included in the webpage.
14. The method of claim 12, wherein the step of detecting comprises reading HTML for key words including expiration date or card verification value.
15. A computer-readable medium including a set of instructions that, when executed by a processor, cause the processor to perform a payment transaction, by performing the steps of:
creating a one-time use personal account number for a transaction with a merchant;
replacing the one-time personal account number with a user real personal account number; and
sending the user real personal account number and details associated with the transaction to a financial institution server for approval.
16. The computer-readable medium of claim 15, wherein the user real personal account number is associated with a user account held at a financial institution.
17. The computer-readable medium of claim 15, further comprising the step of obtaining payment type information from the financial institution server.
18. The computer-readable medium of claim 15, further comprising the step of prompting a user to select a payment type to be used for paying the merchant.
19. The computer-readable medium of claim 15, wherein the merchant is an on-line merchant.
20. The computer-readable medium of claim 19, further comprising the step of transmitting the one-time use personal account number to the on-line merchant through a merchant webpage.
21. The computer-readable medium of claim 20, further comprising the step of sending the one-time personal account number and the details associated with the transaction to a server machine.
22. The computer-readable medium of claim 15, further comprising the steps of:
receiving a first username and a first password input into a computer system by a user;
accessing a database that stores a user profile associated with the user that includes a second username and a second password previously collected from the user when the user enrolled a user account;
verifying that the first username matches the second username included in the user profile and that the first password matches the second password included in the user profile; and
allowing the user to access the user account from the computer system to purchase a product or a service from the merchant.
23. The computer-readable medium of claim 15, further comprising the steps of collecting first biometric data from a user and verifying that the first biometric data matches second biometric data previously collected from the user and included in a user profile.
24. The computer-readable medium of claim 23, wherein the first biometric data includes typing patterns of the user, fingerprint data, or iris pattern data.
25. The computer-readable medium of claim 15, further comprising the step of allowing a user to access a user account without providing sensitive personal data.
26. The computer-readable medium of claim 25, further comprising the step of detecting a webpage related to the user attempting to access the user account.
27. The computer-readable medium of claim 26, wherein the step of detecting comprises reading a source code of the webpage or detecting a trigger included in the webpage.
28. The computer-readable medium of claim 26, wherein the step of detecting comprises reading HTML for key words including expiration date or card verification value.
29. A system for performing a payment transaction, the system comprising:
a server that includes a user profiles database and is configured to:
create a one-time use personal account number for a transaction with a merchant,
replace the one-time personal account number with a user real personal account number, and
send the user real personal account number and details associated with the transaction to a financial institution server for approval.
30. The system of claim 29, wherein the user real personal account number is associated with a user account held at a financial institution.
31. The system of claim 29, wherein the server is further configured to obtain payment type information from the financial institution server.
32. The system of claim 29, wherein the server is further configured to prompt a user to select a payment type to be used for paying the merchant.
33. The system of claim 29, wherein the merchant is an on-line merchant.
34. The system of claim 33, wherein the server is further configured to transmit the one-time use personal account number to the on-line merchant through a merchant webpage.
35. The system of claim 29, further comprising a first computing device having a processor and a memory, wherein the memory includes a security agent configured to collect a first username and a first password input into the first computing device by a user.
36. The system of claim 35, wherein the security agent is further configured to send the one-time personal account number and the details associated with the transaction to the server machine.
37. The system of claim 35, wherein the server is further configured to:
receive the first username and the first password input into the first computing device by the user;
access the user profiles database that stores a user profile associated with the user that includes a second username and a second password previously collected from the user when the user enrolled a user account;
verify that the first username matches the second username included in the user profile and that the first password matches the second password included in the user profile; and
allow the user to access the user account from the first computing device to purchase a product or a service from the merchant.
38. The system of claim 37, wherein the user accesses the user account without providing sensitive personal data.
39. The system of claim 38, wherein the security agent is further configured to detect a webpage related to the user attempting to access the user account.
40. The system of claim 39, wherein the detecting comprises reading a source code of the webpage or detecting a trigger included in the webpage.
41. The system of claim 39, wherein the detecting comprises reading HTML for key words including expiration date or card verification value.
42. The system of claim 35, wherein the security agent is further configured to collect first biometric data from the user and verify that the first biometric data matches second biometric data previously collected from the user and included in a user profile.
43. The system of claim 42, wherein the first biometric data includes typing patterns of the user, fingerprint data, or iris pattern data.
44. The system of claim 29, wherein the one-time use personal account number has a format associated with a conventional credit card.
US12/470,203 2006-11-21 2009-05-21 Systems and methods for identification and authentication of a user Abandoned US20090228370A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US12/470,203 US20090228370A1 (en) 2006-11-21 2009-05-21 Systems and methods for identification and authentication of a user

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US11/562,353 US7548890B2 (en) 2006-11-21 2006-11-21 Systems and methods for identification and authentication of a user
US12/470,203 US20090228370A1 (en) 2006-11-21 2009-05-21 Systems and methods for identification and authentication of a user

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US11/562,353 Continuation US7548890B2 (en) 2006-11-21 2006-11-21 Systems and methods for identification and authentication of a user

Publications (1)

Publication Number Publication Date
US20090228370A1 true US20090228370A1 (en) 2009-09-10

Family

ID=39432932

Family Applications (2)

Application Number Title Priority Date Filing Date
US11/562,353 Active 2027-08-29 US7548890B2 (en) 2006-11-21 2006-11-21 Systems and methods for identification and authentication of a user
US12/470,203 Abandoned US20090228370A1 (en) 2006-11-21 2009-05-21 Systems and methods for identification and authentication of a user

Family Applications Before (1)

Application Number Title Priority Date Filing Date
US11/562,353 Active 2027-08-29 US7548890B2 (en) 2006-11-21 2006-11-21 Systems and methods for identification and authentication of a user

Country Status (1)

Country Link
US (2) US7548890B2 (en)

Cited By (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080253628A1 (en) * 2007-04-12 2008-10-16 Kenji Matsue Image diagnosis support system
US20100218111A1 (en) * 2009-02-26 2010-08-26 Google Inc. User Challenge Using Information Based on Geography Or User Identity
US7865937B1 (en) 2009-08-05 2011-01-04 Daon Holdings Limited Methods and systems for authenticating users
US20110065420A1 (en) * 2009-09-13 2011-03-17 Reyes Randy De Los Method and system for binding payment methods and payment information to mobile devices
US20120024946A1 (en) * 2010-06-29 2012-02-02 John Tullis Value Token Conversion
US20130054433A1 (en) * 2011-08-25 2013-02-28 T-Mobile Usa, Inc. Multi-Factor Identity Fingerprinting with User Behavior
US20140053250A1 (en) * 2012-02-10 2014-02-20 University Of Utah Research Foundation Access to Web Application via a Mobile Computing Device
US8825697B2 (en) * 2011-09-13 2014-09-02 Stefano Foresti Method and system to capture, share and find information and relationships
US8925058B1 (en) * 2012-03-29 2014-12-30 Emc Corporation Authentication involving authentication operations which cross reference authentication factors
WO2015009194A1 (en) * 2013-07-19 2015-01-22 Общество с ограниченной ответственностью "Сибирская Инновационная Компания" Method and system for controlling the status of an object with the aid of a mobile device
WO2015108924A3 (en) * 2014-01-15 2015-11-19 Acuity Systems, Inc. Authentication system
US9251538B1 (en) * 2009-09-23 2016-02-02 Verient Inc System and method for automatically filling webpage fields
US20160337351A1 (en) * 2012-03-16 2016-11-17 Acuity Systems, Inc. Authentication system
US9824199B2 (en) 2011-08-25 2017-11-21 T-Mobile Usa, Inc. Multi-factor profile and security fingerprint analysis
US20170364880A1 (en) * 2016-06-15 2017-12-21 Mastercard International Incorporated System and method of tokenizing deposit account numbers for use at payment card acceptance point
US10168413B2 (en) 2011-03-25 2019-01-01 T-Mobile Usa, Inc. Service enhancements using near field communication
US10915880B2 (en) 2008-05-09 2021-02-09 Verient Inc. System and method for distributed payment products
US11080678B2 (en) 2008-05-09 2021-08-03 Verient, Inc. Payment processing platform

Families Citing this family (58)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9412123B2 (en) 2003-07-01 2016-08-09 The 41St Parameter, Inc. Keystroke analysis
US10999298B2 (en) 2004-03-02 2021-05-04 The 41St Parameter, Inc. Method and system for identifying users and detecting fraud by use of the internet
US8938671B2 (en) 2005-12-16 2015-01-20 The 41St Parameter, Inc. Methods and apparatus for securely displaying digital images
US11301585B2 (en) 2005-12-16 2022-04-12 The 41St Parameter, Inc. Methods and apparatus for securely displaying digital images
US8151327B2 (en) 2006-03-31 2012-04-03 The 41St Parameter, Inc. Systems and methods for detection of session tampering and fraud prevention
US7818264B2 (en) 2006-06-19 2010-10-19 Visa U.S.A. Inc. Track data encryption
US7739169B2 (en) * 2007-06-25 2010-06-15 Visa U.S.A. Inc. Restricting access to compromised account information
US8121942B2 (en) * 2007-06-25 2012-02-21 Visa U.S.A. Inc. Systems and methods for secure and transparent cardless transactions
US7909243B2 (en) * 2007-08-28 2011-03-22 American Express Travel Related Services Company, Inc. System and method for completing a secure financial transaction using a wireless communications device
US8666841B1 (en) * 2007-10-09 2014-03-04 Convergys Information Management Group, Inc. Fraud detection engine and method of using the same
WO2009057147A2 (en) * 2007-11-04 2009-05-07 Rajendra Kumar Khare Method and system for user authentication
US20090312090A1 (en) * 2008-06-17 2009-12-17 Bank Of America Corporation Online Banking Through a Gaming Console
EP2340503A4 (en) * 2008-10-13 2013-01-09 Hewlett Packard Development Co Systems and processes for securing sensitive information
BRPI0921124A2 (en) * 2008-11-06 2016-09-13 Visa Int Service Ass system for authenticating a consumer, computer implemented method, computer readable medium, and server computer.
EP2396742A2 (en) * 2009-02-10 2011-12-21 Uniloc Usa, Inc. Web content access using a client device identifier
US9112850B1 (en) 2009-03-25 2015-08-18 The 41St Parameter, Inc. Systems and methods of sharing information through a tag-based consortium
US9047450B2 (en) * 2009-06-19 2015-06-02 Deviceauthority, Inc. Identification of embedded system devices
US9047458B2 (en) * 2009-06-19 2015-06-02 Deviceauthority, Inc. Network access protection
US20100325040A1 (en) * 2009-06-23 2010-12-23 Craig Stephen Etchegoyen Device Authority for Authenticating a User of an Online Service
US20100333213A1 (en) * 2009-06-24 2010-12-30 Craig Stephen Etchegoyen Systems and Methods for Determining Authorization to Operate Licensed Software Based on a Client Device Fingerprint
US9075958B2 (en) * 2009-06-24 2015-07-07 Uniloc Luxembourg S.A. Use of fingerprint with an on-line or networked auction
US20100332400A1 (en) * 2009-06-24 2010-12-30 Craig Stephen Etchegoyen Use of Fingerprint with an On-Line or Networked Payment Authorization System
US8213907B2 (en) 2009-07-08 2012-07-03 Uniloc Luxembourg S. A. System and method for secured mobile communication
US8726407B2 (en) * 2009-10-16 2014-05-13 Deviceauthority, Inc. Authentication of computing and communications hardware
US9082128B2 (en) * 2009-10-19 2015-07-14 Uniloc Luxembourg S.A. System and method for tracking and scoring user activities
US8306914B2 (en) 2011-01-07 2012-11-06 American Express Travel Related Services Company, Inc. Offsite financial account onboarding
US8341080B2 (en) * 2011-01-07 2012-12-25 Serve Virtual Enterprises, Inc. Offsite financial account onboarding
AU2011100168B4 (en) 2011-02-09 2011-06-30 Device Authority Ltd Device-bound certificate authentication
AU2011101295B4 (en) 2011-06-13 2012-08-02 Device Authority Ltd Hardware identity in multi-factor authentication layer
AU2011101297B4 (en) 2011-08-15 2012-06-14 Uniloc Usa, Inc. Remote recognition of an association between remote devices
AU2012100459B4 (en) 2011-08-15 2012-11-22 Uniloc Usa, Inc. Personal control of personal information
CN103095662B (en) * 2011-11-04 2016-08-03 阿里巴巴集团控股有限公司 A kind of online transaction safety certifying method and online transaction security certification system
US10754913B2 (en) 2011-11-15 2020-08-25 Tapad, Inc. System and method for analyzing user device information
US8881273B2 (en) 2011-12-02 2014-11-04 Uniloc Luxembourg, S.A. Device reputation management
AU2012100464B4 (en) 2012-02-20 2012-11-29 Uniloc Usa, Inc. Computer-based comparison of human individuals
US9633201B1 (en) 2012-03-01 2017-04-25 The 41St Parameter, Inc. Methods and systems for fraud containment
US9521551B2 (en) 2012-03-22 2016-12-13 The 41St Parameter, Inc. Methods and systems for persistent cross-application mobile device identification
WO2014003771A1 (en) * 2012-06-29 2014-01-03 Hewlett-Packard Development Company, L.P. Re-verification of a device
EP2880619A1 (en) 2012-08-02 2015-06-10 The 41st Parameter, Inc. Systems and methods for accessing records via derivative locators
WO2014078569A1 (en) 2012-11-14 2014-05-22 The 41St Parameter, Inc. Systems and methods of global identification
US9143496B2 (en) 2013-03-13 2015-09-22 Uniloc Luxembourg S.A. Device authentication using device environment information
US9286466B2 (en) 2013-03-15 2016-03-15 Uniloc Luxembourg S.A. Registration and authentication of computing devices using a digital skeleton key
US20150326556A1 (en) * 2013-05-07 2015-11-12 Badu Networks Inc. Universal login authentication service
US20150007292A1 (en) * 2013-07-01 2015-01-01 International Business Machines Corporation User authentication utilizing patterns
US10902327B1 (en) 2013-08-30 2021-01-26 The 41St Parameter, Inc. System and method for device identification and uniqueness
US10091312B1 (en) 2014-10-14 2018-10-02 The 41St Parameter, Inc. Data structures for intelligently resolving deterministic and probabilistic device identifiers to device profiles and/or groups
CN105991590B (en) 2015-02-15 2019-10-18 阿里巴巴集团控股有限公司 A kind of method, system, client and server for verifying user identity
WO2016131063A1 (en) * 2015-02-15 2016-08-18 Alibaba Group Holding Limited System and method for user identity verification, and client and server by use thereof
CN106034029A (en) 2015-03-20 2016-10-19 阿里巴巴集团控股有限公司 Verification method and apparatus based on image verification codes
CN105160528A (en) * 2015-08-26 2015-12-16 小米科技有限责任公司 Account property protection method and apparatus
US10854028B2 (en) * 2016-08-09 2020-12-01 Vivint, Inc. Authentication for keyless building entry
US10417629B2 (en) * 2016-09-02 2019-09-17 Microsoft Technology Licensing, Llc Account identifier digitization abstraction
CN108074082A (en) * 2016-11-11 2018-05-25 南昌欧菲生物识别技术有限公司 A kind of data transfer control method and relevant device, system
US10404675B2 (en) 2017-08-16 2019-09-03 Bank Of America Corporation Elastic authentication system
CN109167836A (en) * 2018-09-19 2019-01-08 淮北矿业股份有限公司 A kind of mobile Internet adds security system
US20200120089A1 (en) * 2018-10-11 2020-04-16 Ca, Inc. Multifactor authentication utilizing issued checks
CN112801669A (en) * 2018-10-25 2021-05-14 创新先进技术有限公司 Method, device and equipment for identity authentication, number storage and sending and number binding
CN114881651B (en) * 2022-05-09 2023-04-11 北京合思信息技术有限公司 Abnormal transaction identification system and method for big data service intelligent finance

Citations (41)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5715314A (en) * 1994-10-24 1998-02-03 Open Market, Inc. Network sales system
US5815665A (en) * 1996-04-03 1998-09-29 Microsoft Corporation System and method for providing trusted brokering services over a distributed network
US5870723A (en) * 1994-11-28 1999-02-09 Pare, Jr.; David Ferrin Tokenless biometric transaction authorization method and system
US5905736A (en) * 1996-04-22 1999-05-18 At&T Corp Method for the billing of transactions over the internet
US6000832A (en) * 1997-09-24 1999-12-14 Microsoft Corporation Electronic online commerce card with customer generated transaction proxy number for online transactions
US6163771A (en) * 1997-08-28 2000-12-19 Walker Digital, Llc Method and device for generating a single-use financial account number
US6233565B1 (en) * 1998-02-13 2001-05-15 Saranac Software, Inc. Methods and apparatus for internet based financial transactions with evidence of payment
US6263447B1 (en) * 1998-05-21 2001-07-17 Equifax Inc. System and method for authentication of network users
US20010029485A1 (en) * 2000-02-29 2001-10-11 E-Scoring, Inc. Systems and methods enabling anonymous credit transactions
US20010047297A1 (en) * 2000-02-16 2001-11-29 Albert Wen Advertisement brokering with remote ad generation system and method in a distributed computer network
US20020013764A1 (en) * 2000-04-11 2002-01-31 Juha-Petri Karna Method and system for validating electronic transactions
US20020053035A1 (en) * 2000-06-06 2002-05-02 Daniel Schutzer Method and system for strong, convenient authentication of a web user
US20020073339A1 (en) * 2000-12-07 2002-06-13 Card Ronald C. System and method to access secure information related to a user
US20020128967A1 (en) * 2000-12-14 2002-09-12 John Meyer Bar coded bill payment system and method
US20030105681A1 (en) * 2001-08-29 2003-06-05 Predictive Networks, Inc. Method and system for parsing purchase information from web pages
US20040010685A1 (en) * 2002-02-25 2004-01-15 Sony Corporation Service providing apparatus and server providing method
US20040010720A1 (en) * 2002-07-12 2004-01-15 Romi Singh System and method for remote supervision and authentication of user activities at communication network workstations
US20040019564A1 (en) * 2002-07-26 2004-01-29 Scott Goldthwaite System and method for payment transaction authentication
US6766373B1 (en) * 2000-05-31 2004-07-20 International Business Machines Corporation Dynamic, seamless switching of a network session from one connection route to another
US6839689B2 (en) * 1999-09-21 2005-01-04 Agb2 Inc. Systems and methods for guaranteeing the protection of private information
US6871278B1 (en) * 2000-07-06 2005-03-22 Lasercard Corporation Secure transactions with passive storage media
US20050119979A1 (en) * 2002-07-04 2005-06-02 Fujitsu Limited Transaction system and transaction terminal equipment
US20050246292A1 (en) * 2000-04-14 2005-11-03 Branko Sarcanin Method and system for a virtual safe
US20060106734A1 (en) * 1994-11-28 2006-05-18 Ned Hoffman System and method for processing tokenless biometric electronic transmissions using an electronic rule module clearinghouse
US20060124756A1 (en) * 2004-12-10 2006-06-15 Brown Kerry D Payment card with internally generated virtual account numbers for its magnetic stripe encoder and user display
US20060156385A1 (en) * 2003-12-30 2006-07-13 Entrust Limited Method and apparatus for providing authentication using policy-controlled authentication articles and techniques
US20060173781A1 (en) * 2000-07-24 2006-08-03 Donner Irah H System and method for interactive messaging and/or allocating and/or upgrading and/or rewarding tickets, other event admittance means, goods and/or services
US20060177061A1 (en) * 2004-10-25 2006-08-10 Orsini Rick L Secure data parser method and system
US20060212407A1 (en) * 2005-03-17 2006-09-21 Lyon Dennis B User authentication and secure transaction system
US20060212391A1 (en) * 2004-06-24 2006-09-21 Jpmorgan Chase Bank, N.A. Method and system for facilitating network transaction processing
US20060242058A1 (en) * 2003-03-07 2006-10-26 Anthony Torto Transaction system
US20060282662A1 (en) * 2005-06-13 2006-12-14 Iamsecureonline, Inc. Proxy authentication network
US20060282660A1 (en) * 2005-04-29 2006-12-14 Varghese Thomas E System and method for fraud monitoring, detection, and tiered user authentication
US7162475B2 (en) * 2002-04-17 2007-01-09 Ackerman David M Method for user verification and authentication and multimedia processing for interactive database management and method for viewing the multimedia
US20070053518A1 (en) * 2000-01-13 2007-03-08 Peter Tompkins Method and system for conducting financial and non-financial transactions using a wireless device
US20070079136A1 (en) * 2005-09-30 2007-04-05 Sbc Knowledge Ventures, Lp Methods and systems for using data processing systems in order to authenticate parties
US7225156B2 (en) * 2001-07-11 2007-05-29 Fisher Douglas C Persistent dynamic payment service
US7231657B2 (en) * 2002-02-14 2007-06-12 American Management Systems, Inc. User authentication system and methods thereof
US20070142032A1 (en) * 2005-12-16 2007-06-21 Jim Balsillie System and method of authenticating login credentials in a wireless communication system
US7290288B2 (en) * 1997-06-11 2007-10-30 Prism Technologies, L.L.C. Method and system for controlling access, by an authentication server, to protected computer resources provided via an internet protocol network
US7292999B2 (en) * 2001-03-15 2007-11-06 American Express Travel Related Services Company, Inc. Online card present transaction

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2829986B2 (en) * 1988-10-11 1998-12-02 カシオ計算機株式会社 Electronic device stop function release system

Patent Citations (44)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5715314A (en) * 1994-10-24 1998-02-03 Open Market, Inc. Network sales system
US5870723A (en) * 1994-11-28 1999-02-09 Pare, Jr.; David Ferrin Tokenless biometric transaction authorization method and system
US20060106734A1 (en) * 1994-11-28 2006-05-18 Ned Hoffman System and method for processing tokenless biometric electronic transmissions using an electronic rule module clearinghouse
US5815665A (en) * 1996-04-03 1998-09-29 Microsoft Corporation System and method for providing trusted brokering services over a distributed network
US5905736A (en) * 1996-04-22 1999-05-18 At&T Corp Method for the billing of transactions over the internet
US7290288B2 (en) * 1997-06-11 2007-10-30 Prism Technologies, L.L.C. Method and system for controlling access, by an authentication server, to protected computer resources provided via an internet protocol network
US6163771A (en) * 1997-08-28 2000-12-19 Walker Digital, Llc Method and device for generating a single-use financial account number
US7853529B1 (en) * 1997-08-28 2010-12-14 Walker Digital, Llc Method and device for generating a single-use financial account number
US6000832A (en) * 1997-09-24 1999-12-14 Microsoft Corporation Electronic online commerce card with customer generated transaction proxy number for online transactions
US6233565B1 (en) * 1998-02-13 2001-05-15 Saranac Software, Inc. Methods and apparatus for internet based financial transactions with evidence of payment
US7234156B2 (en) * 1998-05-21 2007-06-19 Equifax, Inc. System and method for authentication of network users
US6263447B1 (en) * 1998-05-21 2001-07-17 Equifax Inc. System and method for authentication of network users
US6857073B2 (en) * 1998-05-21 2005-02-15 Equifax Inc. System and method for authentication of network users
US6839689B2 (en) * 1999-09-21 2005-01-04 Agb2 Inc. Systems and methods for guaranteeing the protection of private information
US20070053518A1 (en) * 2000-01-13 2007-03-08 Peter Tompkins Method and system for conducting financial and non-financial transactions using a wireless device
US20010047297A1 (en) * 2000-02-16 2001-11-29 Albert Wen Advertisement brokering with remote ad generation system and method in a distributed computer network
US20010029485A1 (en) * 2000-02-29 2001-10-11 E-Scoring, Inc. Systems and methods enabling anonymous credit transactions
US20020013764A1 (en) * 2000-04-11 2002-01-31 Juha-Petri Karna Method and system for validating electronic transactions
US20050246292A1 (en) * 2000-04-14 2005-11-03 Branko Sarcanin Method and system for a virtual safe
US6766373B1 (en) * 2000-05-31 2004-07-20 International Business Machines Corporation Dynamic, seamless switching of a network session from one connection route to another
US20020053035A1 (en) * 2000-06-06 2002-05-02 Daniel Schutzer Method and system for strong, convenient authentication of a web user
US6871278B1 (en) * 2000-07-06 2005-03-22 Lasercard Corporation Secure transactions with passive storage media
US20060173781A1 (en) * 2000-07-24 2006-08-03 Donner Irah H System and method for interactive messaging and/or allocating and/or upgrading and/or rewarding tickets, other event admittance means, goods and/or services
US20020073339A1 (en) * 2000-12-07 2002-06-13 Card Ronald C. System and method to access secure information related to a user
US20020128967A1 (en) * 2000-12-14 2002-09-12 John Meyer Bar coded bill payment system and method
US7292999B2 (en) * 2001-03-15 2007-11-06 American Express Travel Related Services Company, Inc. Online card present transaction
US7225156B2 (en) * 2001-07-11 2007-05-29 Fisher Douglas C Persistent dynamic payment service
US20030105681A1 (en) * 2001-08-29 2003-06-05 Predictive Networks, Inc. Method and system for parsing purchase information from web pages
US7231657B2 (en) * 2002-02-14 2007-06-12 American Management Systems, Inc. User authentication system and methods thereof
US20040010685A1 (en) * 2002-02-25 2004-01-15 Sony Corporation Service providing apparatus and server providing method
US7162475B2 (en) * 2002-04-17 2007-01-09 Ackerman David M Method for user verification and authentication and multimedia processing for interactive database management and method for viewing the multimedia
US20050119979A1 (en) * 2002-07-04 2005-06-02 Fujitsu Limited Transaction system and transaction terminal equipment
US20040010720A1 (en) * 2002-07-12 2004-01-15 Romi Singh System and method for remote supervision and authentication of user activities at communication network workstations
US20040019564A1 (en) * 2002-07-26 2004-01-29 Scott Goldthwaite System and method for payment transaction authentication
US20060242058A1 (en) * 2003-03-07 2006-10-26 Anthony Torto Transaction system
US20060156385A1 (en) * 2003-12-30 2006-07-13 Entrust Limited Method and apparatus for providing authentication using policy-controlled authentication articles and techniques
US20060212391A1 (en) * 2004-06-24 2006-09-21 Jpmorgan Chase Bank, N.A. Method and system for facilitating network transaction processing
US20060177061A1 (en) * 2004-10-25 2006-08-10 Orsini Rick L Secure data parser method and system
US20060124756A1 (en) * 2004-12-10 2006-06-15 Brown Kerry D Payment card with internally generated virtual account numbers for its magnetic stripe encoder and user display
US20060212407A1 (en) * 2005-03-17 2006-09-21 Lyon Dennis B User authentication and secure transaction system
US20060282660A1 (en) * 2005-04-29 2006-12-14 Varghese Thomas E System and method for fraud monitoring, detection, and tiered user authentication
US20060282662A1 (en) * 2005-06-13 2006-12-14 Iamsecureonline, Inc. Proxy authentication network
US20070079136A1 (en) * 2005-09-30 2007-04-05 Sbc Knowledge Ventures, Lp Methods and systems for using data processing systems in order to authenticate parties
US20070142032A1 (en) * 2005-12-16 2007-06-21 Jim Balsillie System and method of authenticating login credentials in a wireless communication system

Cited By (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080253628A1 (en) * 2007-04-12 2008-10-16 Kenji Matsue Image diagnosis support system
US8401259B2 (en) * 2007-04-12 2013-03-19 Kabushiki Kaisha Toshiba Image diagnosis support system
US10915880B2 (en) 2008-05-09 2021-02-09 Verient Inc. System and method for distributed payment products
US11080678B2 (en) 2008-05-09 2021-08-03 Verient, Inc. Payment processing platform
US20100218111A1 (en) * 2009-02-26 2010-08-26 Google Inc. User Challenge Using Information Based on Geography Or User Identity
US8301684B2 (en) * 2009-02-26 2012-10-30 Google Inc. User challenge using information based on geography or user identity
US7865937B1 (en) 2009-08-05 2011-01-04 Daon Holdings Limited Methods and systems for authenticating users
US20110065420A1 (en) * 2009-09-13 2011-03-17 Reyes Randy De Los Method and system for binding payment methods and payment information to mobile devices
US9373141B1 (en) 2009-09-23 2016-06-21 Verient, Inc. System and method for automatically filling webpage fields
US9251538B1 (en) * 2009-09-23 2016-02-02 Verient Inc System and method for automatically filling webpage fields
US10255597B2 (en) 2009-09-23 2019-04-09 Verient Inc. System and method for automatically filling webpage fields
US20120024946A1 (en) * 2010-06-29 2012-02-02 John Tullis Value Token Conversion
US8590779B2 (en) * 2010-06-29 2013-11-26 Visa International Service Association Value token conversion
US11002822B2 (en) 2011-03-25 2021-05-11 T-Mobile Usa, Inc. Service enhancements using near field communication
US10168413B2 (en) 2011-03-25 2019-01-01 T-Mobile Usa, Inc. Service enhancements using near field communication
US11138300B2 (en) 2011-08-25 2021-10-05 T-Mobile Usa, Inc. Multi-factor profile and security fingerprint analysis
US9824199B2 (en) 2011-08-25 2017-11-21 T-Mobile Usa, Inc. Multi-factor profile and security fingerprint analysis
US20130054433A1 (en) * 2011-08-25 2013-02-28 T-Mobile Usa, Inc. Multi-Factor Identity Fingerprinting with User Behavior
US8825697B2 (en) * 2011-09-13 2014-09-02 Stefano Foresti Method and system to capture, share and find information and relationships
US20140053250A1 (en) * 2012-02-10 2014-02-20 University Of Utah Research Foundation Access to Web Application via a Mobile Computing Device
US20160337351A1 (en) * 2012-03-16 2016-11-17 Acuity Systems, Inc. Authentication system
US8925058B1 (en) * 2012-03-29 2014-12-30 Emc Corporation Authentication involving authentication operations which cross reference authentication factors
WO2015009194A1 (en) * 2013-07-19 2015-01-22 Общество с ограниченной ответственностью "Сибирская Инновационная Компания" Method and system for controlling the status of an object with the aid of a mobile device
WO2015108924A3 (en) * 2014-01-15 2015-11-19 Acuity Systems, Inc. Authentication system
US20170364880A1 (en) * 2016-06-15 2017-12-21 Mastercard International Incorporated System and method of tokenizing deposit account numbers for use at payment card acceptance point
US11763284B2 (en) * 2016-06-15 2023-09-19 Mastercard International Incorporated System and method of tokenizing deposit account numbers for use at payment card acceptance point

Also Published As

Publication number Publication date
US20080120195A1 (en) 2008-05-22
US7548890B2 (en) 2009-06-16

Similar Documents

Publication Publication Date Title
US7548890B2 (en) Systems and methods for identification and authentication of a user
US8661520B2 (en) Systems and methods for identification and authentication of a user
EP2095221A2 (en) Systems and methods for identification and authentication of a user
US10771251B1 (en) Identity management service via virtual passport
US9426134B2 (en) Method and systems for the authentication of a user
US20220391891A1 (en) Secure Authentication System With Token Service
RU2645593C2 (en) Verification of portable consumer devices
US20170249633A1 (en) One-Time Use Password Systems And Methods
US9053471B2 (en) Apparatus and method for conducting securing financial transactions
US8079082B2 (en) Verification of software application authenticity
US8768837B2 (en) Method and system for controlling risk in a payment transaction
US20080120507A1 (en) Methods and systems for authentication of a user
US20010051924A1 (en) On-line based financial services method and system utilizing biometrically secured transactions for issuing credit
CN110537195A (en) Use the method that the logical card ID clearance card based on block chain uses and the server for using it
US20030046237A1 (en) Method and system for enabling the issuance of biometrically secured online credit or other online payment transactions without tokens
US20060173776A1 (en) A Method of Authentication
US20120116976A1 (en) Verification of portable consumer device for 3-d secure services
US8055545B2 (en) Apparatus and method for conducting secure financial transactions
KR20030019404A (en) Transaction system and method
KR20080107400A (en) Method and system for performing two factor authentication in mail order and telephone order transactions
US20120317018A1 (en) Systems and methods for protecting account identifiers in financial transactions
TWI296769B (en)
US20230245125A1 (en) Identity verification using a virtual credential
Vidal et al. Online Banking and Finance
KR20070021867A (en) Wireless authentication system interworking with wireless terminal and method

Legal Events

Date Code Title Description
STPP Information on status: patent application and granting procedure in general

Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION

STPP Information on status: patent application and granting procedure in general

Free format text: NON FINAL ACTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER

STPP Information on status: patent application and granting procedure in general

Free format text: FINAL REJECTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: RESPONSE AFTER FINAL ACTION FORWARDED TO EXAMINER

STPP Information on status: patent application and granting procedure in general

Free format text: ADVISORY ACTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION

STPP Information on status: patent application and granting procedure in general

Free format text: NON FINAL ACTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER

STPP Information on status: patent application and granting procedure in general

Free format text: FINAL REJECTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: ADVISORY ACTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION

STPP Information on status: patent application and granting procedure in general

Free format text: NON FINAL ACTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER

STPP Information on status: patent application and granting procedure in general

Free format text: FINAL REJECTION MAILED

STPP Information on status: patent application and granting procedure in general

Free format text: RESPONSE AFTER FINAL ACTION FORWARDED TO EXAMINER

STPP Information on status: patent application and granting procedure in general

Free format text: ADVISORY ACTION MAILED

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION