System and method to authenticate contact center agents by a reverse authentication procedure

An authentication system to validate the authenticity of call center agents by using a reverse authentication procedure. The authentication system includes a verification module that verifies the authenticity of agents calling from the call center. The verification module retrieves reference answers in response to the user-provided query questions from a media server. The media server may be located inside the enterprise network. These reference questions and their corresponding reference answers are provided by users when registering with the enterprise network.

BACKGROUND

Field

Embodiments of the present invention generally relate to a system and method to authenticate contact center agents of an enterprise and particularly to a system and method to authenticate contact center agents by a reverse authentication procedure.

Description of Related Art

Contact centers are employed by many enterprises to service inbound and outbound contacts from customers. A primary objective of contact center management is to ultimately maximize contact center performance and profitability. An ongoing challenge in contact center administration is monitoring and optimizing contact center efficiency usage of its available resources. The contact center efficiency is generally measured by metrics such as Service Level Agreement (SLA), Customer Satisfaction (CSAT), and match rate. Contact center resources may include, agents, communication assets (e.g., number of voice trunks, number and bandwidth of video trunks, etc.), computing resources (e.g., a speed, a queue length, a storage space, etc.), and so forth.

Service level is one measurement of the contact center efficiency. Service level is typically determined by dividing the number of contacts accepted within a specified period by the number accepted plus number that were not accepted, but completed in some other way (e.g., abandoned, given busy, canceled, flowed out). Service level definitions may vary from one enterprise to another.

Match rate is another indicator used in measuring the contact center efficiency. Match rate is usually determined by dividing the number of contacts accepted by a primary skill level agent within a period of time by the number of contacts accepted by any agent in a queue over the same period. An agent with a primary skill level is one who typically may handle contacts of a certain nature more effectively and/or efficiently as compared to an agent of lesser skill level. There are other contact center agents who may not be as proficient as the primary skill level agent, and those agents are identified either as skill level agents or backup skill level agents. As can be appreciated, contacts received by a primary skill level agent are typically handled more quickly and accurately or effectively (e.g., higher revenue attained) than a contact received by a secondary or even backup skill level agent. Thus, it is an objective of most contact centers to optimize match rate along with the service level.

In addition to service level and match rate performance measures, contact centers use other Key Performance Indicators (“KPIs”), such as revenue, estimated, actual, or predicted wait time, average speed of answer, throughput, agent utilization, agent performance, agent responsiveness and the like, to calculate performance relative to their Service Level Agreements (“SLAs”). Operational efficiency is achieved when the KPIs are managed near, but not above, SLA threshold levels.

Throughput is a measure of the number of calls/contact requests or work requests that may be processed in a given amount of time. Agent utilization is a measure of how efficiently the agents' time is being used. Customer service level is a measure of the time customers spend waiting for their work to be handled. Company contact center customers wish to provide service to as many requests as possible in a given amount of time, using the least number of agents to do so, and minimizing the wait time for their customers that may increase the Service Level Agreement (SLA) of the contact center. Further, the contact center may also have to maintain the Customer Satisfaction (CSAT) metrics in order to maintain the KPIs of the contact center. For this purpose, agents may have to maintain the quality of services provided to the customers through multimedia (e.g., voice calls, video calls, emails, etc.).

In today's communicatively connected world, the massive growth in information has been the key to the sustainable growth of the human race. To keep this sustainable growth intact, security of the information transferring from one point to another point holds primal importance. These days, hackers continuously try to steal crucial information from various enterprises such as financial institutions, insurance companies, health care service providers, consumer goods companies and so on. The modus operandi of these peoples are simple which is they pose as fake contact center agents on behalf of these enterprises, gather somehow some very basic information about the account holders who are having any kind of accounts at those enterprises and then trick those unsuspecting users to divulge a plurality of crucial personal information about themselves. Most of the times peoples who receive such calls from these fake agents do not have any way to verify the authenticity of the callers.

Further, to reduce costs of operating a contact center on their own, many enterprises outsource the responsibilities of running contact centers with smaller firms. In this way, a plurality of crucial user-related information is shared with many other people, some of whom may have ill intent. Due to this, users may also be hesitant to disclose their crucial personal information, which in turn may hamper the overall functionality of the contact center. In the initial five months of 2014, some of the United Kingdom's (UK's) top financial institutions have reported a combined loss of over £ 21 million due to multiple phishing attacks. Phishing attacks are the most common fraud attack in today's financial world, in which fake people pose as contact center agents of a financial institution, contact unsuspecting users having accounts with those financial institutions and trick those users to divulge their personal information. According to another statistic, for every 2000 phishing attacks, every person on an average loses more than £ 10,000.

Common conventional techniques to detect financial fraud include: verifying the caller by installing calling line identification (CLI); periodically receiving feeds from service providers; installing an app on a smartphone that can detect a bogus caller. Though each of these disclosed techniques may help to differentiate between an original contact center agent and a bogus agent, they are still not fully fraud proof. For example, hackers may easily hide their bogus calling numbers even from CLI or true caller so that they cannot be detected by those techniques. None of the current conventional techniques provide an approach by which a person who is receiving such a call from a bogus agent actually can validate the authenticity of the callers.

Thus, there is a need for a system and method to validate the authenticity of contact center agents to eliminate the risks of fraud.

SUMMARY

Embodiments in accordance with the present invention provide a system to authenticate the identities of the contact center agents. The authentication system maybe located inside a contact center server. The system includes a verification module configured to provide reference answers to at least one reference question asked by the user to validate the authenticity of the contact center agent. The user may provide the reference questions and their corresponding reference answers while registering with the enterprise network, and the reference questions and their corresponding reference answers are stored in a media server. The verification module fetches the reference answers from the media server and provides them to the user. A reference answer may also be referred to herein as a pre-recorded secret authentication message. “Secret” as used throughout herein may refer to something that is kept private and is known and/or verifiable only by an intended person. For example, a secret authentication message would be a message that only an intended person would know and can verify (e.g., because that person supplied the message).

Embodiments in accordance with the present invention further provide a computer-implemented method for authenticating identities of agents of an enterprise contact center. The method includes playing a pre-recorded secret authentication message to the user before initiating a conversation; verification done by the user about the authenticity of the caller after hearing the pre-recorded secret authentication message; and accepting the agent generated outbound call from the enterprise call center associated with the enterprise network by the user.

Embodiments in accordance with the present invention further provide a computer-implemented method for authenticating identities of agents of an enterprise contact center. The method includes playing a pre-recorded secret authentication message to the user before initiating a conversation wherein the pre-recorded secret authentication message may be generated by the user itself during registration with the enterprise network; verification done by the user about the authenticity of the caller after hearing the pre-recorded secret authentication message; and accepting the agent generated outbound call from the enterprise call center associated with the enterprise network by the user.

Embodiments of the present invention may provide a number of advantages depending on its particular configuration. The present application provides a system and a method to authenticate contact center agents by a reverse authentication procedure. The present application further provides two options for the reverse authentication procedure for the users to authenticate the calling agents. The first option is listening to a pre-recorded secret authentication message that was recorded and stored in an enterprise server by the user itself while registering with the enterprise network. The second option is to ask questions and retrieve the correct answers from the contact center, in which the questions and answers were recorded by the user when registering with the enterprise network. Further, the present application utilizes reverse authentication procedures to reduce the risk of receiving fraudulent calls from imposters posing as contact center agents and trying to steal information from unsuspecting people.

These and other advantages will be apparent from the present application of the embodiments described herein.

The preceding is a simplified summary to provide an understanding of some aspects of embodiments of the present invention. This summary is neither an extensive nor exhaustive overview of the present invention and its various embodiments. The summary presents selected concepts of the embodiments of the present invention in a simplified form as an introduction to the more detailed description presented below. As will be appreciated, other embodiments of the present invention are possible utilizing, alone or in combination, one or more of the features set forth above or described in detail below.

DETAILED DESCRIPTION

Embodiments of the present invention will be illustrated below in conjunction with an exemplary communication system, e.g., the Avaya Aura® system. Although well suited for use with, e.g., a system having an Automatic Call Distribution (ACD) or other similar contact processing switch, embodiments of the present invention are not limited to any particular type of communication system switch or configuration of system elements. Those skilled in the art will recognize the disclosed techniques may be used in any communication application in which it is desirable to provide improved contact processing.

The term “computer-readable medium” as used herein refers to any tangible storage and/or transmission medium that participate in providing instructions to a processor for execution. Such a medium may take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media includes, for example, NVRAM, or magnetic or optical disks. Volatile media includes dynamic memory, such as main memory. Common forms of computer-readable media include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, or any other magnetic medium, magneto-optical medium, a CD-ROM, any other optical medium, punch cards, paper tape, any other physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, a solid state medium like a memory card, any other memory chip or cartridge, a carrier wave as described hereinafter, or any other medium from which a computer can read.

A digital file attachment to e-mail or other self-contained information archive or set of archives is considered a distribution medium equivalent to a tangible storage medium. When the computer-readable media is configured as a database, it is to be understood that the database may be any type of database, such as relational, hierarchical, object-oriented, and/or the like. Accordingly, embodiments may include a tangible storage medium or distribution medium and prior art-recognized equivalents and successor media, in which the software embodiments of the present invention are stored.

The term “module” as used herein refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and software that is capable of performing the functionality associated with that element. Also, while the present invention is described in terms of exemplary embodiments, it should be appreciated those individual aspects of the present invention can be separately claimed.

A module that performs a function also may be referred to as being configured to perform the function, e.g., a data module that receives data also may be described as being configured to receive data. Configuration to perform a function may include, for example: providing and executing computer code that performs the function; providing provisionable configuration parameters that control, limit, or enable capabilities of the module (e.g., setting a flag, setting permissions, setting threshold levels used at decision points, etc.); providing a physical connection, such as a jumper to select an option, or to enable/disable an option; attaching a physical communication link; enabling a wireless communication link; energizing a circuit that performs the function (e.g., providing power to a transceiver circuit in order to receive data); and so forth.

The term “switch” or “server” as used herein should be understood to include a Private Branch Exchange (PBX), an ACD, an enterprise switch, or other type of communications system switch or server, as well as other types of processor-based communication control devices such as media servers, computers, adjuncts, etc.

FIG. 1Ashows an illustrative embodiment of the present invention. A contact center100comprises a server110, a set of data stores or databases114containing contact or customer related information, resource or agent related information and other information that may enhance the value and efficiency of the contact processing, and a plurality of servers, namely a voice mail server118, an Interactive Voice Response unit (e.g., IVR)122, and other servers126, a switch130, a plurality of working agents operating packet-switched (first) communication devices134-1-N (such as computer work stations or personal computers), and/or circuit-switched (second) communication devices138-1-M, all interconnected by a Local Area Network (LAN)142, (or Wide Area Network (WAN)). In another embodiment of the present invention, the customer and agent related information may be replicated over multiple repositories.

The servers may be connected via optional communication lines146to the switch130. As will be appreciated, the other servers126may also include a scanner (which is normally not connected to the switch130or Web Server), VoIP software, video call software, voice messaging software, an IP voice server, a fax server, a web server, an email server, and the like. The switch130is connected via a plurality of trunks to a circuit-switched network150(e.g., Public Switch Telephone Network (PSTN)) and via link(s)154to the second communication devices138-1-M. A security gateway158is positioned between the server110and a packet-switched network162to process communications passing between the server110and the packet-switched network162. In an embodiment of the present invention, the security gateway158(as shown inFIG. 1A) may be a G700 Media Gateway™ from Avaya Inc., or may be implemented as hardware such as via an adjunct processor (as shown) or as a chip in the server110.

The switch130and/or server110may be any architecture for directing contacts to one or more communication devices. In some embodiments of the present invention, the switch130may perform load-balancing functions by allocating incoming or outgoing contacts among a plurality of logically and/or geographically distinct contact centers. Illustratively, the switch130and/or server110may be a modified form of the subscriber-premises equipment sold by Avaya Inc. under the names Definity™ Private-Branch Exchange (PBX) based ACD system, MultiVantage™ PBX, Communication Manager™, S8300™ media server and any other media servers, SIP Enabled Services™, Intelligent Presence Server™, and/or Avaya Interaction Center™, and any other products or solutions offered by Avaya or another company. Typically, the switch130/server110is a stored-program-controlled system that conventionally includes interfaces to external communication links, a communications switching fabric, service circuits (e.g., tone generators, announcement circuits, etc.), memory for storing control programs and data, and a processor (i.e., a computer) for executing the stored control programs to control the interfaces and the fabric and to provide ACD functionality. Other types of known switches and servers are well known in the art and therefore not described in detail herein.

The first communication devices134-1-N are packet-switched and may include, for example, IP hardphones such as the 4600 Series IP Phones™ from Avaya, Inc., IP softphones such as an IP Softphone™ from Avaya Inc., Personal Digital Assistants (PDAs), Personal Computers (PCs), laptops, packet-based H.320 video phones and conferencing units, packet-based voice messaging and response units, packet-based traditional computer telephony adjuncts, peer-to-peer based communication devices, and any other communication device.

The second communication devices138-1-M are circuit-switched devices. Each of the second communication devices138-1-M corresponds to one of a set of internal extensions Ext-1-M, respectively. The second communication devices138-1-M may include, for example, wired and wireless telephones, PDAs, H.320 videophones and conferencing units, voice messaging and response units, traditional computer telephony adjuncts, and any other communication devices.

It should be noted that the embodiments of present invention do not require any particular type of information transport medium between switch, or server and first and second communication devices, i.e., the embodiments of the present invention may be implemented with any desired type of transport medium as well as combinations of different types of transport channels.

The packet-switched network162may be any data and/or distributed processing network, such as the Internet. The packet-switched network162typically includes proxies (not shown), registrars (not shown), and routers (not shown) for managing packet flows.

The packet-switched network162as shown inFIG. 1Ais in communication with a first communication device166via a security gateway170, and the circuit-switched network150with an external second communication device174.

In one configuration, the server110, the packet-switched network162, and the first communication devices134-1-N are Session Initiation Protocol (SIP) compatible and may include interfaces for various other protocols such as the Lightweight Directory Access Protocol (LDAP), H.248, H.323, Simple Mail Transfer Protocol (SMTP), IMAP4, ISDN, E1/T1, and analog line or trunk.

It should be emphasized that the configuration of the switch130, the server110, user communication devices, and other elements as shown inFIG. 1Ais for purposes of illustration only and should not be construed as limiting embodiments of the present invention to any particular arrangement of elements.

Further, the server110is notified via the LAN142of an incoming service request or work item by the communications component (e.g., switch130, a fax server, an email server, a web server, and/or other servers) receiving the incoming service request as shown inFIG. 1A. The incoming service request is held by the receiving telecommunications component until the server110forwards instructions to the component to forward or route the contact to a specific contact center resource, such as the IVR unit122, the voice mail server118, and/or first or second telecommunication device134-1-N,138-1-M associated with a selected agent.

FIG. 1Billustrates at a relatively high-level hardware abstraction a block diagram of a server such as the server110, in accordance with an embodiment of the present invention. The server110may include an internal communication interface151that interconnects a processor157, a memory155and a communication interface circuit159. The communication interface circuit159may include a receiver and transmitter (not shown) to communicate with other elements of the contact center100such as the switch130, the security gateway158, the LAN142, and so forth. By use of programming code and data stored in the memory155, the processor157may be programmed to carry out various functions of the server110.

Although embodiments are discussed with reference to client-server architecture, it is to be understood that the principles of embodiments of the present invention apply to other network architectures. For example, embodiments of the present invention apply to peer-to-peer networks, such as those envisioned by the Session Initiation Protocol (SIP). In the client-server model or paradigm, network services and the programs used by end users to access the services are described. The client side provides a user with an interface for requesting services from the network, and the server side is responsible for accepting user requests for services and providing the services transparent to the user. By contrast in the peer-to-peer model or paradigm, each networked host runs both the client and server parts of an application program. Additionally, embodiments of the present invention do not require the presence of packet- or circuit-switched networks.

The term “switch” or “server” as used herein should be understood to include a Private Branch Exchange (PBX), an ACD, an enterprise switch, an enterprise server, or other type of telecommunications system switch or server, as well as other types of processor-based communication control devices such as media servers, computers, adjuncts, etc.

Referring toFIG. 2, one possible configuration of the server110is depicted. The server110is in communication with a plurality of customer communication lines200a-y(which can be one or more trunks, phone lines, etc.) and agent communication line204(which can be a voice-and-data transmission line such as the LAN142and/or a circuit switched voice line). The server110can include Avaya Inc.'s an Operational Analyst™ (OA) with On-Line Analytical Processing (OLAP) technology, or a Call Management System (CMS)228that gathers profile of agents of the contact center and monitors current status of the agents and parameters of the received work requests. OA and CMS will hereinafter be referred to jointly as CMS228.

As can be seen inFIG. 2, included among the data stored in the server110is a set of contact queues or work request queues208a-nand a separate set of agent queues212a-n. Each work request queue208a-ncorresponds to a different set of agent queues, as does each agent queue212a-n. Conventionally, a contact is prioritized and either is enqueued in individual ones of the contact queues208a-nin their order of priority or is enqueued in different ones of a plurality of contact queues208a-nthat correspond to a different priority. Likewise, each agent's queue212a-nis prioritized according to his or her level of expertise or skill in that queue, and an agent is either enqueued in one of an individual agent queues212a-nin their order of expertise level, or is enqueued in a different one of a plurality of agent queues212a-nthat correspond to a queue, and each queue corresponds to a different expertise level.

Included among the control programs in the server110is a work request vector216. Contacts incoming to the contact center are assigned by the work request vector216to different work request queues208a-nbased upon a number of predetermined criteria, including customer identity, customer needs, contact center needs, current contact center queue lengths, customer value, and the agent skill that is required for the proper handling of the contact. Agents who are available for handling work requests are assigned to the agent queues212a-nbased upon the skills that they possess. An agent may have multiple skills, and hence may be assigned to multiple agent queues212a-nsimultaneously. Furthermore, an agent may have different levels of skill expertise (e.g., skill levels1-N in one configuration or merely primary skill levels and secondary skill levels in another configuration), and hence may be assigned to different agent queues212a-nat different expertise levels.

In one configuration, the contact center is operated by a contract operator (e.g., a supervisor or a manager of the contact center), and each of the work request queues208a-n, and possibly each of the agent queues212a-n, corresponds to a different client. Each client can have a separate service level agreement or other type of performance measurement agreement with the contract operator regarding performance expectations, goals, requirements or specifications for the client's respective queue(s). The service level agreement can set forth penalties, such as financial penalties, for failing to comply with the service level agreement's requirements.

Further, embodiments in accordance with the present invention may include, among the programs executing on the server110, an agent selector220and an agent authentication system224. The agent selector220and the agent authentication system224are stored either in the main memory or in a peripheral memory (e.g., disk, CD ROM, etc.) or some other computer-readable medium of the contact center100. Further, the agent selector220monitors the occupants of the work item and agent queues208a-nand212a-n, respectively, and contact center objectives, rules, and policies and assigns agents to service work items.

The agent selector220distributes and connects these work items to communication devices of available agents based on the predetermined criteria noted above. When the agent selector220forwards a contact (or first work item) to an agent, the agent selector220also forwards customer-related information from the database114to the agent's desktop or computer work station for previewing and/or viewing (such as by a pop-up display) to enable the agent for providing better services to the customer. Depending on the contact center configuration, the agent selector224may reallocate the work items to the agents of the contact center100. The agents process the contacts or work items sent to them by the agent selector220.

According to an embodiment of the present invention, the agent authentication system224is configured to validate the authenticity of the calling agents. The agent authentication system224includes a certain module, such as, but is not restricted to, a verification module226. In some embodiments, the verification module226may be implemented by one or more software processes running on the server110. The server110may implement one or more software processes by use of the processor157being suitably programmed by use of software instructions stored in the memory155coupled to the processor157.

The verification module226may validate the authenticity of the agents the contact center100according to an embodiment of the present invention. The type of the call, i.e., whether the call made by an agent is a voice call, a video call, a text message, an email, an instant messaging, a Voice over Internet Protocol (VoIP), and so forth.

According to an embodiment of the present invention,FIG. 3illustrates a representation about a possible implementation scenario of forming a communication session path in between a user302, a contact center100which includes a server110, a contact center agent308and a media server306. The contact center100, the contact center agent308and the media server306may all be located inside an enterprise network304. The server110may include an agent authentication system224where the agent authentication system224may also include a verification module226.

During registration with the enterprise network304, the user302may record a secret authentication message, which may also be referred to as a reference message. Further, the user302may also record at least one security question and its corresponding answer. The corresponding answer may also be referred to as a reference answer. The enterprise network304may store in the media server306information related to user302along with the secret authentication message and the security questions and their answers.

When the user302receives a call from the contact center agent308of the contact center100, the server110automatically fetches the pre-recorded secret authentication message from the media server306and plays it for the user302to hear. After hearing the pre-recorded secret authentication message, which the server110played for the user302, the user302is more assured that the contact center agent308who is calling on behalf of the enterprise network304is genuine. After verification, the user302may accept the call received from the contact center agent308and continue discussion. The details of the call may include, a type of call, i.e., whether the call received by the user302from the agent308is a voice call, a video call, a text message, an email, an instant message, a Voice over Internet Protocol (VoIP), and so forth.

Assuming user302recorded at least one security question and its related answer, and that they were saved in media server306, contact center100may route the call to verification module226, either automatically or on request of user302. Verification module226is located inside agent authentication system224. During verification, user302may ask a pre-recorded question, which is routed to verification module226. Verification module226may fetch the corresponding pre-recorded answer from media server306and provide the pre-recorded answer back to user302. If user302hears the expected answer, user302will be more assured that contact center agent308is an agent representing enterprise network304.

The recorded secret authentication message provided by user302during registration may at least be one of a secret phrase or a secret number. User302may enter the secret phrase or the secret number during registration with the enterprise network304at least by a text message or a voice message.

If the recorded secret authentication message is a voice message, the agent authentication system224located inside the server110may fetch the voice message and delivers it to the user302. If the secret authentication is a text message, then the agent authentication system224may fetch the text messages, converts the text message to speech messages and then deliver them to the user302for the authentication purpose.

According to an embodiment of the present invention,FIG. 4illustrates a representation about a possible implementation scenario of forming a communication session path in between a user402, a contact center100which may include a server110, a contact center agent410and a media server406. The contact center100and the media server406may be located in a separate authentication server404. The authentication server404may be controlled by a separate agency that provides authentication services. The contact center agent410may be located inside an enterprise network408. The enterprise network408may have outsourced the authentication service provisioning to the separate agency that maintains the authentication server404. The server110may include an agent authentication system224where the agent authentication system224may also include a verification module226.

During registration with the enterprise network408, the user402may record a secret authentication message, which may also be referred to as a reference message. Further, the user402may also record at least one security question and its corresponding answer. The corresponding answer may also be referred to as a reference answer. The enterprise network408may store in the media server406information related to user402along with the secret authentication message and the security questions and their answers. Media server406may be located in the separate authentication server404governed by the separate agency. The enterprise network408may form a secured connection with the authentication server404to access information related to user402along with the secret authentication message and the security questions and their answers. After forming the secured connection with the authentication server404, the enterprise network410may route all calls with the user402through the authentication server404

When the user402receives a call from the contact center agent410of the contact center100, the server110may automatically fetch the pre-recorded secret authentication message from the media server406and plays it for the user402to hear. After hearing the pre-recorded secret authentication message, the user402is more assured that the contact center agent410who is calling on behalf of the enterprise network408is genuine. After verification, the user402may accept the call received from the contact center agent410and an authenticated media session starts between the user402and the contact center agent410. The details of the call may include, a type of call, i.e., whether the call received by the user302from the agent308is a voice call, a video call, a text message, an email, an instant message, a Voice over Internet Protocol (VoIP), and so forth.

During verification, contact center100, either on the request of the user402or automatically, may route the call towards the verification module226which is located inside the agent authentication system224. The user402may ask at least one those pre-recorded questions to the verification module226. The verification module226may fetch the corresponding pre-recorded answers from the media server406and provide them back to the user402. After hearing the appropriate answers to the asked questions the user402may become more assured sure that the contact center agent410is a genuine agent representing the enterprise network408.

The user402recorded secret authentication message during registration with the enterprise network410may at least be one of a secret phrase or a secret number. The user402may enter the secret phrase or the secret number during registration with the enterprise network304at least by a text message or a voice message.

If the recorded secret authentication message is a voice message, the agent authentication system224located inside the server110of the contact center100fetches the voice message and delivers it to the user402. If the recorded secret authentication is a text message, then the agent authentication system224may convert the text message to a speech message and delivers the speech message back to the user402for the authentication purpose.

According to an embodiment of the present invention,FIG. 5illustrates an alternative architectural representations to form a communication session path between a user502, an EDP504, a media server506and a calling agent510, when the EDP504, the media server506and the calling agent510all are located inside an enterprise network508, according to an embodiment of the present invention. EDP504may integrate existing and new applications with any unified communication technology setup having contact center100capabilities, which may include voice, video, text and email communications. The EDP504may also include an agent authentication system224where the agent authentication system224may also include a verification module226.

During registration with the enterprise network510, the user502may record a secret authentication message, which may also be referred to as a reference message. Further, the user502may also record at least one security question and its corresponding answer. The corresponding answer may also be referred to as a reference answer. The enterprise network510may store in the media server506information related to user502along with the secret authentication message and the security questions and their answers.

When the user502receives a call from the contact calling agent308of the contact center100, the EDP504may automatically fetch the pre-recorded secret authentication message from the media server506and play it for the user502to hear. After hearing the pre-recorded secret authentication message, the user502is more assured that the calling agent508who is calling on behalf of the enterprise network510is genuine. After verification, the user502may accept the call received from the calling agent508and continue discussion. The details of the call may include, a type of call, i.e., whether the call received by the user502from the agent508is a voice call, a video call, a text message, an email, an instant message, a Voice over Internet Protocol (VoIP), and so forth.

During verification, EDP504, either automatically or on the request of the user502, may route the call towards the verification module226, which is located inside the agent authentication system224. The user502may ask at least one those pre-recorded questions to the verification module226. The verification module226may fetch the corresponding pre-recorded answers from the media server506and provide them back to the user502. After hearing the pre-recorded answers, user502may be more assured that the calling agent508is genuine and may continue the conversation.

The secret authentication message recorded by user502during registration with the enterprise network510may at least be one of a secret phrase or a secret number. The user502may enter the secret phrase or the secret number during registration with the enterprise network510at least by a text message or a voice message.

If the secret authentication message is a voice message, the agent authentication system224located inside the EDP504may fetch the voice message and delivers it to the user502. If the secret authentication message is a text message, then the agent authentication system224may convert the text messages to speech messages and delivers them back to the user502for the authentication purpose.

According to an embodiment of the present invention,FIG. 6illustrates an alternative architectural representation to form a communication session path between a user602, an EDP504, a media server604and a calling agent610. EDP504and the media server604are located inside an authentication server606, which may be separate from an enterprise network608. The authentication server606may be controlled by a separate agency that provides authentication services. The calling agent610may be located inside the enterprise network608. The enterprise network608may have outsourced the authentication service provisioning to the separate agency that maintains the authentication server606. The EDP504may include an agent authentication system224where the agent authentication system224may also include a verification module226.

During registration with the enterprise network608, the user602may record a secret authentication message, which may also be referred to as a reference message. Further, the user602may also record at least one security question and its corresponding answer. The corresponding answer may also be referred to as a reference answer. The enterprise network608may store in the media server604information related to user602along with the secret authentication message and the security questions and their answers. Media server604may be located in the separate authentication server606governed by the separate agency. The enterprise network608may form a secured connection with the authentication server606to access information related to user302along with the pre-recorded secret authentication message and the security questions and their answers. After forming the secured connection with the authentication server606, the enterprise network608may route all calls with the user602through the authentication server606.

When the user602receives a call from the calling agent610of the enterprise network608, the EDP504may automatically fetch the pre-recorded secret authentication message from the media server604and plays it for the user602to hear. After hearing the pre-recorded secret authentication message, the user402is more assured that the calling agent610who is calling on behalf of the enterprise network608is genuine. After verification, the user602may accept the call received from the calling agent610and an authenticated media session starts between the user602and the calling agent610. The details of the call may include, a type of call, i.e., whether the call received by the user602from the agent610is a voice call, a video call, a text message, an email, an instant message, a Voice over Internet Protocol (VoIP), and so forth.

During verification, EDP504, either automatically or on the request of the user602, may route the call to verification module226inside the agent authentication system224. The user602may ask a pre-recorded question to the verification module226. The verification module226may fetch the corresponding pre-recorded answer from the media server604and provide the answer back to the user602. After hearing the pre-recorded answer, the user602may be more assured that the calling agent610is a genuine agent representing the enterprise network608.

The secret authentication message recorded by user602during registration may at least be one of a secret phrase or a secret number. The user602may enter the secret phrase or the secret number during registration with the enterprise network608at least by a text message or a voice message.

If secret authentication message is a voice message, the agent authentication system224located inside the EDP504may fetch the voice message and delivers it to the user602. If the secret authentication message is a text message, then the agent authentication system224may convert the text message to a speech message and delivers them back to the user602for the authentication purpose.

According to an embodiment of the present invention,FIG. 7illustrates an alternative implementation of the current invention on a POM704, according to an embodiment of the present invention.

POM704is a software which may initiate an outbound call towards a customer702and when the customer702answers the outbound call, POM704may connect the customer702with a POM Agent706.

FIG. 8depicts a flowchart of a method800for managing a communication session in the contact center100, according to an embodiment of the present invention.

At step802, an agent of the contact center100may generate an outbound call towards a user who is registered with the enterprise, which the contact center is representing. In one embodiment of the present invention, the user while registering with the enterprise network may record a secret authentication message, which may be stored in a media server of the enterprise network. The user may also record at least one security question and its relevant answer where both the security question and the answer also may be stored in the enterprise media server. The contact center server may also include an agent authentication system, which may include a verification module. The stored secret authentication message may at least be a secret phrase or a secret number. The user may store the secret phrase or the secret number at least by a text message or a voice message.

At step804, when the user picks up the call, the contact center server may fetch the stored secret authentication message from the enterprise media server and plays to the user. If the secret authentication message was stored as a text message, the agent authentication system may convert the text message to a voice message and deliver it to the user.

At step806, the user decides if the secret voice authentication message is genuine or not.

At step808, if the recorded voice is genuine the user accepts the call from the agents and continues the communication.

At step810, if the recorded voice is not genuine the user denies the incoming call.

FIG. 9depicts a flowchart of a method800for managing a communication session in the contact center100, according to another embodiment of the present invention.

At step902, an agent of the contact center100may generate an outbound call towards a user who is registered with the enterprise, which the contact center is representing. In one embodiment of the present invention, the user may also record at least one security question and its relevant answer where both the security question and the answer also may be stored in the enterprise media server.

At step904, the user decides to ask at least one security question to the contact center to verify the authenticity of the contact center agent.

At step906, the contact center server, either automatically or based on user request, routes the call to the verification module.

At step908, the verification module fetches the appropriate reply from the media server and replies back to the user.

At step910, the user decides if the reply matches.

At step912, if the reply matches then the user accepts the call.

At step914, if the reply does not match then the user denies the call.

The exemplary embodiments of this present invention have been described in relation to a contact center. However, to avoid unnecessarily obscuring the present invention, the preceding description omits a number of known structures and devices. This omission is not to be construed as a limitation of the scope of the present invention. Specific details are set forth by use of the embodiments to provide an understanding of the present invention. It should however be appreciated that the present invention may be practiced in a variety of ways beyond the specific embodiments set forth herein.

Furthermore, while the exemplary embodiments of the present invention illustrated herein show the various components of the system collocated, certain components of the system can be located remotely, at distant portions of a distributed network, such as a LAN and/or the Internet, or within a dedicated system. Thus, it should be appreciated, that the components of the system can be combined in to one or more devices, such as a switch, server, and/or adjunct, or collocated on a particular node of a distributed network, such as an analog and/or digital telecommunications network, a packet-switch network, or a circuit-switched network.

It will be appreciated from the preceding description, and for reasons of computational efficiency, the components of the system can be arranged at any location within a distributed network of components without affecting the operation of the system. For example, the various components can be located in a switch such as a PBX and media server, gateway, in one or more communications devices, at one or more users' premises, or some combination thereof. Similarly, one or more functional portions of the system could be distributed between a telecommunications device(s) and an associated computing device.

Also, while the flowcharts have been discussed and illustrated in relation to a particular sequence of events, changes, additions, and omissions to this sequence can occur without materially affecting the operation of embodiments of the present invention.

A number of variations and modifications of the present invention can be used. It would be possible to provide for some features of the present invention without providing others.

For example in one alternative embodiment of the present invention, the systems and methods of this present invention can be implemented in conjunction with a special purpose computer, a programmed microprocessor or microcontroller and peripheral integrated circuit element(s), an ASIC or other integrated circuit, a digital signal processor, a hard-wired electronic or logic circuit such as discrete element circuit, a programmable logic device or gate array such as PLD, PLA, FPGA, PAL, special purpose computer, any comparable means, or the like.

In general, any device(s) or means capable of implementing the methodology illustrated herein can be used to implement the various aspects of this present invention. Exemplary hardware that can be used for the present invention includes computers, handheld devices, telephones (e.g., cellular, Internet enabled, digital, analog, hybrids, and others), and other hardware known in the art. Some of these devices include processors (e.g., a single or multiple microprocessors), memory, non-volatile storage, input devices, and output devices. Furthermore, alternative software implementations including, but not limited to, distributed processing or component/object distributed processing, parallel processing, or virtual machine processing can also be constructed to implement the methods described herein.

Although the present invention describes components and functions implemented in the embodiments with reference to particular standards and protocols, it is not limited to such standards and protocols. Other similar standards and protocols not mentioned herein are in existence and considered to be included in the present invention. Moreover, the standards and protocols mentioned herein and other similar standards and protocols not mentioned herein are periodically superseded by faster or more effective equivalents having essentially the same functions. Such replacement standards and protocols having the same functions are considered equivalents included in the present invention.

The foregoing discussion of the present invention has been presented for purposes of illustration and description. It is not intended to limit the present invention to the form or forms disclosed herein. In the foregoing Detailed Description, for example, various features of the present invention are grouped together in one or more embodiments, configurations, or aspects for the purpose of streamlining the disclosure. The features of the embodiments, configurations, or aspects may be combined in alternate embodiments, configurations, or aspects other than those discussed above. This method of disclosure is not to be interpreted as reflecting an intention the present invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment, configuration, or aspect. Thus, the following claims are hereby incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of the present invention.