Source: https://patents.google.com/patent/US8661520B2/en
Timestamp: 2019-10-22 02:08:57
Document Index: 257293772

Matched Legal Cases: ['Application No. 07', 'Application No. 07', 'Application No. 07', 'Application No. 07', 'Application No. 07', 'Application No. 07']

US8661520B2 - Systems and methods for identification and authentication of a user - Google Patents
Systems and methods for identification and authentication of a user Download PDF
US8661520B2
US8661520B2 US11/562,330 US56233006A US8661520B2 US 8661520 B2 US8661520 B2 US 8661520B2 US 56233006 A US56233006 A US 56233006A US 8661520 B2 US8661520 B2 US 8661520B2
US11/562,330
US20080120717A1 (en
2006-11-21 Application filed by Rajesh G. Shakkarwar filed Critical Rajesh G. Shakkarwar
2006-11-21 Priority to US11/562,330 priority Critical patent/US8661520B2/en
2007-11-21 Priority claimed from PCT/US2007/085332 external-priority patent/WO2008127431A2/en
2008-05-22 Publication of US20080120717A1 publication Critical patent/US20080120717A1/en
2014-02-25 Publication of US8661520B2 publication Critical patent/US8661520B2/en
2017-03-29 Assigned to VERIENT, INC. reassignment VERIENT, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: SHAKKARWAR, RAJESH G.
The present invention generally relates to a computer security system for use in the identification and authentication of a user prior to an on-line transaction. In one aspect, a method for enrolling a user in a system configured to identify and authenticate the user is provided. The method includes collecting a username and password to identify the user. The method further includes extracting device data from a user machine to uniquely identify the machine. The method also includes generating a user profile based upon the device data and the username and password. Additionally, the method includes transmitting the user profile to a server machine to be stored. In another aspect, a computer-readable medium including a set of instructions that when executed by a processor cause the processor to enroll a user in a system configured to identify and authenticate the user is the provided. In yet a further aspect, a system for identifying and authenticating a user is provided.
The present invention generally relates to a computer security system for use in the identification and authentication of a user prior to an on-line transaction. In one aspect, a method for enrolling a user in a system configured to identify and authenticate the user is provided. The method includes collecting a username and password to identify the user. The method further includes extracting device data from a user machine to uniquely identify the machine. The method also includes generating a user profile based upon the device data and the username and password. Additionally, the method includes transmitting the user profile to a server machine to be stored.
In another aspect, a computer-readable medium including a set of instructions that when executed by a processor cause the processor to enroll a user in a system configured to identify and authenticate the user is provided. The processor performs the step of collecting a username and password to identify the user. The processor also performs the step of extracting device data from a user machine to uniquely identify the machine. Further, the processor performs the step of generating a user profile based upon the device data and the username and password. Additionally, the processor performs the step of transmitting the user profile to a server machine to be stored.
In yet a further aspect, a system for identifying and authenticating a user is provided. The system includes a server machine that includes a user profiles database. The system also includes a computing device having a processor and a memory. The memory includes a security agent program configured to collect a username and password to identify the user. The security agent program is also configured to extract device data from a user machine to uniquely identify the machine. Further, the security agent program is configured to generate a user profile based upon the device data and the username and password. Additionally, the security agent program is configured to transmit the user profile to the server machine for storage in the user profiles database.
In step 245, the verified user identity from step 215 is connected (or bound) to the user identity profile 115 which generally comprises the data collected in steps 230-240. The connecting (or binding) of the verified user identity to the factors of authentication allows the user to engage in the secure access transaction 300 or the secure payment transaction 400 without having to repeat the enrollment steps. In other words, the binding of the identity with the factors of authentication eliminates the cumbersome process of proving the identity of the user at every transaction while providing the same level of security as though the user answered the identity questions (the specific personal questions) every time.
In steps 330 and 335, the authentication server 125 verifies that the identity data collected in steps 320 and 325 matches the data included in the user profile previously stored in the user profiles database 130 on the authentication server 125. If the idenity data collected in steps 320 and 325 does not match the user profile in the user profiles database 130, then an exception process is activated in step 340. Depending on the type of mismatch, the exception process in step 340 may include limited access to the account or the exception process may require the collection of additional data or that the user to go through the enrollment process 200 again. For instance, if there is small mismatch, such as a wrong geolocation due to the user travelling or a different hard drive serial number due the user upgrading the user machine, then the user may still be allowed access to the account after collecting additional data. If there is a large mismatch, then the user may be required to go through the enrollment process 200 again in order to establish the identity of the user and the factors of authentication. If the identity data collected in steps 320 and 325 does match the user profile in the user profiles database 130, then the user is allowed access in step 345 to the account at the institution.
In step 405, the security agent 110 prompts the user to enter his or her username and/or password in order to determine the first factor of authentication. In one embodiment, the user enters his or her username and/or password through the standard key entry method of the user machine 105. In another embodiment, referring now to FIG. 6, the security agent 110 prompts the user to enter a username and/or password directly in a box 615 by using a keypad 610 on the security agent 110. The keypad 610 is manipulated by using a mouse (not shown) to push the buttons on the keypad 610. Placing the keypad 610 on the security agent 110 is a security mechanism designed to prevent a keylogger from monitoring and stealing the password. In other words, if the password were entered into the box 615 by using a standard keyboard (not shown), then a keylogger may be able to monitor the keystrokes of the user and steal the password. As a further security mechanism, the location of the keys on keypad 610 will systematically change between uses to prevent a mouse logger from monitoring and stealing the password. Additionally, since the security agent 110 directly communicates with the authentication server 125 rather than through a conventional webpage, the threat of “phishing” by presenting the user with bogus webpages is eliminated. One skilled in the art will recognize that the security mechanisms set forth herein may be equally applicable to any transaction that involves the security agent 110, such as the enrollment process 200 or the secure access transaction 300.
In steps 430 and 435, the authentication server 125 verifies that the identity data collected in steps 420 and 425 matches the data included in the user profile previously stored in the user profiles database 130 on the authentication server 125. If the identity data collected in steps 420 and 425 does not match the user profile in the user profiles database 130, then an exception process is activated in step 440. Depending on the type of mismatch, the exception process in step 440 may allow a payment of a reduced amount to be made during the secured payment transaction or the exception process may require the user to go through the enrollment process 200 again. For instance, if there is small mismatch, such as a wrong geolocation due to the user travelling or a different hard drive serial number due the user upgrading the user machine, then the user may still be allowed to make an online payment after collecting additional data. If there is a large mismatch, then the user may be required to go through the enrollment process 200 again in order to establish the identity of the user and the factors of authentication before proceeding in the secure payment transaction 400. If the identity data collected in steps 420 and 425 does match the user profile in the user profiles database 130, then the security agent connects to the user financial institution server 140 in step 445 via the network 120.
1. A method for enrolling a user in a system configured to identify and authenticate the user, the method comprising:
collecting a username and password to identify the user;
extracting device data from a user machine to uniquely identify the user machine;
generating a user profile based upon the device data, and the username and password;
encrypting the user profile using a public key;
transmitting the encrypted user profile to a server machine to be stored;
verifying an identity of the user to create a verified user identity;
decrypting the encrypted user profile using a recipient private key;
issuing one-time payment credentials to the user that are valid for only a single payment transaction;
receiving the one-time payment credentials at the server machine and replacing the one-time payment credentials with a real account information underlying the one-time payment credentials; and
sending the user's real account information to a financial institution for processing.
2. The method of claim 1, wherein the one-time payment credentials include an account number, an expiration date and a security code.
3. The method of claim 1, further comprising the step of binding the verified user identity with the user profile.
4. The method of claim 3, wherein the step of binding the verified user identity with the user profile eliminates the identity verification of the user at each transaction.
5. The method of claim 1, wherein the step of verifying the identity of the user comprises prompting the user to answer at least one specific personal question and comparing the user's answer to a known answer.
6. The method of claim 5, wherein the known answer is from an institution data base or a third party data base.
7. The method of claim 2, wherein the account number, expiration date and the security code are automatically input into respective payment fields of a web page.
8. The method of claim 1, wherein the extracted device data may include a device ID, a vender ID, information in a Microcode patch, data accessed through PCI configuration space or data accessed through a SMM memory space.
9. The method of claim 1, wherein the extracted device data may include chipset hidden and/or unhidden registers, graphics card hidden and/or unhidden registers, interrupt routing, GPIO routing, PCI Device Select routing or a directory structure.
10. The method of claim 1, wherein the extracted device data may include installed applications, data at different locations in firmware, a memory type, or a memory clock speed.
11. The method of claim 1, wherein the extracted device data may include an amount of memory, a size of a hard drive, or a name of a maker of the hard drive.
12. The method of claim 1, wherein the extracted device data may include a MAC address, a hard drive serial number, a check sum of firmwares/BIOS, or an operating system registry.
13. The method of claim 1, wherein the extracted device data may include a CPU type, a CPU version, or a CPU clock speed.
14. The method of claim 1, further comprising the step of encrypting the user profile before transmitting the user profile to the server machine.
15. The method of claim 1, wherein the extracted device data may include machine level attributes and/or system level attributes and/or system patterns and/or user machine geo location.
collecting biometric data from the user to identify the user of the machine, wherein the user profile is further based on the collected biometric data.
17. The method of claim 16, wherein the biometric data may include typing patterns of the user, fingerprint data, or iris pattern data.
18. The method of claim 1, wherein the one-time payment credentials is generated by the server machine.
19. A non-transitory computer-readable medium including a set of instructions that when executed by a processor cause the processor to enroll a user in a system configured to identify and authenticate the user, by performing the steps of:
extracting device data from a user machine to uniquely identify the machine;
20. The non-transitory computer-readable medium of claim 19, wherein the server machine binds a verified user identity with the user profile.
21. The non-transitory computer-readable medium of claim 20, wherein the verified user identity is generated after prompting the user to answer at least one specific personal question and comparing the user's answer to a known answer.
22. The non-transitory computer-readable medium of claim 19, wherein the extracted device data may include machine level attributes and/or system level attributes and/or system patterns and/or a geo location of the user machine.
23. The non-transitory computer-readable medium of claim 19, further comprising the step of encrypting the user profile before transmitting the user profile to the server machine.
24. The non-transitory computer-readable medium of claim 19, further comprising:
25. A system for identifying and authenticating a user, the system comprising:
a server machine that includes a user profiles database; and
a computing device having a processor and a memory, wherein the memory includes a security agent program configured to:
collect a username and password to identify the user;
extract device data from the computing device to uniquely identify the computing device;
generate a user profile based upon the device data and the username and password;
encrypt the user profile with a public key;
transmit the encrypted user profile to the server machine to be stored;
receiving the one-time payment credentials at the server machine and replacing the one-time payment credentials with a real account information underlying the one-time payment credentials; and sending the user's real account information to a financial institution for processing.
26. The system of claim 25, wherein the server machine is configured to bind a verified user identity with the user profile.
27. The system of claim 25, wherein the extracted device data may include machine level attributes and/or system level attributes and/or system patterns and/or computing device geo location.
28. The system of claim 25, further comprising;
collecting biometric data from the user to identify the user of the computing device, wherein the user profile is further based on the collected biometric data.
US11/562,330 2006-11-21 2006-11-21 Systems and methods for identification and authentication of a user Active 2030-03-02 US8661520B2 (en)
US11/562,330 US8661520B2 (en) 2006-11-21 2006-11-21 Systems and methods for identification and authentication of a user
PCT/US2007/085332 WO2008127431A2 (en) 2006-11-21 2007-11-21 Systems and methods for identification and authentication of a user
EP07873624A EP2095221A4 (en) 2006-11-21 2007-11-21 Systems and methods for identification and authentication of a user
US20080120717A1 US20080120717A1 (en) 2008-05-22
US8661520B2 true US8661520B2 (en) 2014-02-25
ID=39418429
US11/562,330 Active 2030-03-02 US8661520B2 (en) 2006-11-21 2006-11-21 Systems and methods for identification and authentication of a user
US (1) US8661520B2 (en)
US8751816B2 (en) * 2008-10-22 2014-06-10 Hewlett-Packard Development Company, L.P. Method and system for providing recording device privileges through biometric assessment
JPH02101573A (en) 1988-10-11 1990-04-13 Casio Comput Co Ltd Releasing method for function stopping state due to discordance of personal identification number
US20020053035A1 (en) 2000-06-06 2002-05-02 Daniel Schutzer Method and system for strong, convenient authentication of a web user
WO2003038719A1 (en) 2001-10-31 2003-05-08 Arcot Systems, Inc. One-time credit card number generator and single round-trip authentication
US20050119979A1 (en) 2002-07-04 2005-06-02 Fujitsu Limited Transaction system and transaction terminal equipment
US20070142032A1 (en) 2005-12-16 2007-06-21 Jim Balsillie System and method of authenticating login credentials in a wireless communication system
2006-11-21 US US11/562,330 patent/US8661520B2/en active Active
"Final Office Action, U.S. Appl. No. 11/668,541, dated Dec. 10, 2009."
Bloch, Michael, "Taming the Beast," available at http://web.archive.org/web/20051024002014/http://www.tamingthebeast.net/articles3/ (2005).
EP Examination Report for Application No. 07 873 624.6-2212 dated Oct. 8, 2012.
EP Official Communication for Application No. 07 873 624.6-2212 dated Apr. 12, 2011.
EP Official Communication for Application No. 07 873 624.6-2212 dated Aug. 17, 2011.
EP Official Communication for Application No. 07 873 624.6-2212 dated Feb. 11, 2011.
EP Official Communication for Application No. 07 873 624.6-2212 dated Feb. 4, 2013.
EP Official Communication for Application No. 07 873 624.6-2212 dated May 14, 2013.
EP Search Report, EP Appl. No. 07 87 3624, mailed Jul. 16, 2010.
Final Office Action, U.S. Appl. No. 12/470,203, dated Aug. 1, 2011.
Harold, E.R. "Virtual Account Numbers," Aug. 29, 2006, retrieved Jun. 21, 2010 from http://web.archive.org/web/20060829000813/http://www.elharo.com/blog/privacy/2006/05/17/virtual-account-numbers/.
ICharge Web, 2006 (available at: http://web.archive.org/web/20060819032423/http://www.xilo.com/icharqe.htm).
International Search Report. Jul. 8, 2008.
International Search Report. Sep. 29, 2008.
Marriam-Webster's Collegiate Dictionary, tenth edition, p. 241, definition of "configure". 1998.
Merriam-Webster's Collegiate Dictionary, 10th Edition, definitions of "collect" and "verify."
Office Action, U.S. Appl. No. 11/668,541, dated Mar. 2, 2010.
U.S. Appl. No. 11/562,353, Notice of Allowance dated Apr. 20, 2009 (provided as explanation of relevance of JP 02-101573).
U.S. Appl. No. 11/668,541, Office Action dated Jun. 23, 2009.
U.S. Appl. No. 11/943,792, Final Office Action dated Apr. 14, 2009.
ZefaMedia, 2006 (available at: http://www.zefamedia.co.nz/blog/2006/4/13/environmentally-friendlier-pop-ups.html).
US20080120717A1 (en) 2008-05-22
AU2004272083B2 (en) 2009-11-26 System and method for risk based authentication
JP4846154B2 (en) 2011-12-28 Method and system for secure authentication settlement in a computer network
US20100312667A1 (en) 2010-12-09 Methods and apparatus for conducting electronic transactions
Owner name: VERIENT, INC., CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:SHAKKARWAR, RAJESH G.;REEL/FRAME:041776/0979