US20070240230A1 - User-browser interaction analysis authentication system - Google Patents

User-browser interaction analysis authentication system Download PDF

Info

Publication number
US20070240230A1
US20070240230A1 US11/279,186 US27918606A US2007240230A1 US 20070240230 A1 US20070240230 A1 US 20070240230A1 US 27918606 A US27918606 A US 27918606A US 2007240230 A1 US2007240230 A1 US 2007240230A1
Authority
US
United States
Prior art keywords
user
session
browser
pattern matching
matching score
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US11/279,186
Inventor
Brian O'Connell
Keith Walker
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
International Business Machines Corp
Original Assignee
International Business Machines Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by International Business Machines Corp filed Critical International Business Machines Corp
Priority to US11/279,186 priority Critical patent/US20070240230A1/en
Assigned to INTERNATIONAL BUSINESS MACHINES CORPORATION reassignment INTERNATIONAL BUSINESS MACHINES CORPORATION ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: O'CONNELL, BRIAN M., WALKER, KEITH R.
Publication of US20070240230A1 publication Critical patent/US20070240230A1/en
Priority claimed from US13/293,356 external-priority patent/US9817963B2/en
Priority claimed from US13/444,465 external-priority patent/US20120198491A1/en
Application status is Abandoned legal-status Critical

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55Detecting local intrusion or implementing counter-measures

Abstract

Systems, methods and media for authenticating a user based on user-browser interaction are disclosed. Embodiments of a method may include, during an e-commerce session with a user, receiving a request for an action from the user and determining whether the requested action requires additional authentication. Embodiments may also include requesting analysis of user-browser interaction for the session, receiving a pattern matching score for the session, and performing an action based on the pattern matching score and the requested action. The pattern matching score may provide an indication of a comparison between the user's interaction with a browser during the session and a user-browser interaction profile for the user. The performed action may include completing an e-commerce transaction, accessing or modifying information, changing a password, requesting additional information, denying the requested action, or other action. Further embodiments may provide for authenticating the user with a first-level authentication.

Description

    FIELD OF INVENTION
  • The present invention is in the field of data processing systems and, in particular, to systems, methods and media for authenticating a user based on analysis of user-browser interaction, such as for providing authentication for an Internet or e-commerce transaction.
  • BACKGROUND
  • Personal computer systems are well known in the art. They have attained widespread use for providing computer power to many segments of today's modern society. Personal computers (PCs) may be defined as a desktop, floor standing, or portable microcomputer that includes a system unit having a central processing unit (CPU) and associated volatile and non-volatile memory, including random access memory (RAM) and basic input/output system read only memory (BIOS ROM), a system monitor, a keyboard, one or more flexible diskette drives, a CD-ROM or DVD-ROM drive, a fixed disk storage drive (also known as a “hard drive”), a pointing device such as a mouse, and an optional network interface adapter. One of the distinguishing characteristics of these systems is the use of a motherboard or system planar to electrically connect these components together. The use of mobile computing devices, such as notebook PCs, personal digital assistants (PDAs), sophisticated wireless phones, etc., has also become widespread. Mobile computing devices typically exchange some functionality or performance when compared to traditional PCs in exchange for smaller size, portable power, and mobility.
  • The widespread use of PCs and mobile computing devices in various segments of society has resulted in a reliance on computer systems both at work and at home, such as for telecommuting, news, stock market information and trading, banking, shopping, shipping, communication in the form of hypertext transfer protocol (http) and e-mail, as well as other services. Many of these functions take advantage of the communication abilities offered by the Internet or other networks, such as local area networks. One function that continues to grow in importance is Internet-based commerce (also known as e-commerce or on-line commerce) where consumers purchase goods or services from businesses via an Internet connection. Typically, a consumer may utilize a browser or other interface on their PC or other device to select a product or service for purchase from a website (i.e., e-commerce site) operated by the business. While Internet commerce continues to dramatically rise in importance to both businesses and consumers, fraudulent behavior slows adoption of Internet commerce and costs both businesses and consumers time, money, and other resources. Hackers conduct Internet fraud by hijacking accounts (i.e., stealing account information) and performing tasks with the stolen account information, improperly acquiring goods, services, or money. Hackers can hijack accounts by many methods, including “phishing” (fraudulently acquiring account information by pretending to be a trustworthy source), spyware, insider information, compromised data sources at the commerce location, or other methodologies.
  • Many solutions have been developed for Internet commerce fraud by businesses, browser developers, and others to prevent Internet commerce fraud, but all have failed to provide an effective and efficient solution. One type of authentication is to require a user id and password to complete a transaction, but such authentication by itself is subject to hijacking by the means described previously. One known solution is to require a security code (a three or four digit non-imprinted number on a credit card) with every on-line purchase in addition to password authentication, but this solution provides no protection for phishing as the code will typically be entered during the phishing process along with other account information. Another solution is to also require operator ‘call back’ to authenticate the purchaser, but phone numbers can be quickly setup and taken down with no audit trail with Voice over Internet Protocol (VOIP) accounts, especially if a VoIP account is hijacked. Moreover, this solution significantly increases the expense to businesses as it requires a live person to make phone calls. Customer satisfaction is also reduced with this solution as the customer must be near a phone to receive a call back and, for purchased goods, is not treated to the instant satisfaction of their purchase. There is, therefore, a need for an efficient and effective system to provide additional authentication of users during an Internet commerce transaction.
  • SUMMARY OF THE INVENTION
  • The problems identified above are in large part addressed by systems, methods and media for authenticating a user based on user-browser interaction. Embodiments may include, during an e-commerce session with a user, receiving a request for an action from the user and determining whether the requested action requires additional authentication. Embodiments may also include, in response to determining that the requested action requires additional authentication, requesting analysis of user-browser interaction for the session and receiving a pattern matching score for the session. The pattern matching score may provide an indication of a comparison between the user's interaction with a browser during the session and a user-browser interaction profile for the user. Embodiments may also include performing an action based on the pattern matching score and the requested action. The performed action may include, for example, completing an e-commerce transaction, accessing restricted information, modifying user information, changing a password for the user, requesting additional information, or denying the requested action. Further embodiments may provide for authenticating the user with a first-level authentication or establishing the e-commerce session with the user. A further embodiment may provide for analyzing the pattern matching score before performing the action based on the pattern matching score and the requested action. In another further embodiment, receiving the pattern matching score may include determining the pattern matching score for the session. In another further embodiment, determining the pattern matching score may include determining user-browser interaction data associated with the session and comparing the data to determined patterns in previous interaction data. In yet another embodiment, performing the action may include one or more of completing an e-commerce transaction, accessing restricted information, modifying user information, changing a password for a user, requesting additional information, or denying the requested action.
  • Another embodiment provides a machine-accessible medium containing instructions effective, when executing in a data processing system, to cause the system to perform a series of operations for authenticating a user based on user-browser interaction. The series of operations generally includes, during an e-commerce session with a user, receiving a request for an action from the user and determining whether the requested action requires additional authentication. The series of operations may also include, in response to determining that the requested action requires additional authentication, requesting analysis of user-browser interaction for the session and receiving a pattern matching score for the session. The series of operations may also include performing an action based on the pattern matching score and the requested action.
  • A further embodiment provides an e-commerce authentication system having an application server in communication with an incoming interaction server and a pattern matching server. The application server may include an e-commerce application to establish a session with a user of a client computer system. The e-commerce application may determine that additional authentication is required in response to a request by the user for an action. The application server may also include a pattern matching requester to request analysis of user-browser interaction for the established session and to receive a pattern matching score for the established session. The e-commerce application may perform an action based on the pattern matching score for the established session and the requested action. The system may also include an incoming interaction server having a session data listener to receive user-browser interaction data from one or more client computer systems, an interaction data manager to associate received user-browser interaction data with a user login, and an interaction database interface to store the user-browser interaction and associated information in a user-browser interaction database. The system may also include a pattern matching server having an application server interface to receive a request for a pattern matching score and to transmit a determined pattern matching score to the application server, an interaction database interface to access stored user-browser interaction data, and an interaction data analyzer to analyze the stored user-browser interaction data associated with the session for patterns and to compare the determined patterns to user-browser interaction data associated with the session to determine a pattern matching score for the session.
  • Another embodiment provides a method for processing user-browser interaction data for an e-commerce session. Embodiments may include, during an e-commerce session with a user, receiving user-browser interaction data from a client computer system and associating the received user-browser interaction data with a user login for the session. Embodiments may also include storing the user-browser interaction data and associated information in a user-browser interaction database, where the associated information includes an indication of the user login for the session. In a further embodiment, associating the received user-browser interaction data with a user login may also include associated the received data with a user-browser interaction profile associated with the user.
  • Another embodiment provides a method for determining a pattern matching score for an e-commerce session. Embodiments may include determining user-browser interaction data associated with a current session and accessing user-browser interaction data associated with previous session for a user associated with the current session and analyzing the previous session user-browser interaction data to determine patterns in the previous session user-browser interaction data. Embodiments may also include determining a pattern matching score for the current session, such as by comparing user-browser interaction data for the current session with the determined patterns.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • Advantages of the invention will become apparent upon reading the following detailed description and upon reference to the accompanying drawings in which, like references may indicate similar elements:
  • FIG. 1 depicts an environment for an e-commerce authentication system with an application server, incoming interaction server, and pattern matching server according to one embodiment;
  • FIG. 2 depicts a block diagram of one embodiment of a computer system suitable for use as a component of the e-commerce authentication system;
  • FIG. 3 depicts a conceptual illustration of software components of an incoming interaction server of the e-commerce authentication system according to one embodiment;
  • FIG. 4 depicts a conceptual illustration of software components of a pattern matching server of the e-commerce authentication system according to one embodiment;
  • FIG. 5 depicts an example of a flow chart for detecting user-browser interactions and processing user-browser interaction data according to one embodiment;
  • FIG. 6 depicts an example of a flow chart for receiving a request to analyze a user-browser interaction session and to determine a pattern matching score according to one embodiment; and
  • FIG. 7 depicts an example of a flow chart for interacting with a user and authenticating the user with a pattern matching score according to one embodiment.
  • DETAILED DESCRIPTION OF EMBODIMENTS
  • The following is a detailed description of example embodiments of the invention depicted in the accompanying drawings. The example embodiments are in such detail as to clearly communicate the invention. However, the amount of detail offered is not intended to limit the anticipated variations of embodiments; on the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the present invention as defined by the appended claims. The descriptions below are designed to make such embodiments obvious to a person of ordinary skill in the art.
  • Generally speaking, systems, methods and media for authenticating a user based on user-browser interaction are disclosed. Embodiments of a method may include, during an e-commerce session with a user, receiving a request for an action from the user and determining whether the requested action requires additional authentication. Embodiments may also include, in response to determining that the requested action requires additional authentication, requesting analysis of user-browser interaction for the session and receiving a pattern matching score for the session. The pattern matching score may provide an indication of a comparison between the user's interaction with a browser during the session and a user-browser interaction profile for the user. Embodiments may also include performing an action based on the pattern matching score and the requested action. The performed action may include, for example, completing an e-commerce transaction, accessing restricted information, modifying user information, changing a password for the user, requesting additional information, or denying the requested action. Further embodiments may provide for authenticating the user with a first-level authentication.
  • The system and methodology of the disclosed embodiments allows for unobtrusive authentication for a user during an e-commerce (Internet) transaction by comparing the user's interaction with their browser with an existing profile of the user's previous interaction with their browser by generation of a pattern matching score. The user's interaction may include attributes such as the speed of selecting keys, the method the user utilizes to move between fields (e.g., mouse, tab key, etc.), or any other aspect of the user's browser interaction. Based on the pattern matching score, an e-commerce application may then allow a transaction, reject the transaction, or perform other actions. The disclosed methodology may be particularly useful as a secondary authentication mechanism in a two-factor authentication system, providing additional authentication strength to a primary authentication mechanism such as a user name and password. Internet commerce fraud may advantageously be reduced by rejection of e-commerce transactions where the pattern matching score indicates that the user is not requesting the transaction, as may happen when user credit card or other information is stolen or otherwise compromised. The disclosed method may be relatively unobtrusive and operate without knowledge of the user or required action by the user, providing an effective and efficient authentication mechanism.
  • In general, the routines executed to implement the embodiments of the invention, may be part of an operating system or a specific application, component, program, module, object, or sequence of instructions. The computer program of the present invention typically is comprised of a multitude of instructions that will be translated by the native computer into a machine-readable format and hence executable instructions. Also, programs are comprised of variables and data structures that either reside locally to the program or are found in memory or on storage devices. In addition, various programs described herein may be identified based upon the application for which they are implemented in a specific embodiment of the invention. However, it should be appreciated that any particular program nomenclature herein is used merely for convenience, and thus the invention should not be limited to use solely in any specific application identified and/or implied by such nomenclature.
  • While specific embodiments will be described below with reference to particular configurations of hardware and/or software, those of skill in the art will realize that embodiments of the present invention may advantageously be implemented with other substantially equivalent hardware and/or software systems. Aspects of the invention described herein may be stored or distributed on computer-readable media, including magnetic and optically readable and removable computer disks, as well as distributed electronically over the Internet or over other networks, including wireless networks. Data structures and transmission of data (including wireless transmission) particular to aspects of the invention are also encompassed within the scope of the invention.
  • Each software program described herein may be operated on any type of computer, such as personal computer, server, etc. Any programs may be contained on a variety of signal-bearing media. Illustrative signal-bearing media include, but are not limited to: (i) information permanently stored on non-writable storage media (e.g., read-only memory devices within a computer such as CD-ROM disks readable by a CD-ROM drive); (ii) alterable information stored on writable storage media (e.g., floppy disks within a diskette drive or hard-disk drive); and (iii) information conveyed to a computer by a communications medium, such as through a computer or telephone network, including wireless communications. The latter embodiment specifically includes information downloaded from the Internet, intranet or other networks. Such signal-bearing media, when carrying computer-readable instructions that direct the functions of the present invention, represent embodiments of the present invention.
  • Turning now to the drawings, FIG. 1 depicts an environment for an e-commerce authentication system with an application server, incoming interaction server, and pattern matching server according to one embodiment. In the depicted embodiment, the e-commerce authentication system 100 includes a plurality of client computer systems 102 in communication with a network 104. The disclosed e-commerce authentication system 100 also includes an application server 106, an incoming interaction server 108, and a pattern matching server 110 all in communication with network 104. Users may utilize a browser 112 executing on a client computer system 102 to interact with an e-commerce application 118 of an application server 106 via network 104 by establishing a session with the e-commerce application 118. The incoming interaction server 108 may receive indications of the interaction between the user and browser 112 for storage in a user-browser interaction database 130 during operation of the browser 112 by the user. If the e-commerce application 118 determines that additional authentication of a user is required to perform a requested action, the application server 106 may request a pattern matching score from the pattern matching server 110. The pattern matching server 110 may then determine a pattern matching score based on the user's browser 112 interaction during the current session and detected patterns stored in the user-browser interaction database 130 from previous sessions. Based on the pattern matching score and the requested action from the user, the e-commerce application 118 may authenticate the user and allow the requested action, request additional information, or deny the transaction. The e-commerce application 118 may thus utilize the pattern matching score to authenticate the user or provide additional authentication strength to another primary form of authentication, such as a user name and password.
  • Client computer systems 102 may each include one or more personal computers, workstations, servers, mainframe computers, notebook or laptop computers, desktop computers, PDAs, set-top boxes, mobile phones, wireless devices, or the like. In some embodiments, client computer system 102 may be a computer system as described in relation to FIG. 2 and may be in wired or wireless communication with network 104. Browser 112 may be a graphical browser application that allows a user to view Internet or intranet content such as Microsoft Corporation's Internet Explorer™, Netscape Communication Corporation's Navigator™, Mozilla Foundation's Mozilla, Apple Corporation's Safari™, etc. Browsers, at their most basic level of operation, permit users to connect to a given network site, download informational content from that site, and display that information to the user. To view additional information, the user designates a new network address (such as by selecting a link) whose contents then replace the previously displayed information on the user's computer display. Using a browser 112, a user may interact with an e-commerce application 118 to perform tasks such as purchasing goods or services, requesting or viewing information, providing information, or other tasks. A user may interact with the browser 112 via user input devices of the client computer system 102 such as a mouse, keyboard, voice input device, etc., as will be described in more detail subsequently.
  • As will be described in more detail subsequently, the client computer system 102 may transmit indications of the user's interaction with the browser to the incoming interaction server 108 via network 104 to facilitate determination of a user-browser interaction profile and pattern matching score. The user-browser interaction data transmitted by the client computer system 102 may include both indications of the user-browser interaction as well as identification information. In some embodiments, the browser 112 may be enabled with JavaScript™ (of Sun Microsystems, Inc.) or other code that enables transmission of interaction details from a client to a server. JavaScript™ is a system of programming codes that can be embedded in Hypertext Markup Language (HTML) language or other language of a page to provide additional functionality and is generally supported by modem browsers 112. In these embodiments, the client software may be included as JavaScript on every page sent by the application server 106. The JavaScript™ code may track details of the user's interaction with the browser 112 and transmit an indication of such interaction (as part of the user-browser interaction data) to the incoming interaction server 108. Using Asynchronous JavaScript And XML (AJAX) (also known as XMLHTTP), a Web development technique for creating interactive Web applications that is based on JavaScript™, user-browser interaction details may be transmitted in near-real-time to a specified server (i.e., the incoming interaction server 108). The browser 112 of the client computer system 102 will require compatibility with the scripting language used by e-commerce application 118. While the embodiments herein are described in relation to JavaScript™ and AJAX, one of ordinary skill in the art will recognize that other scripting languages or methodologies may also be utilized with the disclosed system.
  • As discussed previously, user-browser interaction data may include both indications of interactions between the user and browser 112 as well as identification information relating to the user and/or client computer system 102. User interactions with a browser 112 may be classified into general categories such as keyboard interactions, movement device interactions, and navigation/selection tendencies. Keyboard interactions may include interactions of a user with the keyboard, including key-down time (how long a particular key is pressed), typing rate, time between keystrokes, numeric keypad usage, capitalization keystroke sequences, common typing errors, etc. A particular user, for example, may typically hold down the ‘o’ key for milliseconds less time than she holds down the ‘k’ key, a pattern that may emerge consistently over continued data entry. This particular difference may reflect both hardware differences (e.g., the keyboard spring for each key on a particular keyboard) as well as the user's natural or learned typing pattern. A different user may have a larger gap between the two letters, a smaller gap, no gap, or a reversal of the longer hold time, providing a characteristic that potentially distinguishes the two users. While one such characteristic may generally be insufficient for authentication purposes, an aggregation of different behaviors provides increasing authentication strength as more data is collected and more factors are considered.
  • Other types of user-browser interaction are also possible. Movement device (e.g., mouse, trackball, etc.) interactions may include ‘mouse-over’ time before clicking, which buttons of a device are used, whether the scroll wheel is used, whether the user holds the cursor steady or fidgets with the cursor, whether the user follows the text with the cursor during reading, etc. Navigation and selection tendencies may include factors relating to how a user navigates a website or selects actions on a website, including scrolling methods (e.g., mouse wheel, arrow keys, left-click on up or down scroll buttons, page up/page down, etc.), whether the user uses ‘hot keys’ or selects actions from pull-down menus, error correction methods (e.g., highlighting text to be replaced with mouse or keyboard, using delete key, accepting spell-checker recommendations, etc.), where the user positions the cursor during screen loading, how the user navigates between fields (e.g., tab key, mouse, etc.), textbox submit preference (e.g., select ‘enter’ or use the mouse to select submit), etc. While a number of general categories and specific examples are described herein, one skilled in the art will recognize that any type of indication of the interaction of a user and a browser 112 and the site displayed on the browser 112 may be used. The details of a user's interaction while using a website may, particularly in combination, identify a user by their behavior to some degree. With enough user-browser interaction detail, the identification may become highly accurate and sufficient for authentication purposes (either solely or as a supplement to a primary form of authentication).
  • Identification information included within the user-browser interaction data may include any information that serves to assist in identifying the user, browser 112, and/or client computer system 102, such as browser code name, browser major version, browser minor version, CPU class, platform, user agent, system language and cookies.
  • Network 104 may be any type of data communications channel or combination of channels, such as the Internet, an intranet, a LAN, a WAN, an Ethernet network, a wireless network, a proprietary network, or a broadband cable network. The Internet or other public network may be particularly useful as network 104 when the client computer systems 102 are widely distributed from the application server 106 as communications between these systems will be facilitated. Similarly, a corporate intranet may serve as network 104 for communications with an internal corporate computing environment. Those skilled in the art will recognize, however, that the invention described herein may be implemented utilizing any type or combination of data communications channel(s).
  • Application server 106 may be a server computer dedicated to running particular software applications such as e-commerce applications 118, business applications, or databases. An application server 106 typically has built-in redundancy, high performance, and support for complex database access. Application server 106 may meet standards such as Java Platform, Enterprise Edition (Java EE™, formerly known as J2EE™) by Sun Microsystems, Inc. An example application server is International Business Machine's (IBM®'s) WebSphere® Application Server (WAS) that may serve as middleware to set up, operate, and integrate e-business applications across multiple computing platforms using Web technologies.
  • Application server 106 may include one or more e-commerce applications 118 and a pattern matching requester 120. An e-commerce application 118 (which may include one or more back-end applications, such as for inventory, billing, accounting, etc.) may be any application that may be used to provide services, content, or information to a user at a remote client computer system 102, including applications that facilitate purchase of goods or services by users or access to information by users. The pattern matching requester 120 may transmit requests to the pattern matching server 110 for a pattern matching score 110 via network 104 and may receive pattern matching scores from the pattern matching server 110. The pattern matching requester 120 may also, in conjunction with an e-commerce application 118, analyze the pattern matching score to determine an appropriate course of action to handle a user request for an action. The e-commerce application 118 may, for example, allow the action, deny the action, mark the transaction for later follow-up, flag the transaction as one that cannot complete until further verification, request additional authentication information, etc. The user request for an action may include requesting completion of tasks such as an e-commerce transaction, accessing restricted information, modifying user information, or changing a password for the user. The pattern matching requester 120 may be a separate module from e-commerce application 118 or may be integrated into an e-commerce application 118. A separate pattern matching requester 120 may potentially serve multiple e-commerce applications 118.
  • As described previously, the incoming interaction server 108 may receive indications of the interaction between the user and browser 112 for storage in a user-browser interaction database 130 during operation of the browser 112 by the user, providing for processing of user-browser interaction data. The application server 106 may include JavaScript™ or other script directing user-browser interaction information gathered at a client computer system 102 to be directed to a particular incoming interaction server 108. The incoming interaction server 108 may then store received user-browser interaction data in a user-browser interaction database 130.
  • Before storing the user-browser interaction data, an interaction data manager 114 of the incoming interaction server 108 may associate the data with a particular user login for later access and analysis. Additionally, the interaction data manager 114 may associate received data with a particular profile for the user. A user-browser interaction profile for a user may indicate interaction tendencies that are specific to a particular piece of interaction hardware. A user may have multiple user-browser interaction profiles each representing, for example, a different client computer system 102 they may use to access an e-commerce application 118. A user may interact differently with a browser from a home computer instead of a work computer, in one example, if one of the computers does not have a mouse with a scroll wheel. A user's style may change along with interaction hardware, such as because different options are available, different components have different performances, or for psychological reasons. The differences in hardware can be enough to produce an entirely different user-interaction experience. As each user will likely only have one account at the e-commerce application 118 website, multiple user-browser interaction profiles for a particular login provide flexibility to accommodate different user-browser interaction scenarios. The incoming interaction server 108 may effectively ‘map’ the user's interaction to the appropriate device. To identify the hardware the user is currently using, the incoming interaction server 108 may utilize information such as cookies, IP address subnet, browser code name, browser full name, browser major version, browser minor version, CPU class, platform, user agent, and system language. These items may not be weighted equally or all considered, and some may only have a positive weighting associated with them (such as IP subnet).
  • The pattern matching server 110 may determine a pattern matching score based on the user's browser 112 interaction during the current session and detected patterns in the user-browser interaction data for the user that are stored in the user-browser interaction database 130. Upon receiving a request for a pattern matching score for a particular user from an e-commerce application 118, the pattern matching server 110 may access the stored user-browser interaction data for that user, analyze the stored data for patterns, and compare the patterns to the user-browser interaction data for the current session. The user-browser interaction data for the current session may, in some embodiments, be stored in the user-browser interaction database 130. The result of the comparison and analysis may be a pattern matching score for the session based on the previous user-browser interactions. The pattern matching score may be any indication of the likelihood that the person (or entity) acting as the user of the current session is in fact the actual user. The pattern matching server 110 may transmit the determined pattern score to the requesting e-commerce application 118, which may in turn determine its course of action based at least in part on the pattern matching score. A pattern matching score indicating high authenticity strength, for example, may suggest to the e-commerce application 118 that the user has been authentication while a pattern matching score indicating low authenticity may result in denial of a transaction to the user or a request for additional information.
  • Application server 106, incoming interaction server 108, and pattern matching server 110 may each include one or more personal computers, workstations, servers, mainframe computers, notebook or laptop computers, desktop computers, or other computer systems. In some embodiments, any of the application server 106, incoming interaction server 108, and pattern matching server 110 may be a computer system as described in relation to FIG. 2 and each may be in wired or wireless communication with network 104. An example application server 106, incoming interaction server 108, and pattern matching server 110 may be an International Business Machine Corporation (IBM) eServer® server. In the e-commerce authentication system 100, the application server 106, incoming interaction server 108, and pattern matching server 110 may be located at the same location, such as in the same building or computer lab, or could be remote. While the term “remote” is used with reference to the distance between the components of the e-commerce authentication system 100, the term is used in the sense of indicating separation of some sort, rather than in the sense of indicating a large physical distance between the systems. For example, any of the components of the e-commerce authentication system 100 may be physically adjacent or located as part of the same computer system in some network arrangements.
  • The user-browser interaction database 130 may be any type of volatile or non-volatile storage and may store user-browser interaction data received by an incoming interaction server 108, as well as associated or identifying information. The user-browser interaction database 130 may be a stand-alone unit or be integrated into another component of the e-commerce authentication system 100 such as the incoming interaction server 108 or the pattern matching server 110.
  • The systems and methodologies of the disclosed embodiments provide an efficient and effective mechanism to provide authentication of a user for an e-commerce transaction. The disclosed system may operate without notification of the user in some embodiments to provide a seamless and efficient authentication method. By tracking a user's interaction with a browser over multiple sessions, a user's actions in a new session can be compared to patterns that emerged in the earlier sessions to provide a type of authentication. The user-browser interaction authentication may serve as a supplement to another type of authentication (a secondary form of authentication), such as a user name and password, in a two-factor authentication system. In some embodiments with sufficiently robust and sophisticated interaction data, user-browser authentication may serve as a sole form of authentication, but may typically be used as secondary authentication. Through the use of user-browser interaction profiles, different interaction styles of the users on different machines may advantageously be accommodated. The disclosed user-browser interaction authentication may be particularly useful for e-commerce applications where user convenience is highly valued and fraud is a significant risk.
  • FIG. 2 depicts a block diagram of one embodiment of a computer system 200 suitable for use as a component of the e-commerce authentication system 100, such as a client computer system 102, application server 106, incoming interaction server 108, or pattern matching server 110. Other possibilities for the computer system 200 are possible, including a computer having capabilities other than those ascribed herein and possibly beyond those capabilities, and they may, in other embodiments, be any combination of processing devices such as workstations, servers, mainframe computers, notebook or laptop computers, desktop computers, PDAs, mobile phones, wireless devices, set-top boxes, or the like. At least certain of the components of computer system 200 may be mounted on a multi-layer planar or motherboard (which may itself be mounted on the chassis) to provide a means for electrically interconnecting the components of the computer system 200.
  • In the depicted embodiment, the computer system 200 includes a processor 202, storage 204, memory 206, a user interface adapter 208, and a display adapter 210 connected to a bus 212. The bus 212 facilitates communication between the processor 202 and other components of the computer system 200, as well as communication between components. Processor 202 may include one or more system central processing units (CPUs) or processors to execute instructions, such as an IBM® PowerPC™ processor, an Intel Pentium® processor, an Advanced Micro Devices Inc. processor or any other suitable processor. The processor 202 may utilize storage 204, which may be non-volatile storage such as one or more hard drives, tape drives, diskette drives, CD-ROM drive, DVD-ROM drive, or the like. The processor 202 may also be connected to memory 206 via bus 212, such as via a memory controller hub (MCH). System memory 206 may include volatile memory such as random access memory (RAM) or double data rate (DDR) synchronous dynamic random access memory (SDRAM).
  • The user interface adapter 208 may connect the processor 202 with user interface devices such as a mouse 220 or keyboard 222. The user interface adapter 208 may also connect with other types of user input devices, such as touch pads, touch sensitive screens, electronic pens, microphones, etc. For a client computer system 102, a user may utilize the keyboard 222 and mouse 220 to interact with a browser 112 and it is these interactions that may be used to create user-browser interaction data. The bus 212 may also connect the processor 202 to a display, such as an LCD display or CRT monitor, via the display adapter 210.
  • FIG. 3 depicts a conceptual illustration of software components of an incoming interaction server 108 of the e-commerce authentication system 100 according to one embodiment. As described previously (and in more detail in relation to FIG. 5), the incoming interaction server 108 may receive user-browser interaction data from one or more client computer systems 102 and process and store the received data. The incoming interaction server 108 of the depicted embodiment includes an interaction data manager 114, a session data listener 302, and an interaction database interface 304. The session data listener 302 may receive indications of user-browser interactions in the form of user-browser interaction data from client computer systems 102 via network 104. The session data listener 302 may then transmit received data for the interaction data manager 114 for processing. The interaction database interface 304 may store user-browser interaction data or other information in the user-browser interaction database 130 for the incoming interaction server 108 and may serve as the interface between the two components.
  • The interaction data manager 114 may process received user-browser interaction data and associate the data with a user and/or profile, and may use sub-modules such as a session data associater 312, profile matcher 314, and interaction profile repository 316 to assist it in performing its tasks. The session data associater 312 may associate received user-browser interaction data (from a particular session) with a particular user login. User names, logins, or other information may be contained as part of the user-browser interaction data in some embodiments so that the session data associater 312 may extract user login information from the received data. The profile matcher 314 may provide additional fidelity by further associating, or matching, the received user-browser interaction data with a particular user-browser interaction profile. User-browser interaction profiles may be stored in an interaction profile repository 316. Each user-browser interaction profile may correspond to a particular piece of hardware (i.e., client computer system 102) that the user may utilize to interact with an e-commerce application 118 via browser 112. As discussed previously, a user-browser interaction profile for a user may indicate interaction tendencies that are specific to a particular piece of interaction hardware and a user may have multiple user-browser interaction profiles each representing different client computer system 102 they may use to access an e-commerce application 118.
  • FIG. 4 depicts a conceptual illustration of software components of a pattern matching server 110 of the e-commerce authentication system 100 according to one embodiment. As described previously (and in more detail in relation to FIG. 6), the pattern matching server 110 may determine a pattern matching score based on the user's browser 112 interaction during the current session and detected patterns in the user-browser interaction data for the user that are stored in the user-browser interaction database 130. The pattern matching server 110 of the depicted embodiment includes an interaction data analyzer 116, an application server interface 402, and an interaction database interface 404. The application server interface 402 may receive requests from an e-commerce application 118 for a pattern matching score for a session and may pass those requests to the interaction data analyzer 116. The application server interface 402 may also receive determined pattern matching scores from the interaction data analyzer 116 and may transmit the scores to the requesting e-commerce application 118. The interaction database interface 404 may, upon request by the interaction data analyzer 116, access user-browser interaction data or other information in the user-browser interaction database 130 and may serve as the interface between the two components.
  • The interaction data analyzer 116 may determine a pattern matching score based on the user's browser 112 interaction during the current session and detected patterns in the user-browser interaction data for the user that are stored in the user-browser interaction database 130. The interaction data analyzer 116 may include sub-modules such as a pattern analyzer 406 and pattern matching score determiner 408 to assist it in performing its tasks. The pattern analyzer 406 may analyze stored user-browser interaction data for a particular user (and optionally profile), such as for interaction patterns (e.g., user tendencies, habits, etc.). The pattern matching score determiner 408 may, based on the results of the analysis from the pattern analyzer 406 and the interactions from the user's current session, determine a pattern matching score for the session. To do so, the pattern matching score determiner 408 may compare the current session action with determined patterns to ascertain similarities and differences between them. As discussed previously, the pattern matching score may be any indication of the likelihood that the person (or entity) acting as the user of the current session is in fact the actual user.
  • FIG. 5 depicts an example of a flow chart 500 for detecting user-browser interactions and processing user-browser interaction data according to one embodiment. The method of flow chart 500 may be performed, in one embodiment, by a client computer system 102 and an incoming interaction server 108. Flow chart 500 begins with element 502, where the browser 112 of the client computer system 102 (such as script running on a displayed webpage) detects indicia of user-browser interaction. Element 502 (as well as elements 504 and 506) may execute in a browser 112 when the user accesses a webpage for an e-commerce application 118 that is configured for user-browser interaction-based authentication according to the disclosed embodiments. As indicia of user-browser interactions is gathered, the browser 112 may generate user-browser interaction data based on the indicia at element 504 and transmit the generated user-browser interaction data to a specified incoming interaction server 108 at element 506. The network location of the incoming interaction server 108 may be specified in the JavaScript (or other script) executing on browser 112. The ability to specify particular incoming interaction servers 108 facilitates the use of multiple incoming interaction servers 108 in a single e-commerce authentication system 100.
  • The incoming interaction server 108 may receive user-browser interaction data from one or more client computer systems 102 at element 508. Via the interaction data manager 114, the incoming interaction server 108 may associate received user-browser interaction data with a particular user login at element 510. Indications of the user login may be stored in the user-browser interaction data or received separately. As described previously, in some embodiments a user may have multiple profiles for their user login associated with different client computer systems 102 they may use to access an e-commerce application 118. If the incoming interaction server 108 determines at decision block 512 that multiple profiles for the user exist, the method of flow chart 500 may continue to element 514, where the profile matcher 314 of the interaction data manager 114 may match the received data with a user-browser interaction profile. The profile matcher 314 may use, for example, an IP address or other identification to differentiate between different user-browser interaction profiles. At element 514, the interaction database interface 304 of the incoming interaction server 108 may store user-browser interaction data and any associated information in the user-browser interaction database 130, after which the method terminates. Associated information may include, for example, an indication of the user login, user-browser interaction profile, or other identification information.
  • FIG. 6 depicts an example of a flow chart 600 for receiving a request to analyze a user-browser interaction session and to determine a pattern matching score according to one embodiment. The method of flow chart 600 may be performed, in one embodiment, by components of a pattern matching server 110. Flow chart 600 begins with element 602, where the pattern matching server 110 may receive a request from an e-commerce application 118 to analyze a particular user-browser interaction session. The pattern matching server 110 may, at element 604, determine the user-browser interaction data associated with the current session for which the request was made. In some embodiments, the user-browser interaction data for the current session may be stored in the user-browser interaction database 130, while in other alternative embodiments the user-browser interaction data for the current session may be received from the e-commerce application 118 along with the request.
  • At element 606, the pattern matching server 110 may access the user-browser interaction data from other sessions of the user (and optionally for the user's particular profile). The user-browser interaction data from previous sessions may also be stored in the user-browser interaction database 130. After accessing the data, the pattern matching server 110 may at element 608 analyze the previous interaction data to determine any patterns in the user-browser interaction. The pattern matching server 110 may then, at element 610, compare the current session user-browser interaction data with the determined patterns to ascertain the similarities and/or differences between the two. Based on the comparison, the pattern matching server 110 may determine the pattern matching score for the current session at element 612 and transmit the pattern matching score to the requesting e-commerce application 118 at element 614, after which the method terminates. By utilizing the method of FIG. 6, the pattern matching server 110 may thus provide pattern matching scores to requesting e-commerce applications 118 for users currently accessing those e-commerce applications 118 from their specific client computer systems 102.
  • FIG. 7 depicts an example of a flow chart 700 for interacting with a user and authenticating the user with a pattern matching score according to one embodiment. The method of flow chart 700 may be performed, in one embodiment, by an e-commerce application 118 executing on, for example, an application server 106. Flow chart 700 begins with element 702, where the e-commerce application 118 establishes an e-commerce session with a user. Establishment of a session may typically include authenticating the user with a first-level authentication at element 704. A first-level authentication may be authentication such as a user name and password or any other type of authentication. Alternatively, no first-level authentication is performed (eliminating the need for element 704) and establishment of a user session may require only a user name or other identification.
  • Once a session is established, the e-commerce application 118 may receive inputs from the user at element 706 as part of the normal operation of the e-commerce site. User inputs may include requests for action (e.g., checkout or purchase, request for information, etc.). The e-commerce application 118 may determine at decision block 708 whether additional authentication is required for any action requested by the user. If no additional authentication is required (such as if any first-level authentication is sufficient for the requested action), the method of flow chart 700 returns to element 706 to receive more user inputs. If the e-commerce application 118 determines that additional authentication is required, the pattern matching requester 120 may at element 710 request analysis of the established user-browser interaction session from the pattern matching server 110. The pattern matching requester 120 may make such request in response to a request by the e-commerce application 118 itself. The request for analysis may include an indication of the user (such as a user login) and may optionally include an indication of the user's interaction with the browser 112 during the current session.
  • After requesting analysis of user-browser interaction for the session, the e-commerce application 118 may receive a pattern matching score for the established session at element 712. The e-commerce application 118 may then, at element 714, analyze the pattern matching score to determine an appropriate course of action with respect to the user and may perform such action based on the analysis of the pattern matching score at element 716, after which the method terminates. The e-commerce application 118 may determine a course of action based on both the requested action by the user and the analysis of the pattern matching score. For example, if a user has requested to purchase goods or services with a credit card, the e-commerce application 118 may request additional authentication before authorizing the purchase. Upon receipt of a favorable pattern matching score (i.e., one indicating a high level of authentication), the e-commerce application 118 may choose to allow the transaction to proceed. Upon receipt of a less favorable pattern matching score indicating a low authentication strength, the e-commerce application 118 may deny the transaction, flag the transaction for later follow-up, request additional information (another form of authentication), request a follow-up phone call, or other action.
  • It will be apparent to those skilled in the art having the benefit of this disclosure that the present invention contemplates methods, systems, and media for authenticating a user based on analysis of user-browser interaction during an Internet commerce session. It is understood that the form of the invention shown and described in the detailed description and the drawings are to be taken merely as examples. It is intended that the following claims be interpreted broadly to embrace all the variations of the example embodiments disclosed.

Claims (27)

1. A method for authenticating a user during an Internet commerce session, the method comprising:
during an e-commerce session with a user, receiving a request for an action from the user;
determining whether the requested action requires additional authentication;
in response to determining that the requested action requires additional authentication, requesting analysis of user-browser interaction for the session;
receiving a pattern matching score for the session, the pattern matching score providing an indication of a comparison between the user's interaction with a browser during the session and a user-browser interaction profile for the user; and
performing an action based on the pattern matching score and the requested action.
2. The method of claim 1, further comprising establishing the e-commerce session with the user.
3. The method of claim 1, further comprising authenticating the user with a first-level authentication.
4. The method of claim 1, further comprising before performing the action based on the pattern matching score and the requested action, analyzing the pattern matching score.
5. The method of claim 1, wherein receiving the pattern matching score for the session comprises determining the pattern matching score for the session.
6. The method of claim 5, wherein determining the pattern matching score for the session comprises determining user-browser interaction data associated with the session and comparing the user-browser interaction data to determined patterns in previous interaction data.
7. The method of claim 1, wherein the requested action comprises one or more of completion of an e-commerce transaction, access to restricted information, modification of user information, or change to a password.
8. The method of claim 1, wherein performing the action based on the pattern matching score and the requested action comprises one or more of completing an e-commerce transaction, accessing restricted information, modifying user information, changing a password for the user, requesting additional information, or denying the requested action.
9. A machine-accessible medium containing instructions effective, when executing in a data processing system, to cause said data processing system to perform operations comprising:
during an e-commerce session with a user, receiving a request for an action from the user;
determining whether the requested action requires additional authentication;
in response to determining that the requested action requires additional authentication, requesting analysis of user-browser interaction for the session;
receiving a pattern matching score for the session, the pattern matching score providing an indication of a comparison between the user's interaction with a browser during the session and a user-browser interaction profile for the user; and
performing an action based on the pattern matching score and the requested action.
10. The machine-accessible medium of claim 9, further comprising establishing the e-commerce session with the user.
11. The machine-accessible medium of claim 9, further comprising authenticating the user with a first-level authentication.
12. The machine-accessible medium of claim 9, further comprising before performing the action based on the pattern matching score and the requested action, analyzing the pattern matching score.
13. The machine-accessible medium of claim 9, wherein the requested action comprises one or more of completion of an e-commerce transaction, access to restricted information, modification of user information, or change to a password.
14. The machine-accessible medium of claim 9, wherein performing the action based on the pattern matching score and the requested action comprises one or more of completing an e-commerce transaction, accessing restricted information, modifying user information, changing a password for the user, requesting additional information, or denying the requested action.
15. An e-commerce authentication system, the system comprising:
an application server in communication with an incoming interaction server and a pattern matching server, the application server comprising:
an e-commerce application to establish a session with a user of a client computer system to determine that additional authentication is required in response to a request by the user for an action;
a pattern matching requester in communication with the e-commerce application to request analysis of user-browser interaction for the established session and to receive a pattern matching score for the established session; and
wherein the e-commerce application is adapted to perform an action based on the pattern matching score for the established session and the requested action.
16. The system of claim 15, further comprising:
an incoming interaction server in communication with the application server, the incoming interaction server comprising:
a session data listener to receive user-browser interaction data from one or more client computer systems;
an interaction data manager to associate received user-browser interaction data with a user login; and
an interaction database interface to store the user-browser interaction and associated information in a user-browser interaction database.
17. The system of claim 15, wherein the interaction data manager further comprises a profile matcher to match the received user-browser interaction data and user login with a user-browser interaction profile associated with the user.
18. The system of claim 15, further comprising:
a pattern matching server in communication with the application server, the pattern matching server comprising:
an application server interface to receive a request for a pattern matching score for a session from the application server and to transmit a determined pattern matching score to the application server;
an interaction database interface to access stored user-browser interaction data; and
an interaction data analyzer to analyze the stored user-browser interaction data associated with the session for patterns and to compare the determined patterns to user-browser interaction data associated with the session to determine a pattern matching score for the session.
19. The system of claim 15, further comprising a user-browser interaction database to store user-browser interaction data and associated information.
20. The system of claim 15, further comprising a client computer system having a browser to receive input from a user.
21. A method for processing user-browser interaction data for an e-commerce session, the method comprising:
during an e-commerce session with a user, receiving user-browser interaction data from a client computer system;
associating the received user-browser interaction data with a user login for the session; and
storing the user-browser interaction data and associated information in a user-browser interaction database, the associated information comprising an indication of the user login for the session.
22. The method of claim 21, wherein associating the received user-browser interaction data with the user login for the session comprises matching the received user-browser interaction data with a user-browser interaction profile associated with the user.
23. A method for determining a pattern matching score for an e-commerce session, the method comprising:
determining user-browser interaction data associated with a current session;
accessing user-browser interaction data associated with previous sessions for a user associated with the current session;
analyzing the previous session user-browser interaction data to determine patterns in the user-browser interaction data; and
determining a pattern matching score for the current session.
24. The method of claim 23, further comprising before determining the user-browser interaction data associated with a current session, receiving a request to analyze user-browser interaction data for a session.
25. The method of claim 23, further comprising transmitting the determined pattern matching score.
26. The method of claim 23, wherein determining user-browser interaction data associated with the current session comprises determining user-browser interaction data associated with a user-browser interaction profile associated with the current session.
27. The method of claim 23, wherein determining a pattern matching score for the session comprises comparing user-browser interaction data for the current session with the determined patterns.
US11/279,186 2006-04-10 2006-04-10 User-browser interaction analysis authentication system Abandoned US20070240230A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US11/279,186 US20070240230A1 (en) 2006-04-10 2006-04-10 User-browser interaction analysis authentication system

Applications Claiming Priority (8)

Application Number Priority Date Filing Date Title
US11/279,186 US20070240230A1 (en) 2006-04-10 2006-04-10 User-browser interaction analysis authentication system
CN 200780009234 CN101405743A (en) 2006-04-10 2007-03-01 User-browser interaction analysis authentication system
CA 2644956 CA2644956A1 (en) 2006-04-10 2007-03-01 User-browser interaction analysis authentication system
PCT/EP2007/051950 WO2007115864A1 (en) 2006-04-10 2007-03-01 User-browser interaction analysis authentication system
JP2009504661A JP5068308B2 (en) 2006-04-10 2007-03-01 User - browser interaction analysis authentication system
US12/126,117 US8918479B2 (en) 2006-04-10 2008-05-23 User-browser interaction analysis authentication system
US13/293,356 US9817963B2 (en) 2006-04-10 2011-11-10 User-touchscreen interaction analysis authentication system
US13/444,465 US20120198491A1 (en) 2006-04-10 2012-04-11 Transparently verifiying user identity during an e-commerce session using set-top box interaction behavior

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US12/126,117 Continuation-In-Part US8918479B2 (en) 2006-04-10 2008-05-23 User-browser interaction analysis authentication system

Related Child Applications (3)

Application Number Title Priority Date Filing Date
US12/126,117 Continuation US8918479B2 (en) 2006-04-10 2008-05-23 User-browser interaction analysis authentication system
US12/126,117 Continuation-In-Part US8918479B2 (en) 2006-04-10 2008-05-23 User-browser interaction analysis authentication system
US13/444,465 Continuation-In-Part US20120198491A1 (en) 2006-04-10 2012-04-11 Transparently verifiying user identity during an e-commerce session using set-top box interaction behavior

Publications (1)

Publication Number Publication Date
US20070240230A1 true US20070240230A1 (en) 2007-10-11

Family

ID=38169611

Family Applications (2)

Application Number Title Priority Date Filing Date
US11/279,186 Abandoned US20070240230A1 (en) 2006-04-10 2006-04-10 User-browser interaction analysis authentication system
US12/126,117 Active 2028-10-16 US8918479B2 (en) 2006-04-10 2008-05-23 User-browser interaction analysis authentication system

Family Applications After (1)

Application Number Title Priority Date Filing Date
US12/126,117 Active 2028-10-16 US8918479B2 (en) 2006-04-10 2008-05-23 User-browser interaction analysis authentication system

Country Status (5)

Country Link
US (2) US20070240230A1 (en)
JP (1) JP5068308B2 (en)
CN (1) CN101405743A (en)
CA (1) CA2644956A1 (en)
WO (1) WO2007115864A1 (en)

Cited By (30)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080222712A1 (en) * 2006-04-10 2008-09-11 O'connell Brian M User-Browser Interaction Analysis Authentication System
US20090100505A1 (en) * 2007-10-16 2009-04-16 Trusted Partners, Inc. Third-party-secured zones on web pages
GB2456864A (en) * 2008-01-22 2009-07-29 Avaya Inc Automatic or semi-automatic use of profile for a set top box
US20090241153A1 (en) * 2008-03-18 2009-09-24 Avaya Technology Llc Open cable application platform set-top box (stb) personal profiles and communications applications
US20090241158A1 (en) * 2008-03-18 2009-09-24 Avaya Technology Llc Open cable application platform set-top box (stb) personal profiles and communications applications
US20090300668A1 (en) * 2008-03-18 2009-12-03 Avaya Technology Llc Open cable application platform (ocap) and set-top box (stb)-based bill notification and payment application
US20090300694A1 (en) * 2008-05-30 2009-12-03 Avaya Technology Llc Open cable application platform (ocap) and set-top box (stb)-based calendering application
US20090327076A1 (en) * 2008-06-27 2009-12-31 Microsoft Corporation Ad targeting based on user behavior
EP2199940A2 (en) * 2008-12-18 2010-06-23 Symantec Corporation Methods and systems for detecting man-in-the-browser attacks
US20100251144A1 (en) * 2007-10-16 2010-09-30 Shachar Shaty Third-party-secured zones on web pages
US20100302212A1 (en) * 2009-06-02 2010-12-02 Microsoft Corporation Touch personalization for a display device
US20110225197A1 (en) * 2010-03-09 2011-09-15 Timothy Howes User specific feed recommendations
US8239903B1 (en) 2008-09-15 2012-08-07 Avaya Inc. Open cable application platform (OCAP), set-top box (STB), next generation service application
WO2013043888A1 (en) 2011-09-21 2013-03-28 Ford David K Methods and apparatus for validating communications in an open architecture system
US8601531B1 (en) * 2009-06-29 2013-12-03 Emc Corporation System authorization based upon content sensitivity
US20140278746A1 (en) * 2013-03-15 2014-09-18 Knowledgevision Systems Incorporated Interactive presentations with integrated tracking systems
US20140380475A1 (en) * 2013-06-25 2014-12-25 International Business Machines Corporation User centric fraud detection
US20160085957A1 (en) * 2008-08-29 2016-03-24 International Business Machines Corporation Automated password authentication
US9348981B1 (en) * 2011-01-23 2016-05-24 Google Inc. System and method for generating user authentication challenges
US20160246813A1 (en) * 2015-02-25 2016-08-25 International Business Machines Corporation System and method for machine information life cycle
US20160285851A1 (en) * 2012-06-14 2016-09-29 Paypal, Inc. Systems and methods for authenticating a user and device
US20160294837A1 (en) * 2010-11-29 2016-10-06 Biocatch Ltd. Device, system, and method of recovery and resetting of user authentication factor
US20160337386A1 (en) * 2015-05-14 2016-11-17 SunStone Information Defense, Inc. Methods and apparatus for detecting remote control of a client device
US9817963B2 (en) 2006-04-10 2017-11-14 International Business Machines Corporation User-touchscreen interaction analysis authentication system
US10033825B2 (en) 2014-02-21 2018-07-24 Knowledgevision Systems Incorporated Slice-and-stitch approach to editing media (video or audio) for multimedia online presentations
US10127576B2 (en) * 2010-12-17 2018-11-13 Intuitive Surgical Operations, Inc. Identifying purchase patterns and marketing based on user mood
US10230759B2 (en) 2011-09-21 2019-03-12 SunStone Information Defense Inc. Methods and apparatus for varying soft information related to the display of hard information
US10262324B2 (en) 2010-11-29 2019-04-16 Biocatch Ltd. System, device, and method of differentiating among users based on user-specific page navigation sequence
US10270776B2 (en) * 2012-04-20 2019-04-23 Ologn Technologies Ag Secure zone for secure transactions
US10298614B2 (en) * 2010-11-29 2019-05-21 Biocatch Ltd. System, device, and method of generating and managing behavioral biometric cookies

Families Citing this family (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8341200B2 (en) * 2008-06-12 2012-12-25 Pomian & Corella, Llc Protecting a web application against attacks through shared files
US8681780B2 (en) * 2009-02-12 2014-03-25 International Business Machines Corporation Establishing electronically authenticated internet voice connections
US8214446B1 (en) * 2009-06-04 2012-07-03 Imdb.Com, Inc. Segmenting access to electronic message boards
WO2011101848A1 (en) * 2010-02-18 2011-08-25 United Parents Online Ltd. Methods and systems for managing virtual identities
US20110029618A1 (en) * 2009-08-02 2011-02-03 Hanan Lavy Methods and systems for managing virtual identities in the internet
US8479268B2 (en) * 2009-12-15 2013-07-02 International Business Machines Corporation Securing asynchronous client server transactions
US8424072B2 (en) * 2010-03-09 2013-04-16 Microsoft Corporation Behavior-based security system
US9077749B2 (en) * 2012-01-31 2015-07-07 International Business Machines Corporation Identity verification for at least one party to a text-based communication
US10204343B2 (en) * 2012-05-18 2019-02-12 [24]7.ai, Inc. Multi-channel customer identification
CN103731444A (en) * 2012-10-11 2014-04-16 北京睿思汇通移动科技有限公司 Method for starting boundless communication, sharing and notification through mobile terminal browser
JP2014123309A (en) * 2012-12-21 2014-07-03 Fujitsu Ltd Program, method, and information processor
US20150066762A1 (en) * 2013-08-28 2015-03-05 Geoffrey W. Chatterton Authentication system
US9444825B2 (en) 2014-08-11 2016-09-13 Empire Technology Development Llc Continuous user authentication
US10108791B1 (en) * 2015-03-19 2018-10-23 Amazon Technologies, Inc. Authentication and fraud detection based on user behavior
US10262156B1 (en) 2016-04-29 2019-04-16 Wells Fargo Bank, N.A. Real-time feature level software security
US10326773B2 (en) 2016-10-07 2019-06-18 International Business Machines Corporation Ensuring the credibility of devices for global attestation
JP6349366B2 (en) * 2016-10-14 2018-06-27 株式会社 みずほ銀行 Service management system, service management method, and service management program

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6304915B1 (en) * 1996-09-26 2001-10-16 Hewlett-Packard Company System, method and article of manufacture for a gateway system architecture with system administration information accessible from a browser
US20010042045A1 (en) * 1999-02-08 2001-11-15 Howard Christopher J. Limited-use browser and security system
US6668327B1 (en) * 1999-06-14 2003-12-23 Sun Microsystems, Inc. Distributed authentication mechanisms for handling diverse authentication systems in an enterprise computer system
US20040250115A1 (en) * 2003-04-21 2004-12-09 Trend Micro Incorporated. Self-contained mechanism for deploying and controlling data security services via a web browser platform
US20050008148A1 (en) * 2003-04-02 2005-01-13 Dov Jacobson Mouse performance identification
US20050050366A1 (en) * 1999-01-26 2005-03-03 International Business Machines Corporation Personal website for electronic commerce on a smart Java card with multiple security check points

Family Cites Families (41)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7613659B1 (en) * 1994-11-28 2009-11-03 Yt Acquisition Corporation System and method for processing tokenless biometric electronic transmissions using an electronic rule module clearinghouse
US6148094A (en) 1996-09-30 2000-11-14 David J. Kinsella Pointing device with biometric sensor
US20140019542A1 (en) * 2003-08-20 2014-01-16 Ip Holdings, Inc. Social Networking System and Behavioral Web
US20040230495A1 (en) * 1997-04-04 2004-11-18 Mikhail Lotvin Computer systems and methods supporting on-line interaction with content, purchasing, and searching
US5930804A (en) 1997-06-09 1999-07-27 Philips Electronics North America Corporation Web-based biometric authentication system and method
US7058597B1 (en) 1998-12-04 2006-06-06 Digital River, Inc. Apparatus and method for adaptive fraud screening for electronic commerce transactions
US6028950A (en) 1999-02-10 2000-02-22 The National Registry, Inc. Fingerprint controlled set-top box
US6850252B1 (en) 1999-10-05 2005-02-01 Steven M. Hoffberg Intelligent electronic appliance system and method
US7260837B2 (en) * 2000-03-22 2007-08-21 Comscore Networks, Inc. Systems and methods for user identification, user demographic reporting and collecting usage data usage biometrics
US7263506B2 (en) 2000-04-06 2007-08-28 Fair Isaac Corporation Identification and management of fraudulent credit/debit card purchases at merchant ecommerce sites
US20040034794A1 (en) * 2000-05-28 2004-02-19 Yaron Mayer System and method for comprehensive general generic protection for computers against malicious programs that may steal information and/or cause damages
US20030159070A1 (en) * 2001-05-28 2003-08-21 Yaron Mayer System and method for comprehensive general generic protection for computers against malicious programs that may steal information and/or cause damages
KR100667742B1 (en) 2000-08-23 2007-01-11 삼성전자주식회사 Method and apparatus for controlling at least one controlled device in a controlling device
US6904408B1 (en) * 2000-10-19 2005-06-07 Mccarthy John Bionet method, system and personalized web content manager responsive to browser viewers' psychological preferences, behavioral responses and physiological stress indicators
US20020065912A1 (en) * 2000-11-30 2002-05-30 Catchpole Lawrence W. Web session collaboration
US20020112048A1 (en) * 2000-12-11 2002-08-15 Francois Gruyer System and method for providing behavioral information of a user accessing on-line resources
KR20030094261A (en) * 2001-03-08 2003-12-11 인터내셔널 비지네스 머신즈 코포레이션 System and Method For Personalized Presentation Of Web Pages
US7092926B2 (en) * 2001-04-06 2006-08-15 Sedna Patent Services, Llc Method and apparatus for identifying unique client users from user behavioral data
US7383570B2 (en) 2002-04-25 2008-06-03 Intertrust Technologies, Corp. Secure authentication systems and methods
EP1465229A1 (en) 2003-04-03 2004-10-06 ICT, Integrated Circuit Testing Gesellschaft für Halbleiterprüftechnik Mbh Apparatus and method for controlling the beam current of a charged particle beam
US20050028148A1 (en) * 2003-08-01 2005-02-03 Sun Microsystems, Inc. Method for dynamic recompilation of a program
US8032483B1 (en) 2004-12-03 2011-10-04 Google Inc. Using game responses to gather data
US7693863B2 (en) * 2004-12-20 2010-04-06 Claria Corporation Method and device for publishing cross-network user behavioral data
US20060212407A1 (en) 2005-03-17 2006-09-21 Lyon Dennis B User authentication and secure transaction system
JP4954979B2 (en) * 2005-04-29 2012-06-20 オラクル・インターナショナル・コーポレイション Fraud monitoring, detection, and system and method for hierarchical user authentication
US7200576B2 (en) 2005-06-20 2007-04-03 Microsoft Corporation Secure online transactions using a captcha image as a watermark
US7552199B2 (en) * 2005-09-22 2009-06-23 International Business Machines Corporation Method for automatic skill-gap evaluation
US20070073579A1 (en) 2005-09-23 2007-03-29 Microsoft Corporation Click fraud resistant learning of click through rate
US7873595B2 (en) 2006-02-24 2011-01-18 Google Inc. Computing a group of related companies for financial information systems
US20120204257A1 (en) 2006-04-10 2012-08-09 International Business Machines Corporation Detecting fraud using touchscreen interaction behavior
US20120198489A1 (en) 2006-04-10 2012-08-02 International Business Machines Corporation Detecting fraud using set-top box interaction behavior
US8650080B2 (en) 2006-04-10 2014-02-11 International Business Machines Corporation User-browser interaction-based fraud detection system
US20120198491A1 (en) 2006-04-10 2012-08-02 International Business Machines Corporation Transparently verifiying user identity during an e-commerce session using set-top box interaction behavior
US20070240230A1 (en) 2006-04-10 2007-10-11 O'connell Brian M User-browser interaction analysis authentication system
US8453188B2 (en) 2008-01-22 2013-05-28 Avaya Inc. Open cable application platform set-top box (STB) personal profiles and communications applications
US7975025B1 (en) * 2008-07-08 2011-07-05 F5 Networks, Inc. Smart prefetching of data over a network
US20110082763A1 (en) * 2009-07-16 2011-04-07 E_Comprando Ltda.-Me Computer-implemented method of performing acts of trade and computer system therefor
US20120054005A1 (en) 2010-03-20 2012-03-01 Manning Gregory P Location based electronic reader services for waiting rooms
US20130030924A1 (en) 2011-07-28 2013-01-31 American Express Travel Related Services Company, Inc. Systems and methods for generating and using a digital pass
US20130254139A1 (en) * 2012-03-21 2013-09-26 Xiaoguang Lei Systems and methods for building a universal intelligent assistant with learning capabilities
US10019744B2 (en) * 2014-02-14 2018-07-10 Brighterion, Inc. Multi-dimensional behavior device ID

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6304915B1 (en) * 1996-09-26 2001-10-16 Hewlett-Packard Company System, method and article of manufacture for a gateway system architecture with system administration information accessible from a browser
US20050050366A1 (en) * 1999-01-26 2005-03-03 International Business Machines Corporation Personal website for electronic commerce on a smart Java card with multiple security check points
US20010042045A1 (en) * 1999-02-08 2001-11-15 Howard Christopher J. Limited-use browser and security system
US6668327B1 (en) * 1999-06-14 2003-12-23 Sun Microsystems, Inc. Distributed authentication mechanisms for handling diverse authentication systems in an enterprise computer system
US20050008148A1 (en) * 2003-04-02 2005-01-13 Dov Jacobson Mouse performance identification
US20040250115A1 (en) * 2003-04-21 2004-12-09 Trend Micro Incorporated. Self-contained mechanism for deploying and controlling data security services via a web browser platform

Cited By (53)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080222712A1 (en) * 2006-04-10 2008-09-11 O'connell Brian M User-Browser Interaction Analysis Authentication System
US9817963B2 (en) 2006-04-10 2017-11-14 International Business Machines Corporation User-touchscreen interaction analysis authentication system
US8918479B2 (en) 2006-04-10 2014-12-23 International Business Machines Corporation User-browser interaction analysis authentication system
US20090100505A1 (en) * 2007-10-16 2009-04-16 Trusted Partners, Inc. Third-party-secured zones on web pages
US8635535B2 (en) * 2007-10-16 2014-01-21 D&B Business Information Solutions Limited Third-party-secured zones on web pages
WO2009050704A3 (en) * 2007-10-16 2010-03-11 Trusted Partners, Inc. Third-party-secured zones on web pages
US8683201B2 (en) 2007-10-16 2014-03-25 D&B Business Information Solutions Limited Third-party-secured zones on web pages
US8635536B2 (en) * 2007-10-16 2014-01-21 D&B Business Information Solutions Limited Third-party-secured zones on web pages
WO2009050704A2 (en) * 2007-10-16 2009-04-23 Trusted Partners, Inc. Third-party-secured zones on web pages
US20120030732A1 (en) * 2007-10-16 2012-02-02 Shachar Shaty Third-party-secured zones on web pages
US20100251144A1 (en) * 2007-10-16 2010-09-30 Shachar Shaty Third-party-secured zones on web pages
GB2456864B (en) * 2008-01-22 2012-12-05 Avaya Inc Open cable application platform set-top box(STB) personal profiles and communications applications
US20090241160A1 (en) * 2008-01-22 2009-09-24 Avaya Technology Llc Open cable application platform set-top box (stb) personal profiles and communications applications
US8453188B2 (en) 2008-01-22 2013-05-28 Avaya Inc. Open cable application platform set-top box (STB) personal profiles and communications applications
GB2456864A (en) * 2008-01-22 2009-07-29 Avaya Inc Automatic or semi-automatic use of profile for a set top box
US20090300668A1 (en) * 2008-03-18 2009-12-03 Avaya Technology Llc Open cable application platform (ocap) and set-top box (stb)-based bill notification and payment application
US20090241153A1 (en) * 2008-03-18 2009-09-24 Avaya Technology Llc Open cable application platform set-top box (stb) personal profiles and communications applications
US9215421B2 (en) 2008-03-18 2015-12-15 Avaya Inc. Open cable application platform (OCAP) and set-top box (STB)-based bill notification and payment application
US20090241158A1 (en) * 2008-03-18 2009-09-24 Avaya Technology Llc Open cable application platform set-top box (stb) personal profiles and communications applications
US20090300694A1 (en) * 2008-05-30 2009-12-03 Avaya Technology Llc Open cable application platform (ocap) and set-top box (stb)-based calendering application
US20090327076A1 (en) * 2008-06-27 2009-12-31 Microsoft Corporation Ad targeting based on user behavior
US9959401B2 (en) * 2008-08-29 2018-05-01 International Business Machines Corporation Automated password authentication
US20160085957A1 (en) * 2008-08-29 2016-03-24 International Business Machines Corporation Automated password authentication
US8239903B1 (en) 2008-09-15 2012-08-07 Avaya Inc. Open cable application platform (OCAP), set-top box (STB), next generation service application
CN101764819A (en) * 2008-12-18 2010-06-30 赛门铁克公司 methods and systems for detecting man-in-the-browser attacks
EP2199940A2 (en) * 2008-12-18 2010-06-23 Symantec Corporation Methods and systems for detecting man-in-the-browser attacks
EP2199940A3 (en) * 2008-12-18 2011-04-27 Symantec Corporation Methods and systems for detecting man-in-the-browser attacks
US20100302212A1 (en) * 2009-06-02 2010-12-02 Microsoft Corporation Touch personalization for a display device
US8601531B1 (en) * 2009-06-29 2013-12-03 Emc Corporation System authorization based upon content sensitivity
US9747374B2 (en) * 2010-03-09 2017-08-29 Excalibur Ip, Llc User specific feed recommendations
US20150026148A1 (en) * 2010-03-09 2015-01-22 Yahoo! Inc. User specific feed recommendations
US20110225197A1 (en) * 2010-03-09 2011-09-15 Timothy Howes User specific feed recommendations
US8832099B2 (en) * 2010-03-09 2014-09-09 Yahoo! Inc. User specific feed recommendations
US20160294837A1 (en) * 2010-11-29 2016-10-06 Biocatch Ltd. Device, system, and method of recovery and resetting of user authentication factor
US10298614B2 (en) * 2010-11-29 2019-05-21 Biocatch Ltd. System, device, and method of generating and managing behavioral biometric cookies
US10262324B2 (en) 2010-11-29 2019-04-16 Biocatch Ltd. System, device, and method of differentiating among users based on user-specific page navigation sequence
US10164985B2 (en) * 2010-11-29 2018-12-25 Biocatch Ltd. Device, system, and method of recovery and resetting of user authentication factor
US10127576B2 (en) * 2010-12-17 2018-11-13 Intuitive Surgical Operations, Inc. Identifying purchase patterns and marketing based on user mood
US9348981B1 (en) * 2011-01-23 2016-05-24 Google Inc. System and method for generating user authentication challenges
EP2758889A4 (en) * 2011-09-21 2015-04-15 David K Ford Methods and apparatus for validating communications in an open architecture system
EP2758889A1 (en) * 2011-09-21 2014-07-30 David K. Ford Methods and apparatus for validating communications in an open architecture system
US10230759B2 (en) 2011-09-21 2019-03-12 SunStone Information Defense Inc. Methods and apparatus for varying soft information related to the display of hard information
WO2013043888A1 (en) 2011-09-21 2013-03-28 Ford David K Methods and apparatus for validating communications in an open architecture system
US10270776B2 (en) * 2012-04-20 2019-04-23 Ologn Technologies Ag Secure zone for secure transactions
US20160285851A1 (en) * 2012-06-14 2016-09-29 Paypal, Inc. Systems and methods for authenticating a user and device
US9633358B2 (en) * 2013-03-15 2017-04-25 Knowledgevision Systems Incorporated Interactive presentations with integrated tracking systems
US20140278746A1 (en) * 2013-03-15 2014-09-18 Knowledgevision Systems Incorporated Interactive presentations with integrated tracking systems
US20140380478A1 (en) * 2013-06-25 2014-12-25 International Business Machines Corporation User centric fraud detection
US20140380475A1 (en) * 2013-06-25 2014-12-25 International Business Machines Corporation User centric fraud detection
US10033825B2 (en) 2014-02-21 2018-07-24 Knowledgevision Systems Incorporated Slice-and-stitch approach to editing media (video or audio) for multimedia online presentations
US20160246813A1 (en) * 2015-02-25 2016-08-25 International Business Machines Corporation System and method for machine information life cycle
US20160337386A1 (en) * 2015-05-14 2016-11-17 SunStone Information Defense, Inc. Methods and apparatus for detecting remote control of a client device
US10091219B2 (en) * 2015-05-14 2018-10-02 SunStone Information Defense, Inc. Methods and apparatus for detecting remote control of a client device

Also Published As

Publication number Publication date
JP2009533735A (en) 2009-09-17
CN101405743A (en) 2009-04-08
US20080222712A1 (en) 2008-09-11
CA2644956A1 (en) 2007-10-18
US8918479B2 (en) 2014-12-23
WO2007115864A1 (en) 2007-10-18
JP5068308B2 (en) 2012-11-07

Similar Documents

Publication Publication Date Title
US9947046B2 (en) Systems and methods for providing user-specific dynamic content for facilitating online transactions
US9596237B2 (en) System and method for initiating transactions on a mobile device
AU2013209420B2 (en) System and method to enable a network of digital wallets
US7543740B2 (en) Fraud analyst smart cookie
US9898740B2 (en) Online challenge-response
AU2011342282B2 (en) Authenticating transactions using a mobile device identifier
US7908645B2 (en) System and method for fraud monitoring, detection, and tiered user authentication
US9824199B2 (en) Multi-factor profile and security fingerprint analysis
US9665868B2 (en) One-time use password systems and methods
CN103339636B (en) Create a signature for authentication applications
US9911146B2 (en) Method and system for providing online authentication utilizing biometric data
AU2007323917B2 (en) Adaptive authentication options
US8943549B2 (en) Methods and systems for online fraud protection
US8756661B2 (en) Dynamic user authentication for access to online services
US8225401B2 (en) Methods and systems for detecting man-in-the-browser attacks
US8527417B2 (en) Methods and systems for authenticating an identity of a payer in a financial transaction
US20060136595A1 (en) Network-based verification and fraud-prevention system
US20120150688A1 (en) Payment service to efficiently enable electronic payment
US9996864B2 (en) User enhanced authentication system for online purchases
US20010051924A1 (en) On-line based financial services method and system utilizing biometrically secured transactions for issuing credit
US20080010678A1 (en) Authentication Proxy
US20120295580A1 (en) Systems and Methods to Detect Fraudulent Payment Requests
US20120278240A1 (en) Method and System to Verify the Identity of a User
KR101895243B1 (en) Integration of payment capability into secure elements of computers
AU2011201164B2 (en) Methods and Systems for Authenticating Users

Legal Events

Date Code Title Description
AS Assignment

Owner name: INTERNATIONAL BUSINESS MACHINES CORPORATION, NEW Y

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:O'CONNELL, BRIAN M.;WALKER, KEITH R.;REEL/FRAME:017837/0505

Effective date: 20060406

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION