US20180048634A1 - Authentication using a Transaction History - Google Patents
Authentication using a Transaction History Download PDFInfo
- Publication number
- US20180048634A1 US20180048634A1 US15/795,922 US201715795922A US2018048634A1 US 20180048634 A1 US20180048634 A1 US 20180048634A1 US 201715795922 A US201715795922 A US 201715795922A US 2018048634 A1 US2018048634 A1 US 2018048634A1
- Authority
- US
- United States
- Prior art keywords
- user
- item
- transaction history
- identifiers
- selection
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/389—Keeping log of transactions for guaranteeing non-repudiation of a transaction
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
Definitions
- the present invention generally relates to the field of computerized systems. More particularly, the invention relates to computerized systems and methods for authenticating a user to access or utilize all or part of a computer system.
- a user To access an account at an Internet site, a user typically submits credentials to the Internet site, which are then authenticated. For example, the most commonly encountered credentials are username and password.
- the username may be an email address of the user or other alphanumeric identifier.
- the username accordingly, may be known to others.
- the password is kept secret by the user and may include a combination of alphanumeric characters.
- the username and password combination is no longer sufficient to securely authenticate users of Internet sites.
- phishing a fraud scheme called “phishing,” individuals fraudulently obtain username and password combinations from users that receive electronic messages purporting to originate from a legitimate Internet site.
- Some phishing techniques send out mass electronic mail messages to persons representing that the messages are from a trusted source (e.g., an Internet site from which the user has purchased goods or services). The messages request a reply from a user providing his or her username and password or provide a link to a page on which the user is requested to confirm his or her username and password.
- the perpetrator might execute automated scripts to access a large number of user accounts. If an Internet site allows users to sell items to the public, the perpetrator may use the automated scripts to log into the user accounts, post listings of items with low prices, and collect money without any intention to ship the sold items. Alternatively, the perpetrator might access a user's account information, such as payment information (e.g., credit card information) and/or might make unauthorized purchases using stolen payment information or may place orders with Internet sites.
- payment information e.g., credit card information
- FIG. 1 is a diagram of an example of a system for authenticating a user
- FIG. 2 is a diagram of an example of an architecture of a retail server
- FIG. 3 is a diagram of an example of a software architecture for authenticating a user
- FIG. 4 is an example of a user interface for authenticating a user.
- FIG. 5 is an example of a flow diagram of a routine for authenticating a user.
- Embodiments disclosed herein provide computer-implemented systems and methods for authenticating a user.
- the systems and methods may maintain transaction history information for each one of a set of users. For example, the transaction history information may be stored in a storage device.
- the systems and methods may provide identifiers that are associated with items for display. The identifiers may be provided to, for example, one of the users.
- the systems and methods may receive, from one of the users, a selection of one or more of the identifiers.
- the systems and methods may authenticate the user as a function of the selection and a transaction history of the user.
- a computer-implemented method for authenticating a user.
- the method may maintain, in a storage device, transaction history information for a user identifying items previously purchased by the user.
- the method may further provide a plurality of identifiers associated with items for display.
- the plurality of identifiers may include at least one identifier of an item previously purchased by the user and a plurality of identifiers of items not previously purchased by the user.
- the method may receive, from the user, a selection of one or more of the identifiers and determine whether the selected one or more items corresponds with items previously purchased by the user.
- the method may authenticate the user if the selected one or more items corresponds with items previously purchased by the user.
- a computer-implemented method for authenticating a user.
- the method may maintain, in a storage device, transaction history information for each one of a set of users.
- the method may provide identifiers associated with items for display and receive, from one of the users, a selection of one or more of the identifiers.
- the method may authenticate the user as a function of the selection and a transaction history of the user.
- a computer-implemented method for authenticating a user.
- the method may display a group of items comprising a plurality of items that are not included in a transaction history of the user and one or more items that are included in the transaction history of the user.
- the method may receive, from the user, a selection of one or more items in the group and determine whether the selected one or more items are included in the transaction history.
- the method may authenticate the user if the selected one or more items are included in the transaction history.
- a computer-implemented method for authenticating a user.
- the method may select, for each of a plurality of categories of products, a product.
- One of the selected products may have been purchased by the user.
- the method may display identifiers of the selected products and receive, from the user, a selection of one of the identifiers.
- the method may authenticate the user based on the selection.
- a system for authenticating a user.
- the system may comprise a catalog server including a data store storing identifiers of items and a retail server in communication with the catalog server.
- the retail server may be operable to transmit a plurality of identifiers of items retrieved from the catalog server and receive, from the user, a selection of one of the identifiers.
- the retail server may authenticate the user based on the selected identifier.
- a computer-readable medium that stores program instructions for implementing any of the above-described methods.
- FIG. 1 is an example of a system 100 for authenticating a user in accordance with one or more embodiments of the present invention.
- system 100 may provide functionality for authenticating a user based on the user's response to a challenge question that is related to the user's transaction history.
- retail server 110 catalog server 120
- terminals 140 - 160 are connected to a network 130 .
- network 130 One of skill in the art will appreciate that although one retailer server, one catalog server, and three terminals are depicted in FIG. 1 , any number of these entities may be provided.
- functions provided by one or more entities of system 100 may be combined. For example, functionality provided by retail server 110 and catalog server 120 may be combined.
- Network 130 provides communications between the various entities in system 100 , such as retail server 110 , catalog servers 120 , and terminals 140 - 160 .
- retail server 110 , catalog server 120 , and/or terminals 140 - 160 may access legacy systems (not shown) via network 130 , or may directly access legacy systems, data stores, or other network applications.
- Network 130 may be a shared, public, or private network, may encompass a wide area or local area, and may be implemented through any suitable combination of wired and/or wireless communication networks.
- network 130 may comprise an intranet or the Internet.
- Retail server 110 may comprise a general purpose computer (e.g., a personal computer, network computer, server, or mainframe computer) having one or more processors (not shown in FIG. 1 ) that may be selectively activated or reconfigured by a computer program.
- Retail server 110 may also be implemented in a distributed network.
- retail server 110 may communicate via network 130 with one or more additional retail servers (not shown), which may enable retail server 110 to distribute processes for parallel execution by a plurality of retail servers.
- retail server 110 may be specially constructed for carrying-out methods consistent with disclosed embodiments.
- Retail server 110 may provide access to an Internet site, as well as provide functionality for authenticating users, and transmitting data in connection with the sale of products and/or services. Additional details of retailer server 110 are discussed below in connection with FIG. 2 .
- Catalog server 120 may comprise a general purpose computer (e.g., a personal computer, network computer, server, or mainframe computer) having one or more processors (not shown) that may be selectively activated or reconfigured by a computer program. Furthermore, catalog server 120 may communicate via network 130 or may be in direct bilateral communication with retail server 110 . Catalog server 110 may also be implemented in a distributed network. For example, catalog server 110 may communicate via network 130 with one or more additional catalog servers (not shown) storing additional data.
- a general purpose computer e.g., a personal computer, network computer, server, or mainframe computer
- processors not shown
- catalog server 120 may communicate via network 130 or may be in direct bilateral communication with retail server 110 .
- Catalog server 110 may also be implemented in a distributed network. For example, catalog server 110 may communicate via network 130 with one or more additional catalog servers (not shown) storing additional data.
- Catalog server 120 may further include a data store 125 .
- Data store 125 may store data describing products and/or services offered for sale by an Internet site provided by retail server 110 .
- data store 125 may store pages that are displayable by a computer executing software, such as an Internet browser.
- data store 125 may store product/or service descriptions, prices, and media used in connection with the sale of the products and/or services.
- Media may include any images, photographs, sounds, and/or video clips that provide samples and/or information pertaining to the products and/or services.
- Products and/or services having information stored in data store 125 may be associated with a unique product identifier (ID), for example.
- ID unique product identifier
- Terminals 140 - 160 may be any type device for communicating with retail server 110 and/or catalog server 120 over network 130 .
- terminals 140 - 160 may be personal computers, handheld devices (e.g., PDAs, cellular phones, etc.), or any other appropriate computing platform or device capable of exchanging data with network 130 .
- Terminals 140 - 160 may each include a processor and a memory (not shown), for example.
- terminals 140 - 160 may execute program modules that provide one or more graphical user interfaces (GUIs) for interacting with network resources, such as retail server 110 and/or catalog server 120 .
- GUIs graphical user interfaces
- users of terminals 140 - 160 may access and/or receive data from retail server 110 and/or catalog server 120
- users at terminals 140 - 160 may access and/or receive data directly from retail server 110 .
- retail server 110 may retrieve appropriate data from catalog server 120 and serve such data to users at terminals 140 - 160 .
- “users” may include individuals purchasing products and/or services or individuals listing products and/or services for sale through the use of an Internet site provided by retail server 110 .
- “users” may include individuals having electronic accounts, such as accounts storing data in electronic form (e.g., files), financial accounts, social networking accounts, and the like.
- retail server 110 may transmit a document (e.g., a web page) that is accessible by an Internet browser.
- the document may include options for a user to log onto a secure site provided by retail server 110 .
- the Internet site may use a secure communication environment, such as an HTTPS (hypertext transfer protocol secure) environment to transfer data over network 130 , data transfer is assumed to be secure.
- HTTPS hypertext transfer protocol secure
- retail server 110 may also require the user to respond to a security challenge question after authenticating the username and password.
- retail server 110 may require the user to respond to a security challenge question to access a particular document (e.g., to perform a new transaction). In such an embodiment, retail server 110 may have previously authenticated the username and password combination.
- retail server 110 may require the user to respond to a security challenge question in lieu of submitting a username and password combination. Security challenge questions and authentication are discussed below in further detail.
- FIG. 2 shows a diagram of an example architecture of retail server 110 , in accordance with one or more embodiments of the present invention.
- Retail server 110 may include a processor 112 and a memory 114 .
- Memory 114 may be one or more memory or storage devices that store data as well as software. Memory 114 may also comprise one or more of RAM, ROM, magnetic storage, or optical storage, for example. Memory 114 may store program modules that, when executed by processor 112 , perform one or more processes for operating an Internet site. Program modules that provide authentication functionality are discussed in more detail in connection with FIG. 3 .
- Retail server 110 may further include a username and password data store 115 , a user profile data store 116 , and a user transaction history data store 117 .
- Username and password data store 115 may store username and password combinations for users of a retail Internet site provided by retail server 110 .
- username and password data store 115 may store username and password combinations in one or more secure tables.
- User profile data store 116 may store information pertaining to users. For example, each user may have a profile including information such as name, billing address, shipping address, payment information (e.g., credit card, debit card, account numbers, etc.), age, occupation, etc.
- User transaction history data store 117 may store transaction histories of user relating to any transaction.
- Transactions may include any activities participated in by users and/or provided by an Internet site, such as, for example, game histories, email histories, auction histories, download histories, search histories, or purchase histories.
- a purchase history may include information about orders including completed orders (e.g., orders for products and/or services that have been shipped or provided) and open orders (e.g., orders for products and/or services that have been placed, but have not been shipped or provided).
- the purchase histories may include the product IDs of the products purchased by users.
- Product IDs may include product names and/or product numbers, UPCs (Universal Product Codes), ISBN (International Standard Book Number), or any other identifier.
- retail server 110 may authenticate a user through the use of a security challenge question.
- the security challenge question may have a visual component that relates to the user's transaction history.
- the security challenge question may involve the use of a list of products and/or services that the user has previously purchased.
- Retail server 110 may select the products and/or services from user transaction history data store 117 and products and/or services from data store 125 that the user has not purchased.
- Retail server 110 may transmit a page to the user including the products and/or services that have been purchased by the user and the selected products and/or services that have not been purchased by the user.
- retail server 110 may depict the products and/or services visually (e.g., by an image) with or without accompanying text. Retail server 110 may then prompt the user to select one or more products and/or services from the displayed list that the user has purchased. If the user responds with a correct selection, retail server 110 may authenticate the user. Further details concerning the triggering and selection of security challenge questions are discussed below in connection with FIG. 3 .
- FIG. 3 is a diagram of an example software architecture for authenticating a user, in accordance with one or more embodiments of the present invention.
- the software architecture may be stored in memory 114 of retail server 110 , as shown in FIG. 2 , for example.
- memory 114 may store instructions of program 314 , which when executed, perform one or more data processes for authenticating a user.
- program 314 may include instructions in the form of one or more program modules 314 a - 314 e .
- Program modules 314 a - 314 e may include a trigger module 314 a , a select module 314 b , a display module 314 c , a challenge module 314 d , and an alert module 314 e.
- Trigger module 314 a may provide functionality for determining when retail server 110 will prompt a user to respond to a security challenge question. To determine whether to present a security challenge question, trigger module 314 a may consider data received from the user's terminal, the page the user is viewing or attempting to view, a status of the user account (i.e., whether an account has been marked for suspected fraud), or whether the user has supplied a username and password that has been authenticated. For example, trigger module 314 a may present the security challenge to a user after verification of a username and password combination or upon the occurrence of another event. Accordingly, in some disclosed embodiments, the security challenge question may follow authentication of a username and password combination. However, in other disclosed embodiments, the security challenge question may not follow authentication of a username and password combination.
- trigger module 314 a may present the security challenge question to a user when the user makes a selection of, or attempts to navigate to, a particular portion or document of an Internet site (e.g., when the user selects a link to view and/or change payment information, shipping address information, or a password).
- trigger module 314 a may present the security challenge question to a user when retail server 110 detects an unrecognized Internet Protocol (IP) address of the user's terminal or when the user attempts to purchase a new item.
- IP Internet Protocol
- a user may have previously accessed retail server 110 from terminal 140 . However, on a subsequent occasion, the user may attempt to access retail server from terminal 150 .
- IP Internet Protocol
- trigger module 314 a may present the security challenge question after detecting the unrecognized IP address of terminal 150 .
- trigger module 314 a may present the security challenge question to a user when retail server 110 no longer detects a cookie on the user's terminal.
- a “cookie” is typically an object that stores information, such as an identifier of the user, user preferences, and active shopping cart information, for example.
- Select module 314 b may determine which items to include in a security challenge question. For each security challenge question, select module 314 b will select one or more items (e.g., products and/or services) that are stored in the user's transaction history and a plurality of items that are not stored in the user's transaction history. Select module 314 b may obtain the items stored in the user's transaction history from user transaction history data store 117 . Select module 314 b may obtain items that are not stored in the user's transaction history from data store 125 . Select module 314 b may compare, for example, an identifier of any item selected from data store 125 against identifiers stored for the user in user transaction history data store 117 in order to avoid selecting items previously purchased by the user. Furthermore, the selection of items by select module 314 b may occur at random or based on certain predetermined rules.
- items e.g., products and/or services
- select module 314 b may randomly select a product from a plurality of product categories (e.g., selecting a book, a CD, a DVD, an electronic device, and a product purchased by the user). Select module 314 b may also randomly select products based on other criteria, such as sales rank, based on a recommendation system, etc. Furthermore, select module 314 b may exclude certain popular items based on an exclude list or based on high sales rankings (e.g., exclude best selling books and/or DVDs since a large number of users have purchased them).
- select module 314 b may enforce a cutoff point, such as only selecting from items that have been included in the user's transaction history within a particular time period (e.g., within the last six months). Furthermore, select module 314 b may determine which product selection techniques are more effective at reducing fraud after monitoring the success rate of prior security challenge questions (e.g., by comparing failure rates for user accounts that have been compromised to determine the best method). Select module 314 b may also identify items purchased by the user after the cutoff point and not select those items as being items not included in the user's transaction history.
- the examples described herein relate to products and/or services, instead of prompting the user to select from products and/or services, other kinds of security challenge questions are consistent with the scope of the present invention.
- the user could be required to select from a list of locations (e.g., city and state) to identify which location or locations the user shipped a recent order.
- Other alternatives include prompting the user to identify a payment method previously used for a prior purchase.
- Display module 314 c may format and transmit data for a security challenge question to one of terminals 140 - 160 .
- FIG. 4 provides an example of a user interface and is discussed below in further detail.
- display module 314 c may access data store 125 or network resources over network 130 for media (images, sounds, video clips, etc.) that pertain to items that were selected by select module 314 b.
- display module 314 c may format the appearance of the security challenge question, such as the arrangement of items.
- Display module 314 c may list images of the items, or play video and/or sound clips describing the items, or play video showing moving images of the items.
- display module 314 c may select a sound and/or video clip from the item itself that is reproduced to the user as part of the security challenge question.
- display module 314 c may present the security challenge question using any appropriate identifier to represent an item in lieu of text and/or graphical information.
- An example of a user interface is shown in FIG. 4 and discussed in further detail.
- Challenge module 314 d may receive and evaluate user selections of items included in a security challenge question. For example, the user may, in responding to a security challenge question, check a box next to displayed items, clicked and/or highlighted the items, use voice and/or touch selection, or drag/dropped icons of the items, or selected items from pull down lists for item categories, for example. Data representing the selection(s) is then received by retail server 110 for determination of whether or not the selection(s) is correct.
- challenge module 314 d may determine whether or not to suspend access to the user account (e.g., indefinite or locked for a predetermined time period). Furthermore, challenge module 314 d may determine whether to provide a user with a second challenge question in the event of an incorrect answer. For example, after an incorrect answer, challenge module 314 d may prevent a user from logging into the account for a predetermined period of time (e.g., must wait an hour) or the user could be locked out until the user calls customer service. If a user makes a mistake, challenge module 314 d may determine whether to present a new security challenge question or whether to let the user make a second selection. Additionally, challenge module 314 d may require the user to select from two different lists in consecutive pages in order to reduce the chance of a fraudulent lucky guess.
- a predetermined period of time e.g., must wait an hour
- Alert module 314 e may generate and send a notification (e.g., an email, voicemail, or text message) to an email address associated with the user account when a suspected intruder has attempted to access the account.
- the notification may include a message informing the user that someone appears to have tried to fraudulently access his or her account.
- the message may further indicate that the user should disregard the message if the user was the individual that incorrectly responded to the security challenge question.
- alert module 314 e may send a notification indicating that the user's account has been locked either temporarily or indefinitely. For example, the user may need to wait a predetermined period of time or may need to contact customer service to reactivate the account.
- Alert module 314 e may also send internal alerts to, for example, members of an internal investigation team based on an incorrect response.
- program modules 314 a - 314 e have been described above as being separate modules, one of ordinary skill in the art will recognize that functionalities provided by one or more modules may be combined.
- FIG. 4 is an example of a user interface 400 for authenticating a user in a manner consistent with certain aspects of the present invention.
- retail server 110 may transmit data for user interface 400 including a challenge question after authenticating a username and password combination or after the user has navigated to or attempted to navigate to a particular page.
- retail server 110 may determine which products and/or services to include in the security challenge question, as discussed above.
- user interface 400 includes a display of items 401 - 409 .
- Each item includes a graphic image depicting a product.
- Item 401 is a DVD
- item 402 is a watch
- item 403 is a book
- item 404 is a computer
- item 405 is a CD
- item 406 is a toy car
- item 407 is a pair of speakers
- item 408 is a HDTV
- item 409 is a bookshelf.
- user interface 400 includes OK button 410 , which a user may, for example, select with a pointing device in order to submit selections to retail server 110 .
- OK button 410 which a user may, for example, select with a pointing device in order to submit selections to retail server 110 .
- a message displayed at the top of user interface 400 may provide instructions for the user.
- the user is provided with a message stating, “To help us verify your identity and keep your account safe, please select the item(s) you have recently purchased by checking the appropriate box(es). After you have made your selections, please click on the OK button.”
- the exemplary security challenge question does not specify the number of items that the user is to select. Accordingly, the user must select the items that he or she previously purchased in order to proceed past this authentication screen.
- the security challenge question may specify to the user to select at least x (e.g., two) number of items from the displayed items that have been purchased within a particular timeframe.
- a user purchased the HDTV shown as item 408 and the computer shown as item 404 within a predetermined time period (e.g., six months). Accordingly, product identifiers for items 404 and 408 are stored in the user's transaction history. The user, however, did not purchase the other items shown in user interface 400 (i.e., items 401 - 403 and 405 - 409 ). Accordingly, if the user selects the check boxes of items 404 and 408 and then OK button 410 , retail server 110 will authenticate the user. Any other selection, such as a selection of additional items or fewer items that include or do not include items 404 and 408 cause retail server 110 to return a message to the user indicating that the user has not been authenticated.
- a predetermined time period e.g., six months
- retail server 110 may present the user with a second chance to correctly answer the same security challenge question or may present the user with a second chance to answer a new security challenge question. Furthermore, subsequent to a correct response, for an additional layer of security, retail server 110 may present a second security challenge question (i.e., to be authenticated, the user must answer correctly consecutive security challenge questions). Still further, although shown in FIG. 4 as one group of items, user interface 400 may include two or more groups of items. For example, a user may be prompted to select one or more products from a first group and one or more products from a second group in order to be authenticated.
- user interface 400 may instead prompt the user to select one or more items that the user has not purchased.
- user interface 400 may include an icon (not shown) providing the user with an option of answering the security challenge question with a response indicating that the user did not purchase any of the displayed items.
- FIG. 5 is a flow diagram 500 of an example of a routine for authenticating a user in accordance with one or more embodiments of the present invention.
- Routine 500 may implement processes according to one or more of program modules 314 a - 314 e and may include causing retail server 110 to transmit data for a user interface, such as user interface 400 .
- trigger module 314 a may determine that a security challenge question should be presented to a user. For example, trigger module 314 a may have monitored data received from one of terminals 140 - 160 from which the user has accessed an Internet site. Triggering of the security challenge question may follow the user viewing or attempting to view a certain page or based on a status of the user account (i.e., whether an account has been marked for suspected fraud), or whether the user has supplied a username and password that has been authenticated. Accordingly, block 502 may occur after verification of a username and password combination or upon the occurrence of another event.
- select module 314 b may determine which items to include in a security challenge question. For each security challenge question, select module 314 b will select one or more items (e.g., products and/or services) that are stored in the user's transaction history and a plurality of items that are not stored in the user's transaction history. Select module 314 b may obtain the items stored in the user's transaction history from user transaction history data store 117 . Select module 314 b may obtain the other items that are not stored in the user's transaction history from data store 125 .
- items e.g., products and/or services
- select module 314 b may also utilize such information to determine items that should not be included in the security challenge question. For example, if the security challenge question is requesting that the user select items purchased within the last six months, in addition to providing items included in the user transition history that were purchased in the last six months, select module 314 b may also determine not to include items that were purchased during the three months preceding the six month window. By specifically excluding items that were actually purchased by the user prior to the specified time-window reduces the likelihood that a user incorrectly select the item as being purchased within the time window based upon a legitimate but incorrect belief that the item was purchased during the specified time-window.
- select module 314 b may randomly select products that are not stored in the user's transaction history from a plurality of product categories (e.g., selecting a book, a CD, a DVD, an electronic device, and a product purchased by the user). Select module 314 b may also select one or more of the products that the user did not purchase by taking into consideration the products that are stored in the user's transaction history. That is, select module 314 b may select products that the user did not purchase, but that are similar in product type or are made by the same manufacturer as products that were previously purchased by the user.
- product categories e.g., selecting a book, a CD, a DVD, an electronic device, and a product purchased by the user.
- Select module 314 b may also select one or more of the products that the user did not purchase by taking into consideration the products that are stored in the user's transaction history. That is, select module 314 b may select products that the user did not purchase, but that are similar in product type or are made by the same manufacturer as products that
- display module 314 c formats and transmits data for the security challenge question, including identifiers of the items selected in block 504 , to one of terminals 140 - 160 .
- display module 314 c may access data store 125 or network resources over network 130 for media (images, sounds, video clips, etc.) that pertain to items that were selected by select module 314 b.
- challenge module 314 d receives a selection of one or more items from the user at one of terminals 140 - 160 .
- the user may have checked a box, clicked and/or highlighted, used voice, touch, or drag/dropped icons, or selected items from pull down lists for item categories.
- challenge module 314 d evaluates whether or not the received selection is correct. If the received selection is correct, routine 500 proceeds to block 522 .
- the received selection must be exactly correct (i.e., the user must have selected all items previously purchased that were displayed). However, in other embodiments consistent with the present invention, a majority of correction selections may be sufficient to constitute a correct selection as long as no incorrect items are selected. For example, selecting two out of three items that have been purchased may be sufficient. In contrast, selecting two purchased items and one item that was not purchased may not be sufficient. Still further, in other embodiments, a correct answer may include a small number of incorrect selections (e.g., only one incorrect selection of an item not previously purchased) so long as the rest of the selected items were previously purchased.
- challenge module 314 d authenticates the user and routine 500 completes. However, if the received selection is not correct, routine 500 proceeds to decision block 512 .
- challenge module 314 d determines whether or not to give the user another chance. For example, challenge module 314 d may determine whether to provide a user with a second chance based on how may incorrect responses have been received or based on a status of the account (e.g., suspected fraudulent activity). For example, if multiple unsuccessful attempts to log into an account have been made, then challenge module 314 d may determine that the user should not receive a second chance. If the user is given another chance, routine 500 returns to block 504 and proceeds as discussed above. If the user is not given another chance, then routine 500 proceeds to decision block 514 .
- a status of the account e.g., suspected fraudulent activity
- challenge module 314 d may determine whether to suspend access to the account for which the security challenge question was incorrectly answered. If challenge module 314 d is going to suspend access to the account, routine 500 proceeds to block 516 . However, if challenge module 314 d is not going to suspend access to the account, then routine 500 proceeds to decision block 518 .
- challenge module 314 d may lock the account. Routine 500 then proceeds to decision block 518 .
- alert module 314 e determines whether to send an alert notification. If alert module 314 e is going to send an alert, routine 500 proceeds to block 520 . In block 520 , alert module 314 e sends an alert notification. For example, alert module 314 e may generate and send a notification (e.g., an email, voicemail, or text message) to an email address associated with the account when a suspected intruder has attempted to access the account. Routine 500 then completes.
- a notification e.g., an email, voicemail, or text message
- blocks 502 - 522 may be optional and may be omitted from implementations in certain embodiments.
- aspects of the invention are described for being stored in memory, one skilled in the art will appreciate that these aspects can also be stored on other types of computer-readable media, such as secondary storage devices, for example, hard disks, floppy disks, or CD-ROM, the Internet or other propagation medium, or other forms of RAM or ROM.
- secondary storage devices for example, hard disks, floppy disks, or CD-ROM, the Internet or other propagation medium, or other forms of RAM or ROM.
- Programs based on the written description and methods of this invention are within the skill of an experienced developer.
- the various programs or program modules can be created using any of the techniques known to one skilled in the art or can be designed in connection with existing software.
- program sections or program modules can be designed in or by means of Java, C++, HTML, XML, or HTML with included Java applets.
- One or more of such software sections or modules can be integrated into a computer system or existing e-mail or browser software.
Landscapes
- Business, Economics & Management (AREA)
- Engineering & Computer Science (AREA)
- Accounting & Taxation (AREA)
- General Physics & Mathematics (AREA)
- Finance (AREA)
- Strategic Management (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
Description
- This application is a continuation of and claims the benefit of both co-pending U.S. patent application Ser. No. 14/280,708, filed May 19, 2014, entitled “AUTHENTICATION USING A TRANSACTION HISTORY,” as well as U.S. patent application Ser. No. 11/797,455, filed May 3, 2007, now U.S. Pat. No. 8,732,089, entitled “AUTHENTICATION USING A TRANSACTION HISTORY,” both of which are incorporated herein by reference in their entireties.
- The present invention generally relates to the field of computerized systems. More particularly, the invention relates to computerized systems and methods for authenticating a user to access or utilize all or part of a computer system.
- To access an account at an Internet site, a user typically submits credentials to the Internet site, which are then authenticated. For example, the most commonly encountered credentials are username and password. The username may be an email address of the user or other alphanumeric identifier. The username, accordingly, may be known to others. By contrast, the password is kept secret by the user and may include a combination of alphanumeric characters.
- As the Internet has proliferated as a means of conducting commerce, Internet fraud has also increased. The username and password combination is no longer sufficient to securely authenticate users of Internet sites. For example, through a fraud scheme called “phishing,” individuals fraudulently obtain username and password combinations from users that receive electronic messages purporting to originate from a legitimate Internet site. Some phishing techniques send out mass electronic mail messages to persons representing that the messages are from a trusted source (e.g., an Internet site from which the user has purchased goods or services). The messages request a reply from a user providing his or her username and password or provide a link to a page on which the user is requested to confirm his or her username and password.
- When a perpetrator of such a phishing technique collects a large number of username and password combinations, the amount of damage the perpetrator may cause is considerable. For example, the perpetrator might execute automated scripts to access a large number of user accounts. If an Internet site allows users to sell items to the public, the perpetrator may use the automated scripts to log into the user accounts, post listings of items with low prices, and collect money without any intention to ship the sold items. Alternatively, the perpetrator might access a user's account information, such as payment information (e.g., credit card information) and/or might make unauthorized purchases using stolen payment information or may place orders with Internet sites.
- As is evident from the foregoing, since user account information may be guarded by only username and password combinations, once a perpetrator has obtained a username and password, the perpetrator has access to all aspects of the account because the username and password are the sole line of defense for many accounts. Recognizing that current systems and methods of user authentication do not sufficiently guard against fraud, some Internet sites have added additional authentication steps. For example, some Internet sites present security challenge questions in addition to authenticating a username and password. These security challenge questions might ask the user to submit, for example, his or her mother's maiden name, where the user was born, or a name of a first employer. These questions require the user to remember this information and enter it correctly (e.g., correct spelling, punctuation, etc.) Furthermore, although requiring more effort, perpetrators of fraud may also obtain this information from the user and/or other sources to circumvent extra security measures.
- As a result of the foregoing, traditional techniques require more user effort, result in a less user friendly experience, and do not secure user account information. Accordingly, there is a need for improved systems and methods that secure user account information while preserving the user experience.
- The accompanying drawings, which are incorporated in and constitute a part of this disclosure, illustrate various embodiments and aspects of the present invention. In the drawings:
-
FIG. 1 is a diagram of an example of a system for authenticating a user; -
FIG. 2 is a diagram of an example of an architecture of a retail server; -
FIG. 3 is a diagram of an example of a software architecture for authenticating a user; -
FIG. 4 is an example of a user interface for authenticating a user; and -
FIG. 5 is an example of a flow diagram of a routine for authenticating a user. - The following detailed description refers to the accompanying drawings. Wherever possible, the same reference numbers are used in the drawings and the following description to refer to the same or similar parts. While several exemplary embodiments are described herein, modifications, adaptations and other implementations are possible, without departing from the spirit and scope of the invention. For example, substitutions, additions or modifications may be made to the components illustrated in the drawings, and the exemplary methods described herein may be modified by substituting, reordering, or adding steps to the disclosed methods. Accordingly, the following detailed description does not limit the invention. Instead, the proper scope of the invention is defined by the appended claims.
- Embodiments disclosed herein provide computer-implemented systems and methods for authenticating a user. The systems and methods may maintain transaction history information for each one of a set of users. For example, the transaction history information may be stored in a storage device. Furthermore, the systems and methods may provide identifiers that are associated with items for display. The identifiers may be provided to, for example, one of the users. The systems and methods may receive, from one of the users, a selection of one or more of the identifiers. Furthermore, the systems and methods may authenticate the user as a function of the selection and a transaction history of the user.
- Consistent with a disclosed embodiment, a computer-implemented method is provided for authenticating a user. The method may maintain, in a storage device, transaction history information for a user identifying items previously purchased by the user. The method may further provide a plurality of identifiers associated with items for display. The plurality of identifiers may include at least one identifier of an item previously purchased by the user and a plurality of identifiers of items not previously purchased by the user. The method may receive, from the user, a selection of one or more of the identifiers and determine whether the selected one or more items corresponds with items previously purchased by the user. Furthermore, the method may authenticate the user if the selected one or more items corresponds with items previously purchased by the user.
- Consistent with another disclosed embodiment, a computer-implemented method is provided for authenticating a user. The method may maintain, in a storage device, transaction history information for each one of a set of users. The method may provide identifiers associated with items for display and receive, from one of the users, a selection of one or more of the identifiers. Furthermore, the method may authenticate the user as a function of the selection and a transaction history of the user.
- Consistent with another disclosed embodiment, a computer-implemented method is provided for authenticating a user. The method may display a group of items comprising a plurality of items that are not included in a transaction history of the user and one or more items that are included in the transaction history of the user. The method may receive, from the user, a selection of one or more items in the group and determine whether the selected one or more items are included in the transaction history. Furthermore, the method may authenticate the user if the selected one or more items are included in the transaction history.
- Consistent with yet another disclosed embodiment, a computer-implemented method is provided for authenticating a user. The method may select, for each of a plurality of categories of products, a product. One of the selected products may have been purchased by the user. The method may display identifiers of the selected products and receive, from the user, a selection of one of the identifiers. Furthermore, the method may authenticate the user based on the selection.
- Consistent with still yet another disclosed embodiment, a system is provided for authenticating a user. The system may comprise a catalog server including a data store storing identifiers of items and a retail server in communication with the catalog server. The retail server may be operable to transmit a plurality of identifiers of items retrieved from the catalog server and receive, from the user, a selection of one of the identifiers. Furthermore, the retail server may authenticate the user based on the selected identifier.
- Consistent with other disclosed embodiments, a computer-readable medium is provided that stores program instructions for implementing any of the above-described methods.
- It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention or embodiments thereof, as claimed.
-
FIG. 1 is an example of asystem 100 for authenticating a user in accordance with one or more embodiments of the present invention. In particular,system 100 may provide functionality for authenticating a user based on the user's response to a challenge question that is related to the user's transaction history. As shown insystem 100,retail server 110,catalog server 120, and terminals 140-160 are connected to anetwork 130. One of skill in the art will appreciate that although one retailer server, one catalog server, and three terminals are depicted inFIG. 1 , any number of these entities may be provided. Furthermore, one of ordinary skill in the art will recognize that functions provided by one or more entities ofsystem 100 may be combined. For example, functionality provided byretail server 110 andcatalog server 120 may be combined. -
Network 130 provides communications between the various entities insystem 100, such asretail server 110,catalog servers 120, and terminals 140-160. In addition,retail server 110,catalog server 120, and/or terminals 140-160 may access legacy systems (not shown) vianetwork 130, or may directly access legacy systems, data stores, or other network applications.Network 130 may be a shared, public, or private network, may encompass a wide area or local area, and may be implemented through any suitable combination of wired and/or wireless communication networks. Furthermore,network 130 may comprise an intranet or the Internet. -
Retail server 110 may comprise a general purpose computer (e.g., a personal computer, network computer, server, or mainframe computer) having one or more processors (not shown inFIG. 1 ) that may be selectively activated or reconfigured by a computer program.Retail server 110 may also be implemented in a distributed network. For example,retail server 110 may communicate vianetwork 130 with one or more additional retail servers (not shown), which may enableretail server 110 to distribute processes for parallel execution by a plurality of retail servers. Alternatively,retail server 110 may be specially constructed for carrying-out methods consistent with disclosed embodiments.Retail server 110 may provide access to an Internet site, as well as provide functionality for authenticating users, and transmitting data in connection with the sale of products and/or services. Additional details ofretailer server 110 are discussed below in connection withFIG. 2 . -
Catalog server 120 may comprise a general purpose computer (e.g., a personal computer, network computer, server, or mainframe computer) having one or more processors (not shown) that may be selectively activated or reconfigured by a computer program. Furthermore,catalog server 120 may communicate vianetwork 130 or may be in direct bilateral communication withretail server 110.Catalog server 110 may also be implemented in a distributed network. For example,catalog server 110 may communicate vianetwork 130 with one or more additional catalog servers (not shown) storing additional data. -
Catalog server 120 may further include adata store 125.Data store 125 may store data describing products and/or services offered for sale by an Internet site provided byretail server 110. For example,data store 125 may store pages that are displayable by a computer executing software, such as an Internet browser. Furthermore,data store 125 may store product/or service descriptions, prices, and media used in connection with the sale of the products and/or services. Media may include any images, photographs, sounds, and/or video clips that provide samples and/or information pertaining to the products and/or services. Products and/or services having information stored indata store 125 may be associated with a unique product identifier (ID), for example. - Terminals 140-160 may be any type device for communicating with
retail server 110 and/orcatalog server 120 overnetwork 130. For example, terminals 140-160 may be personal computers, handheld devices (e.g., PDAs, cellular phones, etc.), or any other appropriate computing platform or device capable of exchanging data withnetwork 130. Terminals 140-160 may each include a processor and a memory (not shown), for example. Further, terminals 140-160 may execute program modules that provide one or more graphical user interfaces (GUIs) for interacting with network resources, such asretail server 110 and/orcatalog server 120. Although users of terminals 140-160 may access and/or receive data fromretail server 110 and/orcatalog server 120, in a preferred embodiment, users at terminals 140-160 may access and/or receive data directly fromretail server 110. For example,retail server 110 may retrieve appropriate data fromcatalog server 120 and serve such data to users at terminals 140-160. As the term is used herein, “users” may include individuals purchasing products and/or services or individuals listing products and/or services for sale through the use of an Internet site provided byretail server 110. Furthermore, “users” may include individuals having electronic accounts, such as accounts storing data in electronic form (e.g., files), financial accounts, social networking accounts, and the like. - Users may access
retail server 110 overnetwork 130 through an Internet browser or software application running on any one of terminals 140-160. For example,retail server 110 may transmit a document (e.g., a web page) that is accessible by an Internet browser. The document may include options for a user to log onto a secure site provided byretail server 110. Because the Internet site may use a secure communication environment, such as an HTTPS (hypertext transfer protocol secure) environment to transfer data overnetwork 130, data transfer is assumed to be secure. - Users may log onto the secure site provided by
retail server 110 by supplying credentials, such as a username and a password. Furthermore, consistent with disclosed embodiments,retail server 110 may also require the user to respond to a security challenge question after authenticating the username and password. In other disclosed embodiments,retail server 110 may require the user to respond to a security challenge question to access a particular document (e.g., to perform a new transaction). In such an embodiment,retail server 110 may have previously authenticated the username and password combination. In still other disclosed embodiments,retail server 110 may require the user to respond to a security challenge question in lieu of submitting a username and password combination. Security challenge questions and authentication are discussed below in further detail. -
FIG. 2 shows a diagram of an example architecture ofretail server 110, in accordance with one or more embodiments of the present invention.Retail server 110 may include aprocessor 112 and amemory 114.Memory 114 may be one or more memory or storage devices that store data as well as software.Memory 114 may also comprise one or more of RAM, ROM, magnetic storage, or optical storage, for example.Memory 114 may store program modules that, when executed byprocessor 112, perform one or more processes for operating an Internet site. Program modules that provide authentication functionality are discussed in more detail in connection withFIG. 3 . -
Retail server 110 may further include a username andpassword data store 115, a userprofile data store 116, and a user transactionhistory data store 117. Username andpassword data store 115 may store username and password combinations for users of a retail Internet site provided byretail server 110. For example, username andpassword data store 115 may store username and password combinations in one or more secure tables. Userprofile data store 116 may store information pertaining to users. For example, each user may have a profile including information such as name, billing address, shipping address, payment information (e.g., credit card, debit card, account numbers, etc.), age, occupation, etc. User transactionhistory data store 117 may store transaction histories of user relating to any transaction. Transactions may include any activities participated in by users and/or provided by an Internet site, such as, for example, game histories, email histories, auction histories, download histories, search histories, or purchase histories. For example, a purchase history may include information about orders including completed orders (e.g., orders for products and/or services that have been shipped or provided) and open orders (e.g., orders for products and/or services that have been placed, but have not been shipped or provided). Furthermore, the purchase histories may include the product IDs of the products purchased by users. Product IDs may include product names and/or product numbers, UPCs (Universal Product Codes), ISBN (International Standard Book Number), or any other identifier. - In disclosed embodiments, as part of the authentication process
retail server 110 may authenticate a user through the use of a security challenge question. The security challenge question may have a visual component that relates to the user's transaction history. For example, the security challenge question may involve the use of a list of products and/or services that the user has previously purchased.Retail server 110 may select the products and/or services from user transactionhistory data store 117 and products and/or services fromdata store 125 that the user has not purchased.Retail server 110 may transmit a page to the user including the products and/or services that have been purchased by the user and the selected products and/or services that have not been purchased by the user. Furthermore, in presenting the security challenge question to the user,retail server 110 may depict the products and/or services visually (e.g., by an image) with or without accompanying text.Retail server 110 may then prompt the user to select one or more products and/or services from the displayed list that the user has purchased. If the user responds with a correct selection,retail server 110 may authenticate the user. Further details concerning the triggering and selection of security challenge questions are discussed below in connection withFIG. 3 . -
FIG. 3 is a diagram of an example software architecture for authenticating a user, in accordance with one or more embodiments of the present invention. The software architecture may be stored inmemory 114 ofretail server 110, as shown inFIG. 2 , for example. In one embodiment,memory 114 may store instructions ofprogram 314, which when executed, perform one or more data processes for authenticating a user. To do so,program 314 may include instructions in the form of one ormore program modules 314 a-314 e.Program modules 314 a-314 e may include atrigger module 314 a, aselect module 314 b, adisplay module 314 c, achallenge module 314 d, and analert module 314 e. -
Trigger module 314 a may provide functionality for determining whenretail server 110 will prompt a user to respond to a security challenge question. To determine whether to present a security challenge question,trigger module 314 a may consider data received from the user's terminal, the page the user is viewing or attempting to view, a status of the user account (i.e., whether an account has been marked for suspected fraud), or whether the user has supplied a username and password that has been authenticated. For example,trigger module 314 a may present the security challenge to a user after verification of a username and password combination or upon the occurrence of another event. Accordingly, in some disclosed embodiments, the security challenge question may follow authentication of a username and password combination. However, in other disclosed embodiments, the security challenge question may not follow authentication of a username and password combination. - For example,
trigger module 314 a may present the security challenge question to a user when the user makes a selection of, or attempts to navigate to, a particular portion or document of an Internet site (e.g., when the user selects a link to view and/or change payment information, shipping address information, or a password). In another embodiment,trigger module 314 a may present the security challenge question to a user whenretail server 110 detects an unrecognized Internet Protocol (IP) address of the user's terminal or when the user attempts to purchase a new item. For example, a user may have previously accessedretail server 110 fromterminal 140. However, on a subsequent occasion, the user may attempt to access retail server fromterminal 150. Accordingly,trigger module 314 a may present the security challenge question after detecting the unrecognized IP address ofterminal 150. In yet another embodiment,trigger module 314 a may present the security challenge question to a user whenretail server 110 no longer detects a cookie on the user's terminal. A “cookie” is typically an object that stores information, such as an identifier of the user, user preferences, and active shopping cart information, for example. -
Select module 314 b may determine which items to include in a security challenge question. For each security challenge question,select module 314 b will select one or more items (e.g., products and/or services) that are stored in the user's transaction history and a plurality of items that are not stored in the user's transaction history.Select module 314 b may obtain the items stored in the user's transaction history from user transactionhistory data store 117.Select module 314 b may obtain items that are not stored in the user's transaction history fromdata store 125.Select module 314 b may compare, for example, an identifier of any item selected fromdata store 125 against identifiers stored for the user in user transactionhistory data store 117 in order to avoid selecting items previously purchased by the user. Furthermore, the selection of items byselect module 314 b may occur at random or based on certain predetermined rules. - For example,
select module 314 b may randomly select a product from a plurality of product categories (e.g., selecting a book, a CD, a DVD, an electronic device, and a product purchased by the user).Select module 314 b may also randomly select products based on other criteria, such as sales rank, based on a recommendation system, etc. Furthermore,select module 314 b may exclude certain popular items based on an exclude list or based on high sales rankings (e.g., exclude best selling books and/or DVDs since a large number of users have purchased them). When selecting items from the user's transaction history,select module 314 b may enforce a cutoff point, such as only selecting from items that have been included in the user's transaction history within a particular time period (e.g., within the last six months). Furthermore,select module 314 b may determine which product selection techniques are more effective at reducing fraud after monitoring the success rate of prior security challenge questions (e.g., by comparing failure rates for user accounts that have been compromised to determine the best method).Select module 314 b may also identify items purchased by the user after the cutoff point and not select those items as being items not included in the user's transaction history. - Although the examples described herein relate to products and/or services, instead of prompting the user to select from products and/or services, other kinds of security challenge questions are consistent with the scope of the present invention. For example, in other disclosed embodiments, the user could be required to select from a list of locations (e.g., city and state) to identify which location or locations the user shipped a recent order. Other alternatives include prompting the user to identify a payment method previously used for a prior purchase.
-
Display module 314 c may format and transmit data for a security challenge question to one of terminals 140-160.FIG. 4 provides an example of a user interface and is discussed below in further detail. To generate the user interface,display module 314 c may accessdata store 125 or network resources overnetwork 130 for media (images, sounds, video clips, etc.) that pertain to items that were selected byselect module 314 b. - Since the security challenge question may be presented with graphic and/or auditory information, user recall is significantly improved because such information is typically more readily remembered than passwords. For example,
display module 314 c may format the appearance of the security challenge question, such as the arrangement of items.Display module 314 c may list images of the items, or play video and/or sound clips describing the items, or play video showing moving images of the items. For items such as books, CDs, movies, etc,display module 314 c may select a sound and/or video clip from the item itself that is reproduced to the user as part of the security challenge question. Furthermore,display module 314 c may present the security challenge question using any appropriate identifier to represent an item in lieu of text and/or graphical information. An example of a user interface is shown inFIG. 4 and discussed in further detail. -
Challenge module 314 d may receive and evaluate user selections of items included in a security challenge question. For example, the user may, in responding to a security challenge question, check a box next to displayed items, clicked and/or highlighted the items, use voice and/or touch selection, or drag/dropped icons of the items, or selected items from pull down lists for item categories, for example. Data representing the selection(s) is then received byretail server 110 for determination of whether or not the selection(s) is correct. - After receiving an incorrect selection,
challenge module 314 d may determine whether or not to suspend access to the user account (e.g., indefinite or locked for a predetermined time period). Furthermore,challenge module 314 d may determine whether to provide a user with a second challenge question in the event of an incorrect answer. For example, after an incorrect answer,challenge module 314 d may prevent a user from logging into the account for a predetermined period of time (e.g., must wait an hour) or the user could be locked out until the user calls customer service. If a user makes a mistake,challenge module 314 d may determine whether to present a new security challenge question or whether to let the user make a second selection. Additionally,challenge module 314 d may require the user to select from two different lists in consecutive pages in order to reduce the chance of a fraudulent lucky guess. -
Alert module 314 e may generate and send a notification (e.g., an email, voicemail, or text message) to an email address associated with the user account when a suspected intruder has attempted to access the account. The notification may include a message informing the user that someone appears to have tried to fraudulently access his or her account. The message may further indicate that the user should disregard the message if the user was the individual that incorrectly responded to the security challenge question. Furthermore, if the user incorrectly selects an item a predetermined number of times,alert module 314 e may send a notification indicating that the user's account has been locked either temporarily or indefinitely. For example, the user may need to wait a predetermined period of time or may need to contact customer service to reactivate the account.Alert module 314 e may also send internal alerts to, for example, members of an internal investigation team based on an incorrect response. - Although
program modules 314 a-314 e have been described above as being separate modules, one of ordinary skill in the art will recognize that functionalities provided by one or more modules may be combined. -
FIG. 4 is an example of auser interface 400 for authenticating a user in a manner consistent with certain aspects of the present invention. As discussed above,retail server 110 may transmit data foruser interface 400 including a challenge question after authenticating a username and password combination or after the user has navigated to or attempted to navigate to a particular page. Furthermore,retail server 110 may determine which products and/or services to include in the security challenge question, as discussed above. - As shown in
FIG. 4 ,user interface 400 includes a display of items 401-409. Each item includes a graphic image depicting a product.Item 401 is a DVD,item 402 is a watch,item 403 is a book,item 404 is a computer,item 405 is a CD,item 406 is a toy car,item 407 is a pair of speakers,item 408 is a HDTV, anditem 409 is a bookshelf. Furthermore,user interface 400 includesOK button 410, which a user may, for example, select with a pointing device in order to submit selections toretail server 110. Although nine items are shown inuser interface 400, one of ordinary skill in the art will recognize the number and kinds of items may vary. In addition, although both images and text are shown inFIG. 4 , along with checkboxes for selecting items, one of ordinary skill in the art will recognize that any identifiers of items are in keeping with the spirit and scope of the present invention (e.g., displaying images without text, sound clips, or video clips, and using other selecting means, such as highlighting, touching, or speaking selections). - A message displayed at the top of
user interface 400 may provide instructions for the user. As shown inuser interface 400, the user is provided with a message stating, “To help us verify your identity and keep your account safe, please select the item(s) you have recently purchased by checking the appropriate box(es). After you have made your selections, please click on the OK button.” Accordingly, the exemplary security challenge question does not specify the number of items that the user is to select. Accordingly, the user must select the items that he or she previously purchased in order to proceed past this authentication screen. In alternative embodiments, the security challenge question may specify to the user to select at least x (e.g., two) number of items from the displayed items that have been purchased within a particular timeframe. - As an example, a user purchased the HDTV shown as
item 408 and the computer shown asitem 404 within a predetermined time period (e.g., six months). Accordingly, product identifiers foritems items OK button 410,retail server 110 will authenticate the user. Any other selection, such as a selection of additional items or fewer items that include or do not includeitems retail server 110 to return a message to the user indicating that the user has not been authenticated. - Subsequent to an incorrect response,
retail server 110 may present the user with a second chance to correctly answer the same security challenge question or may present the user with a second chance to answer a new security challenge question. Furthermore, subsequent to a correct response, for an additional layer of security,retail server 110 may present a second security challenge question (i.e., to be authenticated, the user must answer correctly consecutive security challenge questions). Still further, although shown inFIG. 4 as one group of items,user interface 400 may include two or more groups of items. For example, a user may be prompted to select one or more products from a first group and one or more products from a second group in order to be authenticated. - Although the
example user interface 400 shown inFIG. 4 prompts the user to select one or more items that the user has purchased, in an alternative embodiment,user interface 400 may instead prompt the user to select one or more items that the user has not purchased. Furthermore,user interface 400 may include an icon (not shown) providing the user with an option of answering the security challenge question with a response indicating that the user did not purchase any of the displayed items. One of ordinary skill in the art will recognize that modifications as to the number, arrangement, and security challenge questions are in keeping with the spirit and scope of the present invention. -
FIG. 5 is a flow diagram 500 of an example of a routine for authenticating a user in accordance with one or more embodiments of the present invention.Routine 500 may implement processes according to one or more ofprogram modules 314 a-314 e and may include causingretail server 110 to transmit data for a user interface, such asuser interface 400. - At the start of routine 500, in
block 502,trigger module 314 a may determine that a security challenge question should be presented to a user. For example,trigger module 314 a may have monitored data received from one of terminals 140-160 from which the user has accessed an Internet site. Triggering of the security challenge question may follow the user viewing or attempting to view a certain page or based on a status of the user account (i.e., whether an account has been marked for suspected fraud), or whether the user has supplied a username and password that has been authenticated. Accordingly, block 502 may occur after verification of a username and password combination or upon the occurrence of another event. - In
block 504,select module 314 b may determine which items to include in a security challenge question. For each security challenge question,select module 314 b will select one or more items (e.g., products and/or services) that are stored in the user's transaction history and a plurality of items that are not stored in the user's transaction history.Select module 314 b may obtain the items stored in the user's transaction history from user transactionhistory data store 117.Select module 314 b may obtain the other items that are not stored in the user's transaction history fromdata store 125. - In addition to selecting items from user transaction
history data store 117 to include in the security challenge question,select module 314 b may also utilize such information to determine items that should not be included in the security challenge question. For example, if the security challenge question is requesting that the user select items purchased within the last six months, in addition to providing items included in the user transition history that were purchased in the last six months,select module 314 b may also determine not to include items that were purchased during the three months preceding the six month window. By specifically excluding items that were actually purchased by the user prior to the specified time-window reduces the likelihood that a user incorrectly select the item as being purchased within the time window based upon a legitimate but incorrect belief that the item was purchased during the specified time-window. - Furthermore,
select module 314 b may randomly select products that are not stored in the user's transaction history from a plurality of product categories (e.g., selecting a book, a CD, a DVD, an electronic device, and a product purchased by the user).Select module 314 b may also select one or more of the products that the user did not purchase by taking into consideration the products that are stored in the user's transaction history. That is,select module 314 b may select products that the user did not purchase, but that are similar in product type or are made by the same manufacturer as products that were previously purchased by the user. - In
block 506,display module 314 c formats and transmits data for the security challenge question, including identifiers of the items selected inblock 504, to one of terminals 140-160. For example,display module 314 c may accessdata store 125 or network resources overnetwork 130 for media (images, sounds, video clips, etc.) that pertain to items that were selected byselect module 314 b. - In
block 508,challenge module 314 d receives a selection of one or more items from the user at one of terminals 140-160. For example, the user may have checked a box, clicked and/or highlighted, used voice, touch, or drag/dropped icons, or selected items from pull down lists for item categories. - In
decision block 510,challenge module 314 d evaluates whether or not the received selection is correct. If the received selection is correct, routine 500 proceeds to block 522. For example, in some embodiments, the received selection must be exactly correct (i.e., the user must have selected all items previously purchased that were displayed). However, in other embodiments consistent with the present invention, a majority of correction selections may be sufficient to constitute a correct selection as long as no incorrect items are selected. For example, selecting two out of three items that have been purchased may be sufficient. In contrast, selecting two purchased items and one item that was not purchased may not be sufficient. Still further, in other embodiments, a correct answer may include a small number of incorrect selections (e.g., only one incorrect selection of an item not previously purchased) so long as the rest of the selected items were previously purchased. - In
block 522,challenge module 314 d authenticates the user and routine 500 completes. However, if the received selection is not correct, routine 500 proceeds todecision block 512. - In
decision block 512, because the user has incorrectly answered the security challenge question,challenge module 314 d determines whether or not to give the user another chance. For example,challenge module 314 d may determine whether to provide a user with a second chance based on how may incorrect responses have been received or based on a status of the account (e.g., suspected fraudulent activity). For example, if multiple unsuccessful attempts to log into an account have been made, then challengemodule 314 d may determine that the user should not receive a second chance. If the user is given another chance, routine 500 returns to block 504 and proceeds as discussed above. If the user is not given another chance, then routine 500 proceeds todecision block 514. - In
decision block 514,challenge module 314 d may determine whether to suspend access to the account for which the security challenge question was incorrectly answered. Ifchallenge module 314 d is going to suspend access to the account, routine 500 proceeds to block 516. However, ifchallenge module 314 d is not going to suspend access to the account, then routine 500 proceeds todecision block 518. - In
block 516,challenge module 314 d may lock the account.Routine 500 then proceeds todecision block 518. - In
decision block 518,alert module 314 e determines whether to send an alert notification. Ifalert module 314 e is going to send an alert, routine 500 proceeds to block 520. Inblock 520,alert module 314 e sends an alert notification. For example,alert module 314 e may generate and send a notification (e.g., an email, voicemail, or text message) to an email address associated with the account when a suspected intruder has attempted to access the account.Routine 500 then completes. - As one of ordinary skill in the art will appreciate, one or more of blocks 502-522 may be optional and may be omitted from implementations in certain embodiments.
- The foregoing description has been presented for purposes of illustration. It is not exhaustive and does not limit the invention to the precise forms or embodiments disclosed. Modifications and adaptations of the invention will be apparent to those skilled in the art from consideration of the specification and practice of the disclosed embodiments of the invention. For example, the described implementations include software, but systems and methods consistent with the present invention may be implemented as a combination of hardware and software or in hardware alone. Examples of hardware include computing or processing systems, including personal computers, servers, laptops, mainframes, micro-processors and the like. Additionally, although aspects of the invention are described for being stored in memory, one skilled in the art will appreciate that these aspects can also be stored on other types of computer-readable media, such as secondary storage devices, for example, hard disks, floppy disks, or CD-ROM, the Internet or other propagation medium, or other forms of RAM or ROM.
- Computer programs based on the written description and methods of this invention are within the skill of an experienced developer. The various programs or program modules can be created using any of the techniques known to one skilled in the art or can be designed in connection with existing software. For example, program sections or program modules can be designed in or by means of Java, C++, HTML, XML, or HTML with included Java applets. One or more of such software sections or modules can be integrated into a computer system or existing e-mail or browser software.
- Moreover, while illustrative embodiments of the invention have been described herein, the scope of the invention includes any and all embodiments having equivalent elements, modifications, omissions, combinations (e.g., of aspects across various embodiments), adaptations and/or alterations as would be appreciated by those in the art based on the present disclosure. The limitations in the claims are to be interpreted broadly based on the language employed in the claims and not limited to examples described in the present specification or during the prosecution of the application, which examples are to be construed as non-exclusive. Further, the blocks of the disclosed routines may be modified in any manner, including by reordering blocks and/or inserting or deleting blocks, without departing from the principles of the invention. It is intended, therefore, that the specification and examples be considered as exemplary only, with a true scope and spirit of the invention being indicated by the following claims and their full scope of equivalents.
Claims (20)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/795,922 US20180048634A1 (en) | 2007-05-03 | 2017-10-27 | Authentication using a Transaction History |
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US11/797,455 US8732089B1 (en) | 2007-05-03 | 2007-05-03 | Authentication using a transaction history |
US14/280,708 US9819662B1 (en) | 2007-05-03 | 2014-05-19 | Authentication using a transaction history |
US15/795,922 US20180048634A1 (en) | 2007-05-03 | 2017-10-27 | Authentication using a Transaction History |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/280,708 Continuation US9819662B1 (en) | 2007-05-03 | 2014-05-19 | Authentication using a transaction history |
Publications (1)
Publication Number | Publication Date |
---|---|
US20180048634A1 true US20180048634A1 (en) | 2018-02-15 |
Family
ID=50692347
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/797,455 Active 2032-03-06 US8732089B1 (en) | 2007-05-03 | 2007-05-03 | Authentication using a transaction history |
US14/280,708 Active 2029-06-12 US9819662B1 (en) | 2007-05-03 | 2014-05-19 | Authentication using a transaction history |
US15/795,922 Abandoned US20180048634A1 (en) | 2007-05-03 | 2017-10-27 | Authentication using a Transaction History |
Family Applications Before (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/797,455 Active 2032-03-06 US8732089B1 (en) | 2007-05-03 | 2007-05-03 | Authentication using a transaction history |
US14/280,708 Active 2029-06-12 US9819662B1 (en) | 2007-05-03 | 2014-05-19 | Authentication using a transaction history |
Country Status (1)
Country | Link |
---|---|
US (3) | US8732089B1 (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20200110866A1 (en) * | 2018-10-03 | 2020-04-09 | International Business Machines Corporation | User authentication employing user activity based inquiries |
US20200356653A1 (en) * | 2017-09-05 | 2020-11-12 | Samsung Electronics Co., Ltd. | Video display device and operating method therefor |
Families Citing this family (44)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP2460307B1 (en) * | 2009-07-31 | 2019-12-11 | Anakam, Inc. | System and method for strong remote identity proofing |
US20110035317A1 (en) * | 2009-08-07 | 2011-02-10 | Mark Carlson | Seedless anti phishing authentication using transaction history |
US8959621B2 (en) * | 2009-12-22 | 2015-02-17 | Disney Enterprises, Inc. | Human verification by contextually iconic visual public turing test |
US8793760B2 (en) * | 2011-03-31 | 2014-07-29 | Ebay Inc. | Authenticating online users with distorted challenges based on transaction histories |
US9298918B2 (en) | 2011-11-30 | 2016-03-29 | Elwha Llc | Taint injection and tracking |
US9015860B2 (en) | 2011-09-24 | 2015-04-21 | Elwha Llc | Behavioral fingerprinting via derived personal relation |
US9729549B2 (en) | 2011-09-24 | 2017-08-08 | Elwha Llc | Behavioral fingerprinting with adaptive development |
US9298900B2 (en) | 2011-09-24 | 2016-03-29 | Elwha Llc | Behavioral fingerprinting via inferred personal relation |
US9083687B2 (en) | 2011-09-24 | 2015-07-14 | Elwha Llc | Multi-device behavioral fingerprinting |
US9348985B2 (en) | 2011-11-23 | 2016-05-24 | Elwha Llc | Behavioral fingerprint controlled automatic task determination |
US9825967B2 (en) | 2011-09-24 | 2017-11-21 | Elwha Llc | Behavioral fingerprinting via social networking interaction |
US20130197968A1 (en) * | 2011-09-24 | 2013-08-01 | Elwha LLC, a limited liability corporation of the State of Delaware | Behavioral fingerprinting with retail monitoring |
US9621404B2 (en) | 2011-09-24 | 2017-04-11 | Elwha Llc | Behavioral fingerprinting with social networking |
US8781906B2 (en) | 2012-02-06 | 2014-07-15 | Walter Cruttenden | Systems and methods for managing consumer transaction-based investments |
US10937097B1 (en) | 2012-02-06 | 2021-03-02 | Acorns Grow Incorporated | Systems and methods for creating excess funds from retail transactions and apportioning those funds into investments |
US20130263230A1 (en) * | 2012-03-30 | 2013-10-03 | Anchorfree Inc. | Method and system for statistical access control with data aggregation |
US20140025537A1 (en) * | 2012-07-23 | 2014-01-23 | Cellco Partnership D/B/A Verizon Wireless | Verifying accessory compatibility with a mobile device |
EP2920756A4 (en) * | 2012-11-15 | 2016-07-27 | Google Inc | Know your customer (kyc) |
US9424616B2 (en) | 2013-03-11 | 2016-08-23 | Google Inc. | Customer identity verification |
USD928190S1 (en) | 2013-03-14 | 2021-08-17 | Acorns Grow Incorporated | Mobile device screen or portion thereof with an animated graphical user interface |
USD927508S1 (en) | 2013-03-14 | 2021-08-10 | Acorns Grow Incorporated | Mobile device screen or portion thereof with graphical user interface |
USD969818S1 (en) | 2013-03-14 | 2022-11-15 | Acorns Grow Inc. | Mobile device screen with graphical user interface |
US11176614B1 (en) | 2013-03-14 | 2021-11-16 | Acorns Grow Incorporated | Systems and methods for creating excess funds from retail transactions and apportioning those funds into investments |
USD972577S1 (en) | 2013-03-14 | 2022-12-13 | Acorns Grow Inc. | Mobile device screen with a graphical user interface |
KR102255458B1 (en) | 2013-07-15 | 2021-05-25 | 비자 인터네셔널 서비스 어소시에이션 | Secure remote payment transaction processing |
US9646303B2 (en) | 2013-08-15 | 2017-05-09 | Visa International Service Association | Secure remote payment transaction processing using a secure element |
CN115358746A (en) | 2013-09-20 | 2022-11-18 | 维萨国际服务协会 | Secure remote payment transaction processing including consumer authentication |
US9928358B2 (en) * | 2013-12-09 | 2018-03-27 | Mastercard International Incorporated | Methods and systems for using transaction data to authenticate a user of a computing device |
US9424410B2 (en) * | 2013-12-09 | 2016-08-23 | Mastercard International Incorporated | Methods and systems for leveraging transaction data to dynamically authenticate a user |
US20150332353A1 (en) * | 2014-05-14 | 2015-11-19 | Mastercard International Incorporated | Methods and Systems of Authenticating Reviews |
US9497312B1 (en) | 2015-02-17 | 2016-11-15 | Amazon Technologies, Inc. | Dynamic unlock mechanisms for mobile devices |
USD792890S1 (en) | 2015-05-22 | 2017-07-25 | Acorns Grow Incorporated | Display screen or portion therof with a financial data graphical user interface |
US20170228698A1 (en) * | 2016-02-10 | 2017-08-10 | Mastercard International Incorporated | System and method for benefit distribution with improved proof-of-life features |
US11017687B2 (en) * | 2017-01-31 | 2021-05-25 | Ent. Services Development Corporation Lp | Information technology user behavior monitoring rule generation |
WO2019118249A1 (en) * | 2017-12-13 | 2019-06-20 | Acorns Grow Inc. | Method and system for efficient switching of direct deposit payment destination account |
US10812460B2 (en) | 2018-01-02 | 2020-10-20 | Bank Of America Corporation | Validation system utilizing dynamic authentication |
US11693943B2 (en) * | 2018-07-06 | 2023-07-04 | International Business Machines Corporation | Authenticating a user via a customized image-based challenge |
USD928799S1 (en) | 2018-07-19 | 2021-08-24 | Acorns Grow Incorporated | Mobile device screen or portion thereof with graphical user interface |
US11567655B2 (en) | 2019-02-21 | 2023-01-31 | Acorns Grow Incorporated | Secure signature creation on a secondary device |
US11354679B1 (en) * | 2019-05-31 | 2022-06-07 | Inmar Clearing, Inc. | Account validation system and related methods |
USD927521S1 (en) | 2019-12-09 | 2021-08-10 | Acorns Grow Incorporated | Mobile device screen or portion thereof with a graphical user interface |
US11611589B2 (en) | 2020-06-05 | 2023-03-21 | Seagate Technology Llc | Data storage system with powered move attack protection |
US20220150078A1 (en) * | 2020-11-12 | 2022-05-12 | At&T Intellectual Property I, L.P. | Session verification via media content challenge queries |
US11810112B2 (en) | 2021-04-16 | 2023-11-07 | Capital One Services, Llc | Method for determining the likelihood for someone to remember a particular transaction |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20040093527A1 (en) * | 2002-11-12 | 2004-05-13 | Pering Trevor A. | Method of authentication using familiar photographs |
US7594189B1 (en) * | 2005-04-21 | 2009-09-22 | Amazon Technologies, Inc. | Systems and methods for statistically selecting content items to be used in a dynamically-generated display |
Family Cites Families (16)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8046270B2 (en) * | 2000-05-19 | 2011-10-25 | Eastman Kodak Company | System and method for providing image products and/or services |
US6934860B1 (en) * | 2000-05-08 | 2005-08-23 | Xerox Corporation | System, method and article of manufacture for knowledge-based password protection of computers and other systems |
US7739162B1 (en) * | 2001-05-04 | 2010-06-15 | West Corporation | System, method, and business method for setting micropayment transaction to a pre-paid instrument |
US20030018543A1 (en) * | 2001-06-25 | 2003-01-23 | Alger Jeffrey H. | Client portal |
EP1463976A4 (en) * | 2001-12-13 | 2010-07-07 | Disney Entpr Inc | Image capture system |
WO2003061272A1 (en) * | 2002-01-11 | 2003-07-24 | Genterprise Development Group, Inc. | Systems and methods for producing portraits |
US7143095B2 (en) * | 2002-12-31 | 2006-11-28 | American Express Travel Related Services Company, Inc. | Method and system for implementing and managing an enterprise identity management for distributed security |
US7487226B2 (en) * | 2003-07-31 | 2009-02-03 | Hewlett-Packard Development Company, L.P. | System and method for transferring digital content on a memory card |
US20050080683A1 (en) * | 2003-10-09 | 2005-04-14 | International Business Machines Corporation | Administering a virtual shopping list for a user |
US8527752B2 (en) * | 2004-06-16 | 2013-09-03 | Dormarke Assets Limited Liability | Graduated authentication in an identity management system |
US7853564B2 (en) * | 2004-09-17 | 2010-12-14 | Adobe Systems Incorporated | Adding metadata to a stock content item |
US7396281B2 (en) * | 2005-06-24 | 2008-07-08 | Disney Enterprises, Inc. | Participant interaction with entertainment in real and virtual environments |
US8443197B2 (en) * | 2005-09-30 | 2013-05-14 | The Invention Science Fund I, Llc | Voice-capable system and method for authentication using prior entity user interaction |
US8424061B2 (en) * | 2006-09-12 | 2013-04-16 | International Business Machines Corporation | Method, system and program product for authenticating a user seeking to perform an electronic service request |
US20080174676A1 (en) * | 2007-01-24 | 2008-07-24 | Squilla John R | Producing enhanced photographic products from images captured at known events |
US20080209223A1 (en) * | 2007-02-27 | 2008-08-28 | Ebay Inc. | Transactional visual challenge image for user verification |
-
2007
- 2007-05-03 US US11/797,455 patent/US8732089B1/en active Active
-
2014
- 2014-05-19 US US14/280,708 patent/US9819662B1/en active Active
-
2017
- 2017-10-27 US US15/795,922 patent/US20180048634A1/en not_active Abandoned
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20040093527A1 (en) * | 2002-11-12 | 2004-05-13 | Pering Trevor A. | Method of authentication using familiar photographs |
US7174462B2 (en) * | 2002-11-12 | 2007-02-06 | Intel Corporation | Method of authentication using familiar photographs |
US7594189B1 (en) * | 2005-04-21 | 2009-09-22 | Amazon Technologies, Inc. | Systems and methods for statistically selecting content items to be used in a dynamically-generated display |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20200356653A1 (en) * | 2017-09-05 | 2020-11-12 | Samsung Electronics Co., Ltd. | Video display device and operating method therefor |
US11514150B2 (en) * | 2017-09-05 | 2022-11-29 | Samsung Electronics Co., Ltd. | Video display device and operating method therefor |
US20200110866A1 (en) * | 2018-10-03 | 2020-04-09 | International Business Machines Corporation | User authentication employing user activity based inquiries |
US10810300B2 (en) * | 2018-10-03 | 2020-10-20 | International Business Machines Corporation | User authentication employing user activity based inquiries |
Also Published As
Publication number | Publication date |
---|---|
US8732089B1 (en) | 2014-05-20 |
US9819662B1 (en) | 2017-11-14 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20180048634A1 (en) | Authentication using a Transaction History | |
US11770474B1 (en) | Systems and methods for authenticating a caller | |
US20200186530A1 (en) | Authentication System and Method | |
US11228599B2 (en) | Verification of credential reset | |
US9898740B2 (en) | Online challenge-response | |
US9491155B1 (en) | Account generation based on external credentials | |
US11496452B2 (en) | Non-repeatable challenge-response authentication | |
US11770706B1 (en) | Methods and systems for transferring call context | |
US20170201518A1 (en) | Method and system for real-time authentication of user access to a resource | |
US8695071B2 (en) | Authentication method | |
EP2783319A1 (en) | Providing verification of user identification information | |
US11551215B2 (en) | Fraud deterrence for secure transactions | |
US11762942B1 (en) | Systems and methods for online identity management | |
US20130103544A1 (en) | Authentication system | |
AU2015268635B2 (en) | Online challenge-response |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: AMAZON TECHNOLOGIES, INC., WASHINGTON Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:FANG, PETER C.;LEHMANN, SEBASTIAN;REEL/FRAME:044499/0323 Effective date: 20070502 |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: FINAL REJECTION MAILED |
|
STCV | Information on status: appeal procedure |
Free format text: NOTICE OF APPEAL FILED |
|
STCV | Information on status: appeal procedure |
Free format text: EXAMINER'S ANSWER TO APPEAL BRIEF MAILED |
|
STCV | Information on status: appeal procedure |
Free format text: ON APPEAL -- AWAITING DECISION BY THE BOARD OF APPEALS |
|
STCV | Information on status: appeal procedure |
Free format text: BOARD OF APPEALS DECISION RENDERED |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- AFTER EXAMINER'S ANSWER OR BOARD OF APPEALS DECISION |