Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
2000-06-16
2002-12-17
Hua, Ly V. (Department: 2131)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C713S152000, C380S030000
Reexamination Certificate
active
06496936
ABSTRACT:
FIELD OF THE INVENTION
The invention relates to electronic communications, and more particularly to authenticating the identity of network users.
BACKGROUND OF THE INVENTION
A variety of networks are used today. Computer networks include local area networks (LANs), metropolitan area networks (MANs), wide area networks (WANs), intranets, the Internet and other types of networks. Communication networks include those for conventional telephone service, cellular networks of different varieties, paging services and others. Networks are used for many purposes, including to communicate, to access data and to execute transactions. For many reasons, including security, it is often necessary to confirm or authenticate the identity of a user before permitting access to data or a transaction to occur on the network.
One known approach to computer network authentication is the use of user-specific passwords. Passwords provide some level of protection, but they are not fail-safe. One reason passwords are vulnerable is that users often share them. Even if they are kept private, someone who wants to obtain a password badly enough often can, using random generators, keyboard monitors or other techniques. Moreover, when dealing with unknown users such as people who want to conduct an electronic transaction over the Internet, ad hoc passwords are not practical.
Various non-password schemes exist that perform some level of authentication before authorizing transactions or permitting access to data. These systems generally require a user to provide a sampling of basic identification information such as name, date of birth, social security number, address, telephone number and driver's license information. This sort of information, sometimes known as wallet-type information, is compared to known data such as a credit file to determine how well the user's input matches that source.
For various reasons, one-level authentication schemes are not totally reliable. In some instances, a user who provides accurate identification information may not be authenticated. This may occur, for example, because the user enters a nickname or a contraction rather than a proper name, and the authentication process does not check for a nickname or other variation. As a result, a user who should be entitled to access information or perform a transaction can not. Other inconsistencies may trigger a false negative, and often the false negative will terminate the transaction without further processing or corrective querying.
In other instances, a user who supplies fraudulent information may be authenticated. This may occur when lost or stolen wallet-type information is entered by an unauthorized user. Other situations may also lead to a false positive result. Both false positives and false negatives are undesirable.
Other reasons for unwarranted summary rejection, and other drawbacks, exist.
SUMMARY OF THE INVENTION
An object of the invention is to overcome these and other drawbacks of existing authentication systems and methods.
Another object of the invention is to provide an authentication system and method that perform a first level of authentication based on a first type of information and, based on the results of the first level of authentication, determine whether to perform at least a second level of authentication using another type of information.
Another object of the invention is to provide an authentication system and method that determine whether to perform at least a second level of authentication depending on available information and the level of certainty desired.
Another object of the invention is to provide an authentication system and method including an automatic interactive query feature.
Another object of the invention is to provide an authentication system and method which preprocess information supplied by the user to check, for example, the standardization, format, validity and internal consistency of that information before comparing it to known data.
Another object of the invention is to provide an authentication system and method which are customizable.
Another object of the invention is to provide an authentication system and method that access information from a variety of data sources.
Another object of the invention is to provide an authentication system and method that allow selection of data sources used for comparison, and the circumstances under which those comparisons are made.
Another object of the invention is to provide an authentication system and method that generate a score indicating the confidence or certainty level of authentication.
Another object of the invention is to provide an authentication system and method in which a minimum score or requirement may be set for particular data fields or sources.
In an illustrative embodiment of the invention, a user who wishes to apply for an online transaction accesses a client/server network through a client terminal. The server side of the network includes an application server communicating with an authentication server. When the user wishes to initiate the transaction or at other times, the authentication server determines whether the user's identity can be confirmed, and the level of authentication that may be accorded to the user's identity based on rules specific to the vendor accepting the transaction.
The transaction the user is applying for, such as an electronic brokerage trade, is either carried out or not carried out or other action taken depending on the results of the authentication. The extent of authentication processing performed depends upon the nature of the transaction and vendor-specific requirements. Once the authentication process has been satisfied, the invention may generate a digital certificate recording authentication levels and other information related to the user. The digital certificate can then be presented in future transactions to avoid the need to reauthenticate the user for each new transaction event.
For example, in the context of electronic commerce, lower risk transactions such as relatively small purchases may not require an extensive authentication process. On the other hand, more sensitive or greater risk transactions such as large purchases or sensitive data access may require a more thorough authentication process and a greater level of certainty. A greater level of security could conceivably be attained by automatically performing a thorough authentication process for every transaction. However, this approach incurs unnecessary costs or resources in cases where only a lower level of certainty is needed.
The invention avoids this drawback by enabling different levels of authentication to be performed based on the level of security desired, reducing costs and unnecessary use of system resources.
Generally in the invention, the user is authenticated according to their ability to respond to successive queries for personal information and the level of match attained from comparing the information they provide with reliable data sources. The user is initially requested to provide a first type of identification information. The first type of information is preferably wallet-type information, that is, information such as name, address, driver's license or other information that may be commonly carried on the person. This information is transmitted to the authentication server which carries out a first level authentication process on that information.
That first level authentication process compares the degree of match between the user-supplied first type of information and known data about the user from other sources. At the completion of this first level authentication process, the authentication server may allow the requested access, allow the requested access with restriction, refuse access or proceed to another level of authentication.
Preferably, the second and any additional levels of authentication request a second, non-wallet type of information from the user. The second type of information is preferably based on comparatively private information that only the us
French Jennifer
Wilder Jone
Equifax Inc.
Hua Ly V.
Kilpatrick & Stockton LLP
LandOfFree
System and method for authentication of network users does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with System and method for authentication of network users, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and System and method for authentication of network users will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2924044