US008281129B1
`
`(12) United States Patent
`Asghari-Kamrani et al.
`
`(10) Patent No.:
`(45) Date of Patent:
`
`US 8,281,129 B1
`*Oct. 2, 2012
`
`égggg §"1‘::“Se”‘i~ ~~~~~~~~~~~~~~~ ~~ 7%/51/gfi
`0
`son . . . . . .
`. . . ..
`3/2003 Kocher
`..... H
`380/252
`t
`3/2004 Ch
`1.
`..... .. 726/8
`6/2004 Le?...... H
`. 705/66
`1/2005 Scheidtetal.
`..... .. 726/5
`6/2006 Taguchi
`. . . . . .
`. . . .. 726/18
`8/2006 Chen et al.
`.................... .. 705/74
`
`
`
`gagggagis) E1:
`,
`,
`6,539,092 B1 *
`6,715,082 B1*
`6,748,367 B1 =2,
`6,845,453 132*
`7,065,786 B2 *
`7,096,204 B1*
`
`(54) DIRECT AUTHENTICATION SYSTEM AND
`METHOD VIA TRUSTED AUTHENTICATORS
`,
`,
`.
`Inventors: Nader Asgharl-Kamranl, Centrev1lle,
`VA (US); Kamran Asghari-Kamrani,
`Centreville, VA (US)
`
`(76)
`
`( * ) Notice:
`
`Subject to any disclaimer, the term of this
`patent is extended or adjusted under 35
`U.S.C. 154(b) by 548 days.
`
`(Continued)
`
`OTHER PUBLICATIONS
`
`This patent is subject to a terminal dis-
`claimer,
`
`Lopucki, “Human Identification Theory and the Identity Theft Prob-
`lem,” Texas Law Review, vol. 80, pp. 89-134 (2001).
`
`(21) Appl. No.2 11/333,400
`
`(C°mi““ed)
`
`(22)
`
`Filed:
`
`Jan. 18, 2006
`Related US, Application Data
`(63) Continuation-in-part of application No. 09/940,635,
`filed OI1
`29,
`HOW Pat. NO.
`
`§”"f'“’y ij‘“’""'?” ‘ iitbfifi i:i*‘“?\‘I1= 1:-h
`sszslanl xammer —
`u a m o
`(74) Attorney, Agent, 0}’ Firm 7 Michael P. FOITKOIT, ESq.;
`M' h l P F
`k
`PC
`TC ae
`on on
`
`ar
`
`Fraud and identity theft are enabled by two faulty assump-
`tions about the way that the identity of a person is verified in
`our society. The first is that someone who demonstrates
`knowledge of certain items of personal or financial informa-
`tion about a particular person is presumed to be that person.
`The second assumption, which gives rise to the first assump-
`tion, is that these items ofinformation can be kept confiden-
`tial. Because fraudsters and identity thieves often seek to use
`their victim’s personal and financial information, this inven-
`tion proposes a direct authentication system and method that
`does not depend on these assumptions. The proposed method
`enables businesses to determine whether the customer is truly
`the person who he says he is by adopting a new “two-factor”
`tht't'thn'
`dtht't'
`t
`"d-
`filtly §3fiZ?n?§‘$u§fom§§3§ 331,1? aZ‘ifi§§£3§,§§S.§‘$135,563,
`trusted authenticator can be found within the financial ser-
`
`vices community‘ in particular a bank or other financial
`~
`ft t~
`~th
`1;
`th
`t
`3
`h
`t
`t d
`1
`t~
`h~
`1ns1u1onw1 w om ecus omer asa rus e re a 10115 1p,
`Such as aba11i<a°°011m~
`
`52 Claims, 4 Drawing Sheets
`
`(60)
`
`PI0Visi0iiai aPPiieaii0i1 N0- 60/650,137, flied 011 Feil
`7: 2005-
`
`(51)
`
`Int‘ Cl‘
`(200601)
`H041’ 29/06
`(200601)
`G06Q 20/00
`(52) U-S- Ci-
`~~~~~~~~~~~ -~ 713/163; 705/74; 705/78, 7i3/i84
`(58) Fieid OT Classification Seareil ---------------- -- 713/155,
`7i3/I56, i82'i85; 725/4, 5, 2, 8, I8, 27,
`725/28; 705/39, 54, 74, 77, 78, 57, 72, 75
`S66 application file for Complete Search history.
`
`(56)
`
`Reieieiiees Cited
`Us. PATENT DOCUMENTS
`4,885,778 A * 12/1989 Weiss .......................... .. 713/184
`
`713/155
`7/1996 Gaiiesan
`, 713/155
`3/1998 AZiZ ,,,,,,,,,,, ~
`705/39
`3/1999 Franklin et al.
`. 713/172
`5/2000 Yu etal.
`...... ..
`705/35
`5/2001 Lewis et al.
`5/2001 Hill
`............................... .. 705/67
`
`
`
`5535s276 A T
`5,732,137 A *
`5,883,810 A ,,
`6,067,621 A *
`6,233,565 B1*
`6,236,981 B1 *
`
`10
`
`1-2 vi
`
`20
`
`80
`Individual 3
`(fans tolace§action)
`
`Individual 1
`Buslnen 1
`
`50
`/50
`
`
`
`so\
`
`Communlcnflon Natwurk
`
`
`
`
`
`
`
`
`KAMRANI 2004
`
`
`
`Trusted-Amhonticntor 'F'
`Truatnd-Aulhomicabor 1
`
`
`
`
`
`
`
`
`
`
`30
`
`40
`
`
`
`Trusted-Ainhemlcator 'n'
`Trusted-Aulhenllcntur 2
`
`1/15
`
`KAMRANI 2004
`
`

`
`US 8,281,129 B1
`Page 2
`
`7/2002 Harif ............................. .. 705/76
`2002/0087483 A1*
`>
`'
`=x<
`"
`" Zgggg
`ggggg 81i‘:§;’:tt‘:1‘f’
`gggggiggjfg :1 ,,
`
`"
`" 705/39
`2002/0184143 A1* 12/2002 Khmer
`'
`2004/0030752 A1,,
`2/2004 Selgas egél""""""""""" "709/206
`-
`-
`' """""""" "
`*
`Kahskl’ Jr’
`' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' ' "
`OTHER PUBLICATIONS
`_
`_
`_
`_
`Solove, “Identity Theft, Privacy, and the Architechture 0fVu1nerab11-
`ity,” Hastings Law Journal, Vol. 54 No.4, p. 1251 (2003).
`
`* cited by examiner
`
`2/15
`
`KAMRANI 2004
`
`U.S. PATENT DOCUMENTS
`
`....................... .. 713/186
`9/2006 Scheidt
`B1*
`Bl * 12/2006 Samar ........ ..
`726/8
`B1*
`1/2007 Jespersen et al.
`.. 726/27
`B1*
`6/2007 Ogg et al.
`.. 705/50
`B2 *
`Weiss . . .
`. . N
`Bl *
`1/2008 Oliver et al.
`.. 705/40
`B1 *
`2/2008 Antebi et al.
`235/492
`A1*
`4/2002 Kwan ........ ..
`.. 705/51
`A1 *
`4/2002 Vargas et 31,
`H 70 5/57
`A1*
`4/2002 Morita et al.
`.. 705/67
`Al *
`6/2002 Fox et al.
`.. 705/52
`A1*
`6/2002 Taguchi
`...................... .. 713/202
`
`
`
`.
`
`7,111,173
`7,150,038
`7,171,694
`7,236,956
`7,237,117
`7,324,972
`7,334,735
`2002/0040346
`2002/0046187
`2002/0046189
`2002/0069174
`2002/0083347
`
`2/15
`
`KAMRANI 2004
`
`

`
`U.S. Patent
`
`Oct. 2, 2012
`
`Sheet 1 of4
`
`US 8,281,129 B1
`
`1-1 »j
`
`10
`
`20
`
`-
`
`
`-
`
`.
`
`Individual 3
`
`
`
`80
`
`(face to face interactig >
`
`
`
`
`Individual 2
`
`
`
`
`
`Individual
`
`1
`
`Communication
`Network
`
`50
`
`Trusted-Authenticator 1
`
`
`
`
`
`Trusted-Authenticator 2
`
`Trusted-Authenticator 'n'
`
`
`
`
`
`30
`
`Figure 1a
`
`3/15
`
`KAMRANI 2004
`
`3/15
`
`KAMRANI 2004
`
`

`
`U.S. Patent
`
`Oct. 2, 2012
`
`Sheet 2 of4
`
`US 8,281,129 B1
`
`1-2 4——l
`
`10
`
`Individual
`
`'n'
`
`
`
`
`
`
`
`20
`
`
`
`80
`
`
`
`
`
`'"dW"a'
`
`‘.
`
`
`
`50,
`
`1 1
`\ 50
`
`
`/50
`
`
`
`Communication Network
`
`Trusted-Authenticator 'F'
`
`Trusted-Authenticator 1
`
`
`
`
`
`30
`
`Figure 1b
`
`Trusted-Authenticator 'n'
`
` Trusted-Authenticator 2
`
`40
`
`4/15
`
`KAMRANI 2004
`
`4/15
`
`KAMRANI 2004
`
`

`
`U.S. Patent
`
`Oct. 2, 2012
`
`Sheet 3 014
`
`US 8,281,129 B1
`
`Communication
`Network
`
`Communlcailon Network or
`Iac lo face Interaction
`
`Business
`
`
`
`20
`
`Figure 2a
`
`5/15
`
`KAMRANI 2004
`
`5/15
`
`KAMRANI 2004
`
`

`
`U.S. Patent
`
`Oct. 2, 2012
`
`Sheet 4 of4
`
`US 8,281,129 B1
`
`
`Request dynamic key
`
`
`
`Business
`
`L
`Authe ication Message
`
`
`
`20
`
`Request I Receive Dynamic Key
`
`Authentication Steps:
`
`@ @
`
`Figure 2b
`
`6/15
`
`KAMRANI 2004
`
`
`
`4.
`!,
`JD
`3
`_,$:
`3~<‘°
`._.m§_n_
`;S:.'E>“"‘
`Cam
`mg
`0'36‘
`5.'mQ°
`can
`’:‘.:l‘<
`:00
`.20:
`...n:
`3.
`°
`
`9
`
`3
`°
`S.
`3
`m
`0)
`5
`_—_~,
`°
`9°
`9
`:1
`“’
`3
`5-
`
`‘ rusted-Authenticat o
`
`O
`3
`
`3'
`3/
`6
`3
`\
`C
`g
`6‘
`_
`3
`0,
`3
`M
`‘O
`“’
`
`>
`C
`3
`m
`E».
`8
`=‘-
`0
`3
`E
`3
`3
`
`6/15
`
`KAMRANI 2004
`
`

`
`US 8,281,129 B1
`
`1
`DIRECT AUTHENTICATION SYSTEM AND
`METHOD VIA TRUSTED AUTHENTICATORS
`
`This application is a continuation-in-part of U.S. patent
`application Ser. No. 09/940,635 filedAug. 29, 2001, now U.S.
`Pat. No. 7,356,837 and claims priority to U.S. Provisional
`Application No. 60/650,137 filed Feb. 7, 2005.
`
`BACKGROUND OF THE INVENTION
`
`1. Field of the Invention
`
`The present invention generally relates to a direct authen-
`tication system and method, more particularly, to a new two-
`factor authentication method used by a business to authenti-
`cate its customers’ identity utilizing trusted-authenticators.
`2. Description of the Related Art
`Fraud and Identity theft, the taking of a person’s identity
`for the purpose of committing a criminal act, is a growing
`national concern, both in terms of its affect on its victims, and
`its potential national security implications. Checking account
`fraud costs US banks USD 698 million in 2002, according to
`the American Bankers’ Association, while those perpetrating
`the fraud attempted to take USD 4.3 billion in total. Identity
`theft costs financial institutions USD 47.6 billion in 2002-
`
`2003 . A report issued in September 2003 by the Federal Trade
`Commission estimates that almost 10 million Americans
`
`were victims of some type ofidentity theft within the previous
`year. Especially urmerving are the numerous accounts of the
`ordeals that victims endure as they attempt to deal with the
`results of this crime. They are assumed to be responsible for
`the debts incurred by the thiefuntil they can demonstrate that
`they have been victims of fraud. They are targeted by collec-
`tion agencies trying to collect on debts generated by thieves
`who open new accounts in their name. They have to deal with
`damaging information placed in their credit files as a result of
`the imposter’s actions. It’s well known how this can happen.
`Fraudulent charges may be posted to someone’s checking
`account if the thief knows the account number and banks
`
`routing number. Identity thieves can “take over” an existing
`account and withdraw money, as well as change other account
`information such as mailing address, if the thief knows a few
`pieces of sensitive personal
`information, especially the
`account holder’s Social Security Number (SSN). Perhaps
`worst of all, a thief can easily open a new account in someone
`else’s name by completing an application for a new credit
`account, using the victim’s name and SSN, but with a differ-
`ent address. The credit grantor, whether it be a retailer offer-
`ing instant credit accounts via their website, a telecommuni-
`cations company offering a new cell phone account, a bank
`offering a credit card, or an auto dealership offering a new car
`loan, uses the information provided by the thief to obtain a
`credit report on the person named in the account application.
`Ifthe report indicates that the person named in the application
`is a good credit risk, a new account will likely be opened in the
`victim’s name. But the victim never knows about the late and
`
`unpaid bills, until his credit is ruined.
`Online Fraud happens because online businesses such as
`retailers assume that the person shopping online is the same
`person whose personal or financial information are given.
`Identity theft happens because creditors assume that the per-
`son filling the application is the sarne person whose name and
`personal information are used in the application, unless there
`is clear evidence to the contrary. A business “authenticates” a
`customer by matching personal and financial information
`provided, such as name, SSN, birth date, etc., with informa-
`tion contained in third party databases (indirect authentica-
`tion). Ifthere is a match on at least a few items ofinformation,
`
`10
`
`15
`
`20
`
`25
`
`30
`
`35
`
`40
`
`45
`
`50
`
`55
`
`60
`
`65
`
`2
`
`it is assumed that the person is the same person who he says
`he is. This assumption itself is a direct result of a belief that
`sensitive personal and financial
`information can be kept
`secret and out of the hands of thieves. Yet the widespread
`incidence of fraud and identity theft, as detailed by the per-
`sonal stories of its many victims, clearly demonstrates that
`this notion is false. A recent paper by Prof. Daniel Solove
`(“Identity Theft, Privacy, and the Architecture of Vulnerabil-
`ity”, Hastings Law Journal, Vol 54, No. 4 (2003), page 1251)
`of the Seton Hall Law School aptly points out that “The
`identity thief’ s ability to so easily access and use our personal
`and financial data stems from an architecture that does not
`
`provide adequate security to our personal and financial infor-
`mation and that does not afford us with a sufiicient degree of
`participation in the collection, dissemination, and use of that
`information.” He further goes on to say “The problem, how-
`ever, runs deeper than the public disclosure of Social Security
`Numbers (SSN), personal and financial information. The
`problem stems not only from the government’s creation of a
`de facto identifier and lax protection of it, but also from the
`private sector’s inadequate security measures in handling
`personal information”. “Further, identity thieves can obtain
`personal and financial information simply by paying a small
`fee to various database companies and obtaining a detailed
`dossier about their victims.” There’s only a certain amount
`that an individual can do to prevent sensitive information
`from getting into the wrong hands, such as keeping a tight grip
`on one’s purse or wallet. Beyond that, the information is
`easily available to a thief in numerous other ways. It may be
`available through certain public records. It can be purchased
`from publicly available databases for a nominal fee. It can be
`copied from medical claims forms lying around in a doctor’s
`ofiice. Other methods include breaking into various commer-
`cial databases containing sensitive information about busi-
`ness’s customers, many times with the help of an insider. As
`long as the authentication of new credit applications is based
`upon knowledge of a few items of personal information that
`are supposed to be confidential, the only way to truly prevent
`this type ofidentity theft is to keep one’ s personal information
`out of the hands of thieves, an impossible task. This is also
`true in the case of identity theft involving account takeovers,
`in which the thief uses knowledge of personal information
`about the victim to obtain information needed to take over
`
`someone’s existing account.
`There have been many attempts to solve above issues and
`concerns. One being the recent paper by Prof. Lynn LoPucki
`of
`the UCLA School of Law (www.ssm.con1/ab-
`stract:263213). The paper addresses many ofthese concerns,
`and suggests an approach to the identity theft problem that
`addresses the fundamental
`flaws
`in the process. This
`approach does not depend on keeping personal information
`secret, asking out-of-wallet questions, or computing fraud
`scores based on historical data and analytical fraud models.
`LoPucki’s approach, which he calls the Public Identity Sys-
`tem (PIDS), would establish a voluntary list of people con-
`cerned about identity theft, and who consent to be directly
`contacted for verification when someone applies for credit in
`their name. The list would be maintained by a government
`agency. An individual would voluntarily provide his/her per-
`sonal information to the list, including name, SSN, and per-
`haps other identifying information. A thorough authentica-
`tion process would ensure that new members of the list are
`truly the persons they claim to be. A personal appearance
`before the government agency that maintains the list would be
`required. Individuals participating in PIDS would specify one
`or more standardized ways that a creditor should contact them
`when the creditor has received a new account application in
`
`7/15
`
`KAMRANI 2004
`
`7/15
`
`KAMRANI 2004
`
`

`
`US 8,281,129 B1
`
`3
`their name. Contact methods would likely be limited to a
`phone call, e-mail (encrypted or unencrypted), or US Mail.
`When a creditor receives a new account application, the credi-
`tor would consult the list to determine if the person named in
`the application, as identified by a SSN or other information, is
`a PIDS participant. If the named person is not a participant,
`the new account application would be processed in the usual
`manner. If, however, the named person is a PIDS participant,
`the creditor would contact the individual directly using one or
`more of the contact methods specified in the instructions
`provided by the individual.
`A PIDS participant may even require, under some circum-
`stances, a personal appearance before the creditor by anyone
`applying for a new account in his or her name. The reason for
`contacting the participant would be to verify that the partici-
`pant is truly the person who submitted the new account appli-
`cation. To significantly reduce identity theft using this
`approach, creditors would need to have an incentive to con-
`sult the list and follow the instructions given, and consumers
`would need to participate in PIDS in large numbers.
`Although Prof. LoPucki’s approach addresses the funda-
`mental flaws in the credit granting process responsible for
`identity theft, it is time consuming for creditors to verify
`customer’ s identity. Also, some difiiculties may arise with its
`implementation. The list of PIDS participants, together with
`their Social Security Numbers and contact
`information,
`would reside on a government website, and the information
`would be available to the public. This would only be imple-
`mented ifthe laws were changed to prevent knowledge ofthis
`information alone as providing “proof” of identity, as well as
`preventing other types of privacy invasions that might be
`enabled with public access to such information. Although the
`legal changes would make one’s personal information much
`less useful to an identity thief, it is not clear how comfortable
`people would feel about an arrangement that allows their
`personal information to be made public in such an overt
`manner. In addition, PIDS participants would also need to
`personally appear before the government agency managing
`the list. These factors may inhibit many people from partici-
`pating in PIDS. Since creditors would be required to directly
`contact individuals named in an account application if the
`person’s name appears on the list, creditors may find this type
`of “direct authentication” process to be burdensome, espe-
`cially if it involves more than a simple phone call or email.
`This may lead creditors to oppose PIDS. In addition, there is
`the question of how the creditor should authenticate the per-
`son taking the call, or responding to the email. How can the
`creditor be sure that the person taking the call, or responding
`to the email, is truly the person who joined PIDS, and who
`now should be queried about the credit application? Finally,
`the implementation of PIDS would seem to require the estab-
`lishment of a new government bureaucracy to perform nec-
`essary functions such as establishing and maintaining the
`PIDS list, meeting with those individuals seeking to partici-
`pate, verifying their identity credentials, and establishing the
`standardized methods by which creditors will contact and
`interact with PIDS participants. Of course, implementing any
`alternative to PIDS would also require a certain amount of
`up-front work to develop the necessary capabilities and infra-
`structures. And while it is not unreasonable for a government
`agency (such as a state motor vehicles bureau) to undertake at
`least some of these tasks, it is not clear whether any federal or
`state agencies would be ready and willing to fulfill the entire
`role.
`
`Another possible solution has been suggested to modify
`Prof. LoPucki’s approach (PIDS procedure) somewhat to
`take advantage of the existing trust relationships that indi-
`
`10
`
`15
`
`20
`
`25
`
`30
`
`35
`
`40
`
`45
`
`50
`
`55
`
`60
`
`65
`
`4
`
`viduals have already established with various organizations
`that they deal with. Rather than requiring creditors to authen-
`ticate applicants for new accounts by contacting them
`directly, these interactions could instead be performed by a
`“trusted authenticator.” The trusted authenticator would be an
`
`entity that already knows the individual, maintains personal
`information about that
`individual, and has established a
`trusted relationship with that person. The advantage of using
`trusted authenticators is that the authentication process can be
`built on trust relationships and infrastructures already in
`place. A reasonable candidate for such a trusted authenticator
`would be a bank or other financial institution with whom the
`
`individual has already established an account. After all, if
`most people trust a bank to handle their money and keep it
`safe, trusting that same bank to authenticate their identities in
`other financial transactions should be natural. Prof. LoPuc-
`
`ki’s paper hints at such an arrangement in its discussion of
`how list members may choose to be contacted:
`The [e-mail] contact could be directly with the owner or
`through the owner’s trusted intermediary. Instead of creating
`a new government bureaucracy to implement PIDS, the exist-
`ing infrastructures and trust relationships within the financial
`services community could be enhanced to more efiiciently
`derive the same benefits that PIDS provides.
`In this modified authentication procedure, a list of all indi-
`viduals who choose to participate (the “participants”) would
`still be needed. The list would contain a name and SSN of
`
`each participant, together with the identity of their trusted
`authenticator. The list would be maintained by a new organi-
`zation created by the financial services community specifi-
`cally for this purpose, rather than by the government. How-
`ever, the information on the list would not be accessible by the
`general public, but only by creditors and other members ofthe
`financial services community acting as trusted authenticators.
`The modified authentication procedure works as follows:
`The creditor, upon receiving a new account application,
`checks the list to determine if the person named in the appli-
`cation is a participant. If so, the creditor queries the trusted
`authenticator designated on the list, and requests verification
`that the person named in the application is actually the person
`filing the new account application. If the person is not a
`participant, the creditor will process the application in the
`usual way.
`Upon receiving a request from a creditor for direct authen-
`tication of a participant, who is also one of its customers, the
`trusted authenticator contacts its customer via a secure email
`
`message or phone call, as specified by the customer.
`When communication is established, the trusted authenti-
`cator must first determine that it is actually communicating
`with its customer, and not someone else who has intercepted
`the email or phone call.
`An email would contain a link that takes the customer to an
`authentication screen on the trusted authenticator’s website.
`
`Here the customer would provide a password or Personal
`Identification Number (PIN) to authenticate himself/herself.
`The authentication process may also include an additional
`biometric factor such as a fingerprint or voiceprint. Most
`likely, the method of authentication used would be the same
`as the customer would use for online banking, which provides
`access to his/her banking accounts online.
`A phone call would contain, at least, a request for the
`customer to provide a PIN or some other secret. A more
`secure authentication process might include an additional
`biometric factor, such as a voiceprint. Again, the method of
`authentication may be the same as the customer may use to
`perform telephone banking, which provides access to his/her
`banking accounts over the phone. Once the trusted authenti-
`
`8/15
`
`KAMRANI 2004
`
`8/15
`
`KAMRANI 2004
`
`

`
`US 8,281,129 B1
`
`5
`cator has verified the identity of its customer, the trusted
`authenticator asks its customer whether he/she has filed a
`
`6
`vidual is who he/she claims he/she is, and will provide a
`real-time authentication solution that is suited for the con-
`
`specific application for credit, as indicated in the creditor’s
`request for authentication.
`If the customer responds affirrnatively, the trusted authen-
`ticator replies to the creditor that the application appears to be
`authentic. If the customer responds negatively,
`the bank
`responds to the creditor that the application appears to be
`fraudulent.
`
`The first problem with this solution is the fact that the
`trusted authenticator contacts its customer via an email mes-
`
`sage, which allows for phishing or brand spoofing. The cus-
`tomer could receive an email from a user falsely claiming to
`be the trusted authenticator in an attempt to scam the cus-
`tomer into surrendering private information that will be used
`for identity theft.
`The second problem is the fact that a list of all individuals
`who choose to participate would still be needed. This will add
`to privacy and security concerns.
`Another problem is the fact that this authentication method
`lacks the real-time authentication and therefore it is not suited
`for online transactions.
`
`There have been many attempts to solve the online identi-
`fication problems using tokens, smart cards or biometrics
`authentication methods, but these methods failed due to high
`cost and consumers’ dissatisfactions:
`
`Password Generation Tokens—creates custom passwords
`each time they are activated. The cost of each token makes
`this type of two-factor authentication method suited only for
`enterprise spaces and not to the consumer level outside of the
`enterprise. Another problem with this method is that the pass-
`words are generated using an algorithm that is based on both
`a unique user ID and the current time, which makes the next
`generated password guessable. Another drawback of this
`authentication method is that a consumer has to manage dif-
`ferent tokens for different relationships.
`Biometrics—measure unique bodily characteristics such
`as fingerprint as a form of identification. Again, the cost ofthe
`devices makes this type of two-factor authentication method
`suited only for enterprise spaces. For privacy and security
`reasons,
`it’s not suited to consumer level authentication
`where biometric images need to be stored and transmitted
`over a public network such as the Internet for authentication
`(opens to theft or interception).
`Smart Cards and—store information on a tiny computer
`chip on the card. This type of two-factor authentication
`method requires a reader device and therefore makes it suited
`only for enterprise spaces. There have been many attempts to
`implement this method to the consumer level, but each time it
`failed because consumers find it difficult to use (Hooking up
`smart card readers to computer systems), costly and software
`dependent.
`Smart Tokens—are technologically identical to the smart
`cards with the exception of their form factor and interface.
`Again, many attempts to implement this type of two-factor
`authentication method to the consumer level failed due to the
`
`same reasons: cost and consumer adoption (difficult to use
`and difiicult to manage).
`In view of the foregoing, a need exists for a new and
`improved direct authentication system and method via
`trusted-authenticators that validates customers’ identity with-
`out the deficiencies and disadvantages of the prior arts,
`mainly the cost and consumer adoption. This new direct
`authentication system and method via trusted-authenticators
`will reduce the identity theft, fraud and customer privacy
`concerns, will be secure, easy to use and manage, will be
`inexpensive, will offer a high level assurance that an indi-
`
`sumer level authentication where real -time identity validation
`of the consumer is necessary.
`
`SUMMARY OF THE INVENTION
`
`10
`
`15
`
`20
`
`25
`
`30
`
`35
`
`40
`
`Briefly described, the present invention relates to a direct
`authentication system and method via trusted-authenticators.
`In this invention, direct authentication of an individual
`would be achieved via a new two-factor authentication
`
`method used by businesses to authenticate customers’ iden-
`tity utilizing trusted-authenticators. A trusted-authenticator
`would be an entity that already knows the individual, main-
`tains information about that individual, and has established a
`trusted relationship with that individual. A reasonable candi-
`date for such a trusted-authenticator would be bank or other
`
`financial institution with whom the individual has already
`established a relationship. In this invention, the financial ser-
`vices community will have a leading role in implementing
`stronger forms of authentication for identity theft and fraud
`prevention.
`Experience shows that knowledge-based authentication,
`where individuals are recognized by demonstrating that they
`are in possession of information which only that individual
`would be expected to know, is an inexpensive, easy to use and
`easy to implement authentication method, where the authen-
`tication is between two entities such as a bar1ks’s customer
`and the bank. It relies on the secret information that is shared
`
`between these two entities. Therefore the underlying basis for
`this method is that only the real individual (bar1k’s customer)
`would know such identifying information. But, when it
`comes to direct authentication to the consumer level, where
`the individual needs to authenticate his/her identity to any
`other entities with whom the individual does not have an
`
`existing relationship, such knowledge-based authentication
`will not work. Therefore, it’s not secure to share the same
`secret information that the individual shares with one entity,
`with other entities for identification purposes. Such informa-
`tion is static and someone who happens to get access to such
`information could use it for authentication at other entities as
`
`well. Therefore, knowledge-based authentication is not
`secure for direct authentication of individuals.
`To eliminate the risks associated with the static nature of
`
`45
`
`the knowledge-based authentication, this invention suggests
`combining knowledge-based authentication with a dynamic
`key or information maintained by the trusted-authenticator to
`create a new two-factor authentication. This new two-factor
`
`authentication confirms individual identities using two differ-
`ent credentials:
`
`a) Something the individual knows—This factor is a static
`key or information that the individual shares with his/her
`trusted-authenticator.
`
`b) Something the individual receives—This factor refers to
`SecureCode which is a dynamic key or information that
`the individual requests and receives from his or her
`trusted-authenticator at
`the time of authentication
`
`through a communication network. It is important to
`note that the individual’s dynamic key is an alphanu-
`meric code and will have a different value each time the
`individual receives it from hi s/her trusted-authenticator
`
`for authentication purpose.
`The strength of this new method of authentication occurs
`when combining two factors. This achieves a high level of
`assurance that an individual is who he/she claims he/she is
`
`and enhances security and reduces privacy concerns.
`
`50
`
`55
`
`60
`
`65
`
`9/15
`
`KAMRANI 2004
`
`9/15
`
`KAMRANI 2004
`
`

`
`US 8,281,129 B1
`
`7
`The direct authentication of an individual works as fol-
`lows:
`
`is on a business’s site (offline or
`When an individual
`online), for successful direct authentication, the business
`requires the individual to provide his/her static and dynamic
`keys. The individual requests a dynamic key from his/her
`trusted-authenticator (using any communication network
`such as Internet or wireless) and provides it along with his/her
`static key to the business. When the business receives indi-
`vidual’s static and dynamic keys, the business communicates
`authentication messages including individual’s static and
`dynamic keys to the trusted-authenticator. The trusted-au-
`thenticator verifies individual’s identity if both static and
`dynamic keys are valid, otherwise will send a denial authen-
`tication message back to the business over the same commu-
`nication network.
`
`BRIEF DESCRIPTION OF THE DRAWINGS
`
`FIG. la is a high-level overview of a direct authentication
`system and method according to the present invention where
`the business directly contacts the individual’ s trusted-authen-
`ticator for validation of the individual’s identity.
`FIG. lb is another high-level overview of a direct authen-
`tication system and method according to the present invention
`where the business contacts the individual’s trusted-authen-
`
`ticator through its own trusted-authenticator to validate the
`individual’s identity.
`FIG. 2a illustrates the direct authentication system and
`method according to the present invention where the business
`directly contacts the individual’s trusted-authenticator for
`validation of the individual’s identity.
`FIG. 2b illustrates the direct authentication system and
`method according to the present invention where the business
`contacts the individual’s trusted-authenticator through its
`own trusted-authenticator to validate the individual’s iden-
`tity.
`
`DETAILED DESCRIPTION OF THE PREFERRED
`EMBODIMENTS
`
`Detailed descriptions ofthe preferred embodiment are pro-
`vided herein. It is to be understood, however, that the present
`invention may be embodied in various forms. Therefore, spe-
`cific details disclosed herein are not to be interpreted as lim-
`iting, but rather as a basis for the claims and as a representa-
`tive basis for teaching one skilled in the art to employ the
`present invention in virtually any appropriately detailed sys-
`tem, structure or manner.
`Furthermore, as used herein, “individual” 10 broadly refers
`to a person, company or organization that has established a
`trusted relationship with a trusted-authenticator 30.
`Furthermore, as used herein, “business” 20 broadly refers
`to a company or organization (online or offline) that has
`established a trusted relationship with a trusted-authenticator
`40 and that needs to authenticate the identity ofthe individual
`10.
`
`The use of “trusted-authenticator” 30 refers to an entity
`that already knows the individual 10, maintains information
`about that individual 10, and has established a trusted rela-
`tionship with that individual 10. A reasonable candidate for
`such a trusted-authenticator 30 would be a bank or other
`financial institution.
`
`The use of “trusted-authenticator” 40 refers to an entity
`that already knows the business 20, maintains information
`about that business 20, and has established a trusted relation-
`
`8
`ship w