Hidden factor authentication
View Patent ↗The invention provides a user verification system to verify whether a user of a secure system is authorised to access the secure system. The user verification system comprises one or more processors and one or more computer memory storage means; stored instructions on the memory storage means for controlling the processor, to create a user profile for a user, which profile input fields require first address such as an email address and second address such as a cellular telephone number; and stored instructions on the memory storage means for controlling the processor, to login to the secure system and which secure system is set up to send a login verification means to the first or second address in the form of a hidden response request.
1 . A user verification system to verify whether a user of a secure system is authorized to access the secure system, the user verification system comprising:
one or more processors and computer memory storage;
stored instructions on the computer memory storage configured to:
create a user profile for a user, wherein the profile includes a first address and one or more hidden addresses, each hidden address being assigned and authenticated by a business and concealed at login;
deliver a one-time pin or approval request to a hidden address for verifying the user's access or transaction; and
periodically or dynamically update each hidden address with a new hidden address created and authenticated by the business to secure verification processes.
2 . The system as claimed in claim 1 , further comprising of stored instructions on the computer memory storage to perform a password or profile reset, wherein the secure system is configured to send a reset verification request to the first address and a reset one-time pin to the hidden address for verification.
3 . The system as claimed in claim 1 , wherein a login interface is configured to conceal the transmission of a one-time pin or approval request or any indication that the hidden address is being used.
4 . The system as claimed in claim 1 , wherein the one-time pin or approval request is a time-out response request.
5 . The system as claimed in claim 1 , wherein the one-time pin or approval request is sent in addition to visible verification steps or login verification requests.
6 . The system as claimed in claim 1 , wherein the one-time pin or approval request is sent to the hidden address and is in the form of an email, a mobile application notification and/or request for verification, or a message which comprises an OTP (one-time pin) or approval request.
7 . The system as claimed in claim 1 , wherein the stored instructions for creating or updating the user profile are configured to provide input fields for the first address and the one or more hidden addresses, the first address being the primary communication address, and the login interface is configured to conceal the hidden address during login, and wherein the system is configured to prompt the user to input a hidden address to strengthen security.
8 . The system as claimed in claim 1 , wherein the user verification system is configured to delay the one-time pin delivery or approval request.
9 . The system as claimed in claim 1 , wherein the user verification system is connected to a server loaded with a database which comprises compromised user contact details or suspicious IP addresses or features and configured to compare user information entered on the user's profile to determine if any information is flagged as compromised or suspicious and notify the user to require to suggest an input of a hidden address to strengthen the security.
10 . The system as claimed in claim 1 , wherein the hidden address is used as a notification means to issue notifications to the user, notifications comprising reject or approval requests, new password requests, resetting or changing the password messages, or compromise of private information alerts.
11 . The system as claimed in claim 1 , wherein a login page of the login verification means is configured to only display the hidden address after completion of a verification process after a one-time pin or approval request has been entered, and only for a single login session.
12 . The system as claimed in claim 11 , wherein the user verification system is configured to customize the verification steps and/or requirements to allow a user to select a security configuration associated with perceived security risks related to different types of transactions and prior compromised contact details.
13 . The system as claimed in claim 1 , wherein the hidden address is used as a notification means to issue notifications to the user, the notifications being used to send a pin, OTP, seed phrase, random words, letters, special characters, or combinations as part of a verification or password change or resetting process and a pin or similar is also sent to a first or primary address.
14 . A method for verifying whether a user of a secure system is authorized to access the secure system, which method comprises the steps of:
creating a user profile for a user, wherein input fields are provided for a cellular telephone number and one or more hidden addresses, each hidden address being assigned and authenticated by a business and concealed at login;
sending a verification request to a cellular device of the user;
sending a one-time pin or approval request to the hidden address for a verification process selected from the group consisting of login and reset verification means; and
periodically or dynamically updating each hidden address to a new hidden address created and authenticated by the business to secure the verification processes.
15 . A method as claimed in claim 14 , comprising a step of requesting the user during account profile creation or updating to enter and store, one or more hidden addresses and concealing each hidden address and the sending of any verification request to the hidden address at an associated login page.
16 . A non-transitory computer-readable medium including one or more sequences of instructions which, when executed by one or more processors, causes said one or more processors to perform the method as claimed in claim 14 .