DYNAMIC ACCOUNT AUTHENTICATION USING A MOBILE DEVICE
Providing dynamic authentication of a user requesting access to a system via a mobile device is disclosed. An account holder tailors a set of customized security challenges and responses. When a request for account authentication is received from a mobile device, the system conducts a multi-step user authentication process that includes dynamically selecting and prompting the user with the custom security challenges.
1 . A method for dynamic authentication of a user using a mobile device, comprising:
receiving a request from the mobile device for authentication of the user using the mobile device, wherein the request includes information that uniquely identifies an account;
sending a first custom security challenge that is selected from custom security challenges, wherein the first custom security challenge and a first valid response to the first custom security challenge were previously established with the user and stored in association with the account;
receiving a first response to the security challenge from the mobile device; and,
validating the first response against the first valid response to authenticate the user.
2 . The method of claim 1 , wherein sending the first custom security challenge comprises sending multiple custom security challenges.
3 . The method of claim 1 , further comprising encrypting the first custom security challenge.
4 . The method of claim 1 , wherein the step of receiving a first response comprises receiving an encrypted first response.
5 . The method of claim 1 , wherein the request includes a personal identification number (PIN) to uniquely identify the account.
6 . The method of claim 1 , wherein the account is a transaction account.
7 . The method of claim 1 , further comprising enabling the user to perform at least one of:
executing a transaction with the account, modifying the account, enrolling in additional products and enrolling in additional services.
8 . The method of claim 1 , further comprising enabling the user to execute a transaction with limitations based upon at least one of time, transaction type, transaction amount, number of transactions, mobile device capabilities, mobile device characteristics and user permissions.
9 . The method of claim 1 , wherein receiving the request from the mobile device comprises receiving the request from an application on the mobile device.
10 . The method of claim 1 , further comprising causing an application to be loaded onto the mobile device.
11 . The method of claim 1 , wherein the first valid response is dynamic with respect to at least one of time and a stored data value.
12 . The method of claim 1 , wherein selecting from custom security challenges comprises selecting based upon at least one of: user specified order, random selection, a calculation, a previous user response, an event, a date, a time, a location, mobile device capabilities, mobile device characteristics and the service being requested by the user.
13 . The method of claim 1 , wherein sending comprises sending multiple security challenges, receiving comprises receiving multiple responses to the multiple security challenges and validating comprises validating multiple responses.
14 . The method of claim 1 , further comprising:
sending a second custom security challenge that is selected from custom security challenges, wherein the second custom security challenge and a second valid response to the second custom security challenge were previously established with the user and stored in association with the account, and wherein sending a second custom security challenge is triggered by the step of validating the first response;
receiving a second response to the second security challenge from the mobile device; and,
validating the second response against the second valid response to further authenticate the user.
15 . The method of claim 1 , wherein the request includes a card identification number (CID) to uniquely identify the account.
16 . The method of claim 1 , wherein the user is a third-party and the information that uniquely identifies the account also identifies the user as a third-party.
17 . The method of claim 1 , wherein the user is a third-party and the first custom security challenge and the first valid response are unique to the third-party and were previously established by an account holder.
18 . The method of claim 1 , wherein the information that uniquely identifies an account includes at least one of mobile device capabilities, mobile device characteristics and data associated with the mobile device.
19 . The method of claim 1 , wherein the account is a transaction account and the first valid security response is at least partially related to the amount of the latest transaction against the transaction account.
20 . A machine-readable medium having stored thereon a plurality of instructions for dynamic authentication of a user using a mobile device, the plurality of instructions when executed by a processor, cause the processor to perform the steps of:
receiving a request from the mobile device for authentication of the user using the mobile device, wherein the request includes information that uniquely identifies an account;
sending a first custom security challenge that is selected from custom security challenges, wherein the first custom security challenge and a first valid response to the first custom security challenge were previously established with the user and stored in association with an account;
receiving a first response to the security challenge from the mobile device; and,
validating the first response against the first valid response to authenticate the user.
21 . A system for dynamic authentication of a user using a mobile device, comprising:
an authentication engine configured to:
receive a request from the mobile device for authentication of the user using the mobile device, wherein the request includes information that uniquely identifies an account;
send a custom security challenge that is selected from custom security challenges, wherein the custom security challenge and a valid response to the custom security challenge were previously established with the user and stored in association with the account;
receive a response to the security challenge from the mobile device; and,
validate the response against the valid response; and
a database containing custom security challenges and the valid response to each security challenge.
22 . A method for dynamic authentication of a mobile device, comprising:
receiving a request from the mobile device, wherein the request includes information that uniquely identifies the mobile device or an account;
sending a first custom security challenge that is selected from custom security challenges, wherein the first custom security challenge and a first valid response to the first custom security challenge were previously established with an account holder and stored in association with the account;
receiving a first response to the security challenge from the mobile device; and,
validating the first response against the first valid response to authenticate the mobile device.