Multi-channel multi-factor authentication
View Patent ↗Systems and methods for authenticating electronic transactions are provided. The authentication methods employ a combination of security features and communication channels. These security features can be based, for example, on unique knowledge of the person being authenticated, a unique thing that the person has, unique personal features and attributes of the person, the ability of the person to respond, and to do so in a fashion that a machine cannot, and so forth. Methods for enrolling the person prior to authentication are also provided, as well as systems for enrollment and authentication.
1. A method for authenticating a user comprising:
receiving a claimant target over a first channel;
retrieving a device address associated with a user ID;
sending a prompt over a second channel to a device associated with the device address, the prompt being one of a plurality of prompts, each of the plurality of prompts having a biometric template of the user associated therewith;
receiving a biometric response to the prompt; and
determining a match between the biometric response and a biometric template associated with the prompt that was sent over the second channel.
2. The method of claim 1 wherein the claimant target comprises the user ID.
3. The method of claim 1 further comprising determining the user ID from the claimant target.
4. The method of claim 1 not comprising receiving a password.
5. The method of claim 1 wherein the device address is a phone number.
6. The method of claim 1 wherein at least one of the prompts comprises a personalized prompt.
7. The method of claim 1 further comprising selecting the prompt from the plurality of prompts.
8. The method of claim 7 wherein selecting the prompt is performed according to a rule that the same prompt is not used in successive authentications.
9. The method of claim 1 wherein sending the prompt includes sending a SMS.
10. The method of claim 1 wherein the biometric response is received over the first channel.
11. The method of claim 1 wherein the biometric response is received over the second channel.
12. The method of claim 1 wherein determining the match between the biometric response and the biometric signature includes performing voice recognition.
13. The method of claim 1 wherein determining the match between the biometric response and the biometric signature includes performing voice identification.
14. The method of claim 1 wherein the prompt comprises a hybrid prompt including a random word.
15. The method of claim 14 further comprising applying voice recognition to the random word.
16. The method of claim 15 further comprising storing a biometric signature corresponding to the random word.
17. A method for authenticating a user comprising:
receiving a claimant target over a first channel;
retrieving a device address associated with a user ID;
establishing a second channel to a device associated with the device address;
sending a prompt to the user, the prompt being one of a plurality of prompts, each of the plurality of prompts having a biometric template of the user associated therewith;
receiving a biometric response to the prompt over the second channel; and
determining a match between the biometric response and a biometric template associated with the prompt sent over the second channel.
18. The method of claim 17 wherein the claimant target comprises the user ID.
19. The method of claim 17 further comprising determining the user ID from the claimant target.
20. The method of claim 17 further comprising selecting the prompt from the plurality of prompts.
21. The method of claim 17 wherein sending the prompt to the user comprises sending the prompt over the first channel.
22. A method for authentication consisting of:
a claimant submitting a unique identifier over a first channel;
the claimant receiving a prompt on a device; and
the claimant submitting a biometric response to the prompt, where one of the two steps of receiving the prompt and submitting the biometric response is performed over a second channel.
23. The method of claim 22 wherein the prompt comprises a personalized prompt.
24. The method of claim 22 wherein the device is a hand-held device.
25. An authentication system comprising:
enrollment logic configured to enroll a user by
associating the user with a user ID,
associating the user ID and with a device address,
associating a plurality of prompts with the user ID, and
associating a plurality of biometric templates each with one of the plurality of prompts; and
authentication logic configured to authenticate a claimant as the user by
receiving a claimant target over a first channel,
retrieving a device address associated with the user ID,
sending a prompt from the plurality of prompts to a device associated with the device address over a second channel,
receiving a biometric response to the prompt, and
determining a match between the biometric response and a biometric template associated with the prompt.
26. The authentication system of claim 25 wherein the enrollment logic is further configured to associate the plurality of prompts with the user ID by presenting a set of pre-defined prompts to the user and receiving a selection of the plurality of prompts therefrom.
27. The authentication system of claim 25 wherein the enrollment logic is further configured to allow the user to create a personalized prompt.
28. An authentication system comprising authentication logic configured to authenticate a claimant by
receiving a claimant target over a first channel;
retrieving a device address associated with a user ID;
sending a prompt from a plurality of prompts to a device associated with the device address over a second channel;
receiving a biometric response to the prompt; and
determining a match between the biometric response and a biometric template associated with the prompt.
29. The authentication system of claim 28 wherein the claimant target comprises the user ID.
30. The authentication system of claim 28 wherein the authentication logic is further configured to determine the user ID from the claimant target.
31. The authentication system of claim 28 wherein the authentication logic is further configured to send a key.
32. The authentication system of claim 31 wherein the key expires within a period of time.
33. The authentication system of claim 28 wherein the prompt includes a key.