Granted Patent B1

US 10,299,118 · App. 15/169,168 · Granted May 21, 2019

Inventors: Huzefa Karachiwala (Belmont, CA); Terence Sheehy (West Palm Beach, FL); Tsang Ming Jiang (Fremont, CA)

Assignee: Benten Solutions Inc.

H04W12/06H04L63/067H04L63/0838H04L63/10

Abstract

Claims (90)

1. A computer-implemented method comprising:

receiving, at an authentication server, a request from a third party server to authenticate an attempt to access a user account stored by the third party server, the request comprising a user identifier input during the attempt, each of the authentication and third party servers being computing devices,

wherein the input of the user identifier during the attempt is not accompanied by a password;

retrieving, from a registration database at the authentication server, a list of one or more mobile devices registered at the authentication server by a user and associated with the user identifier, the one or more mobile devices, and the user account belonging to the user;

transmitting an authentication notification from the authentication server to a push service for the push service to push the authentication notification to at least one mobile device from the list of one or more mobile devices belonging to the user, the authentication notification comprising a prompt to be displayed at the at least one mobile device for the user to verify that they are in fact currently attempting to access their user account or verify that they are not in fact currently attempting to access their user account;

receiving, at the at least one mobile device, the authentication notification from the push service;

in response to receiving the authentication notification at the at least one mobile device, displaying, on an electronic screen of the at least one mobile device, the prompt in the authentication notification for the user to verify that they are in fact currently attempting to access their user account or verify that they are not in fact currently attempting to access their user account;

receiving, at the at least one mobile device in response to the prompt, one of first or second indications from the user, the first indication being a verification from the user that they are in fact currently attempting to access their user account, and the second indication being a verification from the user that they are not in fact currently attempting to access their user account;

when the first indication is received,

generating, at the at least one mobile device, a first one-time passcode (OTP);

transmitting the first OTP from the at least one mobile device to the authentication server;

receiving, at the authentication server from the at least one mobile device, the first OTP;

generating, at the authentication server, a second OTP;

determining if the second OTP matches the first OTP;

if the second OTP matches the first OTP, notifying the third party server of the verification from the user that they are in fact currently attempting to access their user account; and

if the second OTP does not match the first OTP, notifying the third party server that the attempt to access the user account should be blocked; and

when the second indication is received,

generating, at the at least one mobile device, an invalid OTP;

transmitting the invalid OTP from the at least one mobile device to the authentication server;

receiving, at the authentication server from the at least one mobile device, the invalid OTP;

based on the invalid OTP, determining that the user is not in fact currently attempting to access their user account; and

notifying the third party server that the attempt to access the user account should be blocked.

2. The method of claim 1 wherein the user identifier comprises an email address or a username.

3. The method of claim 1 comprising:

transmitting, from the authentication server to the third party server, the list of one or more mobile devices registered at the authentication server and associated with the user identifier; and

receiving, at the authentication server from the third party server, a selection of a mobile device from the list, the selected mobile device being the at least one mobile device to which the authentication notification is to be transmitted.

4. The method of claim 1 wherein access to the user account stored by the third party server is authenticated without the third party server having to receive a one-time password.

5. The method of claim 1 wherein the third party server is different from the authentication server.

6. The method of claim 1 wherein the third party server comprises a website.

7. The method of claim 1 wherein the third party server comprises at least one of a financial services website, e-commerce website, or streaming media website.

8. The method of claim 1 wherein the mobile device comprises a smartphone or a tablet computer.

9. The method of claim 1 wherein an authentication app on the at least one mobile device does not display the first one-time passcode to the user.

10. The method of claim 1 wherein the third party server does not receive the first one-time passcode.

11. The method of claim 1 wherein access to the user account stored by the third party server is permitted without entering any of the password, the first OTP, or the second OTP.

12. A system comprising:

a storage device; and

a processor configured to:

receive, at an authentication server, a request from a third party server to authenticate an attempt to access a user account stored by the third party server, the request comprising a user identifier input during the attempt, each of the authentication and third party servers being computing devices,

wherein the input of the user identifier during the attempt is not accompanied by a password;

retrieve, from a registration database at the authentication server, a list of one or more mobile devices registered at the authentication server by a user and associated with the user identifier, the one or more mobile devices, and the user account belonging to the user;

transmit an authentication notification from the authentication server to a push service for the push service to push the authentication notification to at least one mobile device of the one or more mobile devices belonging to the user, wherein the authentication notification comprises a prompt to be displayed at the at least one mobile device belonging to the user for the user to verify that they currently wish to access the user account or verify that they currently do not wish to access the user account;

receive, at the at least one mobile device by an authentication application (“app”) executing on the at least one mobile device, the authentication notification from the push service;

display, on an electronic screen of the at least one mobile device, the prompt in the authentication notification for the user to verify that they currently wish to access the user account or verify that they currently do not wish to access the user account;

receive, at the at least one mobile device, one of first or second responses from the user, the first response being a verification from the user that they currently wish to access the user account, and the second response being a verification from the user that they currently do not wish to access the user account;

if the first response is received,

generate, at the at least one mobile device, a first one-time passcode (OTP);

transmit the first OTP from the at least one mobile device to the authentication server;

receive, at the authentication server from the at least one mobile device, the first OTP;

generate, at the authentication server, a second OTP;

determine if the second OTP matches the first OTP;

if the second OTP matches the first OTP, notify the third party server that the attempt to access the user account should be permitted; and

if the second OTP does not match the first OTP, notify the third party server that the attempt to access the user account should be blocked; and

if the second response is received,

generate, at the at least one mobile device, an invalid OTP indicating that the user currently does not wish to access the user account;

transmit the invalid OTP from the at least one mobile device to the authentication server;

receive, at the authentication server from the at least one mobile device, the invalid OTP;

based on the invalid OTP, determine that the user currently does not wish to access the user account; and

notify the third party server that the attempt to access the user account should be blocked.

13. The system of claim 12 wherein the push service comprises Apple Push Notification (APN) service.

14. The system of claim 12 wherein the push service comprises Firebase Cloud Messaging (FCM) (formerly referred to as Google Cloud Messaging (GCM) service).

15. A computer program product comprising a non-transitory computer readable medium having program instructions embodied therein for:

receiving, at an authentication server, a request from a third party server to authenticate an attempt to perform an online transaction associated with a user account stored by the third party server, the request comprising a user identifier input during the attempt, each of the authentication and third party servers being computing devices,

wherein the input of the user identifier during the attempt is not accompanied by a password;

retrieving, from a registration database at the authentication server, a list of one or more mobile devices registered at the authentication server by a user and associated with the user identifier, the one or more mobile devices, and the user account belonging to the user;

transmitting an authentication notification from the authentication server to a push service for the push service to push the authentication notification to at least one mobile device of the one or more mobile devices belonging to the user, wherein the authentication notification comprises a prompt to be displayed at the at least one mobile device belonging to the user for the user to confirm that they are in fact attempting to perform the online transaction or confirm that they are not in fact attempting to perform the online transaction;

receiving, at the at least one mobile device, the authentication notification from the push service;

displaying, on an electronic screen of the at least one mobile device belonging to the user, the prompt in the authentication notification for the user to confirm that they are in fact attempting to perform the online transaction or confirm that they are not in fact attempting to perform the online transaction, wherein displaying the prompt is before generation of a one-time passcode (OTP);

receiving, at the at least one mobile device, one of first or second indications from the user, the first indication being a confirmation from the user that they are in fact attempting to perform the online transaction, and the second indication being a confirmation from the user that they are not in fact attempting to perform the online transaction;

if the first indication is received,

generating, at the at least one mobile device, a first OTP in response to the user confirming that they are in fact attempting to perform the online transaction;

transmitting the first OTP from the at least one mobile device to the authentication server;

receiving, at the authentication server from the at least one mobile device, the first OTP;

generating, at the authentication server, a second OTP;

determining if the second OTP matches the first OTP;

if the second OTP matches the first OTP, notifying the third party server that the attempt to perform the online transaction should be permitted; and

if the second OTP does not match the first OTP, notifying the third party server that the attempt to perform the online transaction should be blocked; and

if the second indication is received,

not generating the first OTP in response to the user confirming that they are not in fact attempting to perform the online transaction;

generating, at the at least one mobile device, an invalid OTP;

transmitting the invalid OTP from the at least one mobile device to the authentication server;

receiving, at the authentication server from the at least one mobile device, the invalid OTP;

based on the invalid OTP, determining that the user is not in fact attempting to perform the online transaction; and

notifying the third party server, by the authentication server, that the attempt to perform the online transaction should be blocked.

16. The method of claim 1 wherein the displaying the prompt in the authentication notification is before generation of an OTP.

17. The method of claim 1 wherein the when the second indication is received comprises:

not generating the first OTP; and

generating an indication that the user is not in fact currently attempting to access their user account.

18. The method of claim 1 wherein the

invalid OTP is an indication that the user is not in fact currently attempting to access their user account.

19. The computer program product of claim 15 wherein the online transaction comprises a user account access authorization or a credit card transaction.

Assignments (1)

Continuity (1)

Cited By (11)

US 12,261,957 US 12,262,201 US 12,386,930 US 12,483,555 US 12,489,746 US 12,500,874 US 12,524,511 US 12,568,074 US 12,621,158 US 12,659,312 US 12,689,622