Authentication using DTMF tones
A method of obtaining and automatically providing secure authentication information includes registering a client device over a data line, storing information and a changeable value for authentication in subsequent telephone-only transactions. In the subsequent transactions, a telephone call placed from the client device to an interactive voice response server is intercepted and modified to include dialing of a delay and at least a passcode, the passcode being based on the unique information and the changeable value, where the changeable value is updated for every call session. The interactive voice response server forwards the passcode and a client device identifier to an authentication function, which compares the received passcode to plural passcodes generated based on information and iterations of a value stored in correspondence with the client device identifier. Authentication is confirmed when a generated passcode matches the passcode from the client device.
1. A computer-implemented method comprising:
transmitting, by a computer, to a client device via a data channel an authentication sequence from a database during registration of a caller device; and
after registration of the caller device:
receiving, by the computer, authentication information originated from the caller device via a telephone channel, the authentication information including purported metadata associated with the caller device and dual-tone multi-frequency (DTMF) tones containing a purported authentication sequence;
comparing, by the computer, the authentication sequence against the purported authentication sequence and expected metadata from the database against the purported metadata; and
authenticating, by the computer, the caller device as the client device in response to identifying matches between the authentication sequence and the purported authentication sequence and between the expected metadata and the purported metadata.
2. The method according to claim 1 , further comprising:
receiving, by the computer, prior authentication information from the client device via the data channel;
generating, by the computer, the authentication sequence, at least a portion of the authentication generated using the prior authentication; and
storing, by the computer, the authentication sequence into the database.
3. The method according to claim 1 , further comprising converting, by the computer, audio representation of the DTMF tones received via the telephone channel into electronic data containing the purported authentication sequence.
4. The method according to claim 1 , wherein at least a portion of the authentication information received from the caller device is encoded; the method further comprising:
identifying, by the computer, in the database encoding data corresponding to a client device identifier (client ID) received with the authentication information; and
decoding, by the computer, the at least a portion of the authentication information based upon the encoding data.
5. The method according to claim 1 , further comprising:
transmitting, by the computer, a changeable value associated with the client device along with the authentication sequence, wherein the changeable value is configured to be used when generating the authentication sequence or purported authentication sequence;
identifying, by the computer, in the database the changeable value corresponding to a client ID received with the authentication information; and
updating, by the computer, the authentication sequence according to the changeable value for comparing the authentication sequence against the purported authentication sequence.
6. The method according to claim 1 , further comprising transmitting, by the computer, a notification to at least one of the caller device and the client device indicating whether the caller device has been authenticated as the client device.
7. The method according to claim 1 , further comprising transmitting, by the computer, a notification to at least one of the caller device and the client device indicating whether the expected data matches the purported data.
8. The method according to claim 1 , wherein the authentication information originated from the caller device further includes a passcode generated at the client device.
9. The method according to claim 1 , wherein the authentication information is received from the caller device via a server hosting an interactive voice response (IVR) system.
10. The method according to claim 1 , wherein the metadata includes a type of metadata selected from the group comprising: a cell tower identifier, a geographical identifier, an account number, biometric data, caller name, caller address, and government identification number.
11. A system comprising:
a database configured to store authentication information associated with one or more client devices; and
a server comprising a processor configured to:
transmit to a client device via a data channel the authentication sequence associated with the client during registration of a caller device; and
after registration of the caller device:
receive authentication information originated from a caller device via a telephone channel, the authentication information including purported metadata associated with the caller device and dual-tone multi-frequency (DTMF) tones containing a purported authentication sequence;
compare the authentication sequence against the purported authentication sequence and expected metadata from the database against the purported metadata; and
authenticate the caller device as the client device in response to identifying matches between the authentication sequence and the purported authentication sequence and between the expected metadata and the purported metadata.
12. The system according to claim 11 , wherein the server is further configured to:
receive prior authentication information from the client device via the data channel;
generate the authentication sequence, at least a portion of the authentication generated using the prior authentication; and
store the authentication sequence into the database.
13. The system according to claim 11 , wherein the server is further configured to convert audio representation of the DTMF tones received via the telephone channel into electronic data containing the purported authentication sequence.
14. The system according to claim 11 , wherein at least a portion of the authentication information received from the caller device is encoded; and
wherein the server is further configured to:
identify in the database encoding data corresponding to a client device identifier (client ID) received with the authentication information; and
decode the at least a portion of the authentication information based upon the encoding data.
15. The system according to claim 11 , wherein the server is further configured to:
transmit a changeable value associated with the client device along with the authentication sequence, wherein the changeable value is configured to be used when generating the authentication sequence or purported authentication sequence;
identify in the database the changeable value corresponding to a client ID received with the authentication information; and
update the authentication sequence according to the changeable value for comparing the authentication sequence against the purported authentication sequence.
16. The system according to claim 11 , wherein the server is further configured to transmit a notification to at least one of the caller device and the client device indicating whether the caller device has been authenticated as the client device.
17. The system according to claim 11 , wherein the server is further configured to transmit a notification to at least one of the caller device and the client device indicating whether the expected data matches the purported data.
18. The system according to claim 11 , wherein the authentication information originated from the caller device further includes a passcode generated at the client device.
19. The system according to claim 11 , wherein the authentication information is received from the caller device via a server hosting an interactive voice response (IVR) system.
20. The system according to claim 11 , wherein the metadata includes a type of metadata selected from the group comprising: a cell tower identifier, a geographical identifier, an account number, biometric data, caller name, caller address, and government identification number.