Method and system protecting against identity theft or replication abuse
A system detecting and protecting against identity theft by abusing a computer users ID and password or protecting a user against identity replication through parallel user session via a second authentication level using a second channel, a one-time-passcode and user contextual location information. When accessing networks, computer systems or programs, the said networks, computer systems or programs will validate user ID and password and collect contextual information about the user, the device, the used network etc. Once validated, a message is send by a second means that may be a cell phone SMS network or an instant message, said message containing a real-time session-specific one-time passcode. The session specific code and the collected information provides information enabling the user to detect a compromised identity through a mismatch between presented information and the information representing the user and the passcode protects against fraudulent access.
1. A method, implemented by a computer-implemented authentication system, for authenticating a user attempting to access a target component of a computer system from a first user system, the first user system being connectable to a first communications network, the method comprising:
receiving, by at least one computing device, user authentication information entered by the user via a first user-interface of the first user system;
obtaining, by the at least one computing device, via the first communications network a session identifier and at least one item of contextual information identifying the first user system or a property of the first communications network;
verifying, by the at least one computing device, the user authentication information, and responsive to successful verification of the user authentication information, sending a message from the computer-implemented authentication system via a second communications network to a second user system, the message comprising
(a) at least one item of said obtained contextual information or derived information of said obtained contextual information, allowing the second user system to present at least the at least one item of contextual information to the user via a second user interface so as to allow the user to verify the at least one item of contextual information, and
(b) a real-time session-specific one-time passcode, different from the at least one item of said obtained contextual information, and associated with the session identifier;
receiving, by the at least one computing device, via the first user system and the first communications network a passcode entered by the user into the first user system;
verifying, by the at least one computing device, the entered passcode against the real-time session-specific one-time passcode and/or the session identifier; and responsive to a successful verification of the entered passcode, granting to the first user system access to the target component.
2. The method according to claim 1 wherein the target component is chosen from a computer, a computer program, computer program functionality, a computer resource, a computer network.
3. The method according to claim 1 , wherein the first and second user systems are different devices.
4. The method according to claim 3 , wherein the second user system is a portable communications device configured to receive and display the message.
5. The method according to claim 1 wherein the first and second user systems are embodied as a single user system adapted to provide the first and second user interfaces, and wherein the method comprises presenting at least the at least one item of contextual information by the single user system via a second user interface of the single user system different from the first user interface.
6. The method according to claim 1 , wherein the first and second communications networks are different communications networks.
7. The method according to claim 1 , further comprising communicating the passcode from the computer-implemented authentication system to the user.
8. The method according to claim 1 , further comprising communicating gathered contextual information from the computer-implemented authentication system to the user via a second passcode window displayed by the first user system.
9. The method according to claim 1 , wherein the authentication system creates a passcode in real-time that is only valid for the session ID created by the login attempt that invokes the code being created and sent.
10. The method according to claim 1 , wherein the at least one item of contextual information comprises a computer identifier of a computer used as the first user system, or approximate regional information about a location of the first user system.
11. A non-transitory computer readable medium encoded with instructions for authenticating a user attempting to access a target component of a computer system from a first user system, the instructions executable by a processor, comprising:
receiving user authentication information entered by the user via a first user-interface of the first user system;
obtaining via the first communications network a session identifier and at least one item of contextual information identifying the first user system or a property of the first communications network;
verifying the user authentication information and, responsive to successful verification of the user authentication information, sending a message from the computer-implemented authentication system via a second communications network to a second user system, the message comprising:
a) at least one item of said obtained contextual information or derived information of said obtained contextual information, allowing the second user system to present at least the at least one item of contextual information to the user via a second user interface so as to allow the user to verify the at least one item of contextual information, and
b) a real-time session-specific onetime passcode, different from the at least one item of said obtained contextual information, and associated with the session identifier;
receiving via the first user system and the first communications network a passcode entered by the user into the first user system; and
verifying the entered passcode against the real-time session-specific one-time passcode and/or the session identifier; and responsive to a successful verification of the entered passcode, granting to the first user system access to the target component.
12. A system for authenticating a user attempting to access a target component of a computer system from a first user system, the first user system being connectable to a first communications network, the system comprising:
a first user system to receive user authentication information entered by the user via a first user-interface of the first user system;
a communications network to obtain a session identifier and at least one item of contextual information identifying the first user system or a property of the first communications network; and
an authentication system comprising at least one microprocessor, the at least one microprocessor to:
verify the user authentication information and, responsive to successful verification of the user authentication information, sending a message from the computer-implemented authentication system via a second communications network to a second user system, the message comprising:
a) at least one item of said obtained contextual information or derived information of said obtained contextual information, allowing the second user system to present at least the at least one item of contextual information to the user via a second user interface so as to allow the user to verify the at least one item of contextual information, and
b) a real-time session-specific onetime passcode, different from the at least one item of said obtained contextual information, and associated with the session identifier;
receive via the first user system and the first communications network a passcode entered by the user into the first user system; and
verify the entered passcode against the real-time session-specific one-time passcode and/or the session identifier; and responsive to a successful verification of the entered passcode, grant to the first user system access to the target component.
13. The system according to claim 12 further comprising an authentication server, and wherein the at least one microprocessor further to provide the first user-interface on the first user system.