Environment-based two-factor authentication without geo-location
The invention provides a method and system for accomplishing two-factor authentication for internet transactions, wherein the user of the device through which the transaction is negotiated needs to give only a single yes/no verification to the system. In some embodiments, the second factor authentication is automated without any action on the part of the user. The method calls on the user's wireless voice device for the detection of environmental wireless signals (“Short Distance Wireless Information” or “SDWI”), and uses these signals collectively as a “fingerprint” that uniquely identifies the wireless signals near the wireless voice device. The system stores these SDWI fingerprints, and later uses the stored information to establish whether or not the user's wireless voice device is near a previously-recognized SDWI.
1. A computer-implemented method of controlling the access of an Internet user to conduct a transaction via a website, where the user has access to a mobile voice device that is paired with an identifier of the user, and is in communication with the website via a computer having a computer signature, the method comprising the computer-implemented steps of:
a. receiving the computer signature;
b. receiving an identifier of the user;
c. checking whether the computer signature is stored in a database;
d. sending a notification from a server to the mobile voice device that is paired with the identifier received in step (b), which causes the mobile voice device to acquire and report available Short Distance Wireless Information (SDWI);
e. if SDWI is not available, then attempting to authenticate the transaction, and if the transaction is authenticated then communicating an indication of success to the web site; or
f. if the stored computer signature is correlated in the database with stored SDWI that matches the SDWI acquired at step (d), then communicating an indication of success to the website; and
g. if the stored SDWI does not match the SDWI acquired at step (d), then attempting to authenticate the transaction, and if the transaction is authenticated then communicating an indication of success to the website, and correlating the computer signature in the database with the SDWI acquired at step (d).
2. The method of claim 1 , wherein the SDWI is an IP address of a wireless device that is independent and separate from both the mobile voice device and the computer.
3. The method of claim 1 , wherein the SDWI is at least one identifier of a wireless device that is independent and separate from both the mobile voice device and the computer.
4. The method of claim 3 , wherein the SDWI comprises at least one of:
a. Wi-Fi MAC address;
b. Wi-Fi SSID; and
c. Wi-Fi signal strength.
5. The method of claim 1 , wherein the user is not presented with an option to automate future transactions.
6. The method of claim 1 , wherein the process of authenticating the transaction in steps (e) and (g) is performed by the software installed on the mobile voice device.
7. The method of claim 6 , wherein the user is not presented with an option to automate future transactions.
8. The method of claim 1 , further comprising the step of receiving an indication of a change in SDWI during an active session in which the transaction has been authenticated, and if the received SDWI is not correlated with the computer signature, sending notification to the mobile voice device or to a server.
9. The method of claim 1 , wherein the process of authenticating the user in steps (e) and (g) is done by presenting options to the user, via the software installed on the mobile voice device, the options including at least one of:
a. the option to approve or not approve the transaction; and
b. the option to use the association of SDWI and computer signature of another user; but not including
c. an option to automate future transactions.
10. The method of claim 9 , wherein the software installed on the mobile voice device presents to the user an option to delete from the database the correlation of the computer signature with the stored SDWI.
11. The method of claim 1 , wherein if the access to the website in steps (e) and (g) is successfully authenticated, then the acquired SDWI is correlated in the database with the computer signature.
12. The method of claim 1 , wherein the process of authenticating the user in steps (e) and (g) is done by presenting to the user, via the software installed on the mobile voice device, two options, and wherein if the user chooses to allow access to the website, then all future access to the website that are characterized by the same computer signature and the same acquired SDWI are allowed automatically.
13. The method of claim 1 , wherein in step (d), if the SDWI is not available or is not reported within a pre-set period of time, the method further comprises the step of sending a notification to the mobile voice device.
14. The method of claim 1 , wherein the received SDWI is correlated in the database with the computer signature only if the SDWI is that of a Wi-Fi device that is protected by a password and is using encrypted communications.
15. The method of claim 1 , wherein the stored and correlated SDWI and computer signature were correlated by a prior user who is not the current user, and the prior user was granted access to the website.
16. The method of claim 1 , wherein the match in step (f) is between the SDWI and computer signature of a prior user granted access to the website, and the SDWI and computer signature of the current user, and if both match then allowing access to the current user.
17. The method of claim 1 , wherein in step (d) the notification sent to the user is a silent notification which does not alert the user that the notification arrived.
18. The method of claim 1 , further comprising the step of receiving an indication of a change in SDWI during an active session in which the transaction has been authenticated, and if the received SDWI is not correlated with the computer signature, then attempting to authenticate the-transaction, and if the transaction is authenticated then communicating an indication of success to the website.