Patent Issued for Multi-channel authentication using smart cards (USPTO 11372958): United Services Automobile Association

2022 JUL 15 (NewsRx) -- By a News Reporter-Staff News Editor at Insurance Daily News -- A patent by the inventors Clowe, John R. (Selma, TX, US), filed on October 2, 2019, was published online on June 28, 2022, according to news reporting originating from Alexandria, Virginia, by NewsRx correspondents.

Patent number 11372958 is assigned to United Services Automobile Association (San Antonio, Texas, United States).

The following quote was obtained by the news editors from the background information supplied by the inventors: “Account takeovers are prevalent due in part to mass data breaches and phishing attacks exposing billions of email addresses, usernames and passwords in the past few years. Additionally, many people use the same username/password combination across multiple accounts, which makes it easy for cybercriminals to sell stolen credentials. Service providers attempt to curtail fraudulent activity by collecting and using information such as a username and password or in some cases requiring multi-factor authentication to authenticate the user. However, these techniques have limitations using current systems.

“The techniques introduced here may be better understood by referring to the following Detailed Description in conjunction with the accompanying drawings, in which like reference numerals indicate identical or functionally similar elements. Moreover, while the technology is amenable to various modifications and alternative forms, specific embodiments have been shown by way of example in the drawings and are described in detail below. The intention, however, is not to limit the technology to the particular embodiments described. On the contrary, the technology is intended to cover all modifications, equivalents, and alternatives falling within the scope of the technology as defined by the appended claims.”

In addition to the background information obtained for this patent, NewsRx journalists also obtained the inventors’ summary information for this patent: “Multi-factor authentication (i.e., the user is authenticated only after successfully presenting two or more pieces of evidence to an authentication mechanism: knowledge (something the user and only the user knows), possession (something the user and only the user has), and inherence (something the user and only the user is)) is becoming standard in authentication due to the prevalence of account takeovers. Multi-channel authentication is a method of multi-factor authentication where one or more of the authentication factors involved are communicated over separate communication channels or protocols. One way to allow users to obtain multi-channel authentication is by using a one-time password (“OTP”) token which is a hardware device capable of generating one-time passwords. More advanced hardware tokens use microprocessor-based smart cards to calculate one-time passwords. Smart cards can also include additional strong authentication capabilities such as or Public Key Infrastructure (“PKI”) certificates. When used for PKI applications, the smart card device can provide core PKI services, including encryption, digital signature and private key generation and storage.

“In existing systems, to use the hardware token, the user checks the hardware token and enters the OTP with other identity credentials (typically username and password) and an authentication server validates the request. In some cases, the hardware token can be inserted into a device and a OTP can be directly sent to an authentication server. Although this is a proven solution for enterprise applications, the deployment cost can make the solution inconvenient and expensive for consumer applications. Additionally, having to type in an OTP each time the user wants to access an application or input a hardware token into a user device such as mobile phone is burdensome. Moreover, requiring the user to carry a separate hardware token with no other use than authentication can also be problematic.

“To address the above-mentioned issues, the technology described herein provides a system and method that allows a user to be authenticated using multiple channels without requiring the user to enter a OTP or carry a hardware token dedicated to generating OTPs. In some embodiments, a smart card is embedded into a medium such as a payment card (e.g., credit card, debit card) or membership card. When the user receives the smart card, the user registers the smart card with the system by providing identity and/or authentication (e.g., username, password, PIN) to the system (e.g., via an application) and by holding the smart card within a proximity of the user’s device. The proximity is determined by the type of protocol being used to communicate information from the smart card to the device. The system collects (e.g., using RFID) information that can be used to verify OTPs generated by the smart card (e.g., digital certificate) and associated with the user profile, device, and smart card. When the smart card is embedded in a payment card, registering the smart card can accomplish two tasks simultaneously: (1) activating the payment card so it can be used to make purchases and (2) activating the smart card as an authentication device that can be used to authenticate the user for activities (e.g., access to a bank account, access to make an in-application call).

“When the user requests an interaction with the entity (e.g., by accessing the application, viewing bank accounts, requesting a transaction, filing a claim, making a call, making an in-application call), after the system identifies the user (e.g., by collecting identifying information from the user or from the device), the system prompts the user to hold the smart card within a proximity of the user’s device. The smart card generates the OTP or other information and communicates the information to the device and the device via the application sends the information to the system for verification. In some embodiments, verification occurs locally on the device. Using the digital certificate or other information previously collected by the system and associated with the user profile, the system can verify that the smart card is or is not associated with the user and/or the device. The system can either allow the user to interact, request for information or deny the request based on verification of the OTP and business rules. In some embodiments, the user is asked to provide additional authentication such as a PIN for further authentication.

“The smart card can be associated with more than one device associated with the user using the same or similar registration process. In some implementations, the device is a smartphone, tablet, laptop, smartwatch, or voice-controlled personal assistant.”

The claims supplied by the inventors are:

“1. A computerized method, the method comprising: receiving, from a device associated with a user, a request to register a smart card, wherein the request includes a digital certificate associated with the smart card sent to the device via a wireless protocol; associating the digital certificate with the smart card, the device and a user profile associated with the user; receiving, via an application installed on the device, a request to engage in an activity; determining at least one detected authentication factor is outside of a normal range for the user for determining whether the smart card is in the user’s possession; in response to receiving the request to engage in the activity and the determination that the smart card is in the user’s possession, prompting the user to place the smart card within a threshold proximity of the device; in response to the smart card being detected within the threshold proximity of the device, receiving, via the application, information associated with the smart card; verifying that the information is associated with the device and the user profile using the digital certificate; and in response to verifying that the information is associated with the device and the user profile, allowing the user to engage in the activity.

“2. The computerized method of claim 1, wherein the smart card is embedded in a payment card, wherein registering the smart card activates the payment card for purchases and activates the smart card for use as an authentication device.

“3. The computerized method of claim 1, wherein the smart card generates a one-time password.

“4. The computerized method of claim 1, the method further comprising: receiving a second request to register the smart card with a second device, wherein the second request includes the digital certificate associated with the smart card; verifying that the second device is associated with the user profile; and associating the digital certificate with the second device.

“5. The method of claim 1, the method further comprising: determining a level of authentication required for the activity; and in response to the level of authentication required for the activity being above a threshold, requesting the user to provide additional authentication before allowing the user to engage in the activity.

“6. The method of claim 1, wherein the device is a voice-controlled personal assistant device.

“7. The method of claim 1, wherein the smart card communicates with the device using near-field communication.

“8. The method of claim 1, wherein receiving, from the device associated with the user, the request to register the smart card comprises wirelessly detecting, by the device, the smart card.

“9. The method of claim 1, the method further comprising: detecting a trigger; and in response detecting the trigger, requesting the user to provide additional authentication before allowing the user to engage in the activity.

“10. The method of claim 9, wherein the method further comprises receiving health information from a wearable associated with the user, wherein detecting the trigger comprises receiving the health information from the wearable.

“11. A system for verifying authorization of an application download comprising: a smart card; and a server configured for: receiving, from a device associated with a user, a request to register the smart card, wherein the request includes a digital certificate associated with the smart card sent to the device via a wireless protocol; associating the digital certificate with the smart card, the device and a user profile associated with the user; receiving, via an application installed on the device, a request to engage in an activity; determining at least one detected authentication factor is outside of a normal range for the user for determining whether the smart card is in the user’s possession; in response to receiving the request to engage in the activity and the determination that the smart card is in the user’s possession, prompting the user to place the smart card within a threshold proximity of the device; in response to the smart card being detected within the threshold proximity of the device, receiving, via the application, information associated with the smart card; verifying that the information is associated with the device and the user profile using the digital certificate; and in response to verifying that the information is associated with the device and the user profile, allowing the user to engage in the activity.

“12. The system of claim 11, wherein the smart card is embedded in a payment card, wherein registering the smart card activates the payment card for purchases and activates the smart card for use as an authentication device.

“13. The system of claim 11, wherein the server is further configured for: receiving a second request to register the smart card with a second device, wherein the second request includes the digital certificate associated with the smart card; verifying that the second device is associated with the user profile; and associating the digital certificate with the second device.

“14. The system of claim 11, wherein the server is further configured for determining a level of authentication required for the activity; and in response to the level of authentication required for the activity being above a threshold, requesting the user to provide a personal identification number before allowing the user to engage in the activity.

“15. The system of claim 11, wherein receiving, from the device associated with the user, the request to register the smart card comprises wirelessly detecting, by the device, the smart card.

“16. A non-transitory computer-readable storage medium containing a set of instructions that, when executed by one or more processors, cause a machine to: receive, from a device associated with a user, a request to register a smart card, wherein the request includes a digital certificate associated with the smart card sent to the device via a wireless protocol; associate the digital certificate with the smart card, the device and a user profile associated with the user; receive, via an application installed on the device, a request to engage in an activity; determining at least one detected authentication factor is outside of a normal range for the user for determining whether the smart card is in the user’s possession; in response to receiving the request to engage in the activity and the determination that the smart card is in the user’s possession, prompt the user to place the smart card within a threshold proximity of the device; in response to the smart card being detected within the threshold proximity of the device, receive, via the application, information associated with the smart card; verify that the information is associated with the device and the user profile using the digital certificate; and in response to verifying that the information is associated with the device and the user profile, allow the user to engage in the activity.

“17. The non-transitory computer-readable storage medium of claim 16, wherein the smart card is embedded in a payment card, wherein registering the smart card activates the payment card for purchases and activates the smart card for use as an authentication device.

“18. The non-transitory computer-readable storage medium of claim 16, wherein the set of instructions, when executed by the one or more processors, further cause the machine to: receive a second request to register the smart card with a second device, wherein the second request includes the digital certificate associated with the smart card; verify that the second device is associated with the user profile; and associate the digital certificate with the second device.

“19. The non-transitory computer-readable storage medium of claim 16, wherein the set of instructions, when executed by the one or more processors, further cause the machine to: determine a level of authentication required for the activity; and in response to the level of authentication required for the activity being above a threshold, request the user to provide a personal identification number before allowing the user to engage in the activity.

“20. The non-transitory computer-readable storage medium of claim 16, wherein the set of instructions, that when executed by the one or more processors, cause the machine to receive, from the device associated with the user, the request to register the smart card further cause the machine to wirelessly detect, by the device, the smart card.”

URL and more information on this patent, see: Clowe, John R. Multi-channel authentication using smart cards. U.S. Patent Number 11372958, filed October 2, 2019, and published online on June 28, 2022. Patent URL: http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.htm&r=1&f=G&l=50&s1=11372958.PN.&OS=PN/11372958RS=PN/11372958

(Our reports deliver fact-based news of research and discoveries from around the world.)