Systems and methods for secure remote identity verification

Patent metadata

Field	Value
Publication number	US-10476676-B2
Application number	US-201715642259-A
Country	US
Kind code	B2
Filing date	Jul 5, 2017
Priority date	Jul 5, 2016
Publication date	Nov 12, 2019
Grant date	Nov 12, 2019

Abstract

Systems and methods are provided for authenticating an identity of a user requesting a resource or service from an entity. In some embodiments, a system may include at least one processor; and a non-transitory medium containing instructions that cause the system to perform operations. The operations may include receiving credential information associated with the remote user, and receiving, from the server associated with the entity, first hash information. The operations may also include generating second hash information based on information associated with the user, comparing the first hash information with the second hash information, and transmitting an indication based on the comparison to the server associated with the entity.

First claim

What is claimed is:

1. A system for authenticating the identity of a remote user, the system comprising:
at least one processor; and
a non-transitory computer readable medium containing instructions, that when executed by the at least one processor, cause the system to perform operations comprising:
receiving, from a server associated with an entity, a request to authenticate a remote user,
transmitting, to a first computer device associated with the remote user, a request for credential information,
receiving, from the first computer device, credential information associated with the remote user,
transmitting, to the server associated with the entity, information identifying the request,
receiving, from the server associated with the entity, first hash information,
generating second hash information based on information associated with the user,
comparing the first hash information with the second hash information, and
transmitting, to the server associated with the entity, an indication based on the comparison;
wherein the server includes a validation application programming interface for comparing the received information associated with the user with information known to the server and a salt/pepper application programming interface for securing the received information associated with the user before providing it to the server via the validation programming interface.

2. The system of claim 1 , wherein the first hash information includes an indication of one or more categories of information used to create the first hash information.

3. The system of claim 2 , wherein generating the second hash information based on information associated with the user comprises generating the second hash information based on the indication of one or more categories of information used to create the first hash information.

4. The system of claim 1 , wherein the operations further comprise submitting, to a second computer device associated with the remote user, a multi factor authentication challenge.

5. The system of claim 1 , wherein the first hash information includes an identification of at least one of cryptographic salt and cryptographic pepper.

6. The system of claim 5 , wherein the operations further comprise:
determining, based on the identification of the at least one of cryptographic salt and cryptographic pepper, that the at least one of cryptographic salt and cryptographic pepper is expired; and
wherein the transmitted indication includes an indication that the authentication cannot be completed.

7. The system of claim 1 , wherein the second hash information is generated at least in part based on the information identifying the request.

8. The system of claim 7 , wherein the received first hash information includes the information identifying the request.

9. The system of claim 8 , wherein the information associated with the user is retrieved based on the information identifying the request included in the received first hash information.

10. A system for authenticating the identity of a remote user, the system comprising:
at least one processor; and
a non-transitory computer readable medium containing instructions, that when executed by the at least one processor, cause the system to perform operations comprising:
receiving an identity verification request from a device associated with a remote user, the request including information associated with the remote user,
requesting, from a server, a transaction identifier for the identity verification request,
transmitting, to the device, redirect information for redirecting the device to the server,
receiving, from the server, the transaction identifier identifying the identify verification request,
hashing the information associated with the remote user,
transmitting the hashed information to the server, and
receiving from the server, an indication of the authenticity of the user;
wherein the server includes a validation application programming interface for comparing the received information associated with the user with information known to the server and a salt/pepper application programming interface for securing the received information associated with the user before providing it to the server via the validation programming interface.

11. The system of claim 10 , wherein the hashed information includes an identification of at least one of cryptographic salt and cryptographic pepper.

12. The system of claim 11 , wherein the operations further comprise:
receiving, from the server, an indication that the at least one of cryptographic salt and cryptographic pepper, is expired; and
transmitting, to the server, a request for at least one of new cryptographic salt and new cryptographic pepper.

13. The system of claim 10 , wherein the transmitted hashed information includes the transaction identifier.

14. The system of claim 10 , wherein the transmitted hashed information includes an indication of one or more categories of information used to create the hashed information.

15. The system of claim 10 , wherein the hashing is performed at least in part based on the received transaction identifier.

16. A method for authenticating the identity of a remote user, the method comprising the following operations performed by one or more processors:
receiving, from a server associated with an entity, a request to authenticate a remote user,
transmitting, to a first computer device associated with the remote user, a request for credential information,
receiving, from the first computer device, credential information associated with the remote user,
transmitting, to the server associated with the entity, information identifying the request,
receiving, from the server associated with the entity, first hash information,
generating second hash information based on information associated with the user,
comparing the first hash information with the second hash information, and
transmitting, to the server associated with the entity, an indication based on the comparison;
wherein the server includes a validation application programming interface for comparing the received information associated with the user with information known to the server and a salt/pepper application programming interface for securing the received information associated with the user before providing it to the server via the validation programming interface.

17. The method of claim 16 , wherein the first hash information includes an indication of one or more categories of information used to create the first hash information.

18. The method of claim 17 , wherein generating the second hash information based on information associated with the user comprises generating the second hash information based on the indication of one or more categories of information used to create the first hash information.

19. The method of claim 16 , wherein the operations further comprise submitting, to a second computer device associated with the remote user, a multi factor authentication challenge.

20. The method of claim 16 , wherein the first hash information includes an identification of at least one of cryptographic salt and cryptographic pepper.

Assignees

• Capital One Services Llc

Inventors

• Fox Ryan
• Weimer Jonathan
• Sharma Meghnath
• Hall Charles W

Classifications

• H04L9/3236 Primary

  using cryptographic hash functions · CPC title

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L2463/082

  applying multi-factor authentication · CPC title