Secure and convenient mobile authentication techniques

Patent metadata

Field	Value
Publication number	US-9361619-B2
Application number	US-201213567805-A
Country	US
Kind code	B2
Filing date	Aug 6, 2012
Priority date	Aug 6, 2012
Publication date	Jun 7, 2016
Grant date	Jun 7, 2016

Abstract

Security and convenience are provided by a system, apparatus, method, and computer program product that stores two or more encryption keys that correspond to two or more levels of authentication. The encryption keys may be encrypted and decrypted utilizing an endorsement key and trusted computing techniques. Or the encryption keys may be stored in a secure manner utilizing key protection techniques, such as cryptographic camouflaging. A first encryption key is recovered automatically for the first level of authentication. And input is requested to recover the second encryption key for the second level of authentication.

First claim

What is claimed is:

1. An apparatus for providing two or more levels of authentication for a transaction, the apparatus comprising:
a user interface;
a processor; and
a memory storing executable instructions, that, when executed by the processor, cause the processor to perform the steps of:
storing authentication information, a first encryption key associated with a first level of authentication, and a second encryption key associated with a second level of authentication;
receiving transaction information;
determining that the first level of authentication is required for the transaction and, based on the determination, recovering the first encryption key;
determining that a second level of authentication is required for the transaction and, in response, requesting a first input via the user interface;
receiving the first input via the user interface;
comparing the received first input to the authentication information;
determining that the authentication information is different than the first input;
generating an incorrect encryption key based on the first input being different than the authentication information, wherein the incorrect encryption key is different than the second encryption key;
signing the transaction information using the incorrect key;
transmitting the signed transaction information to a server;
receiving a message from the server and, based on the message, requesting a second input via the user interface;
receiving the second input into the user interface and transmitting the second input to the server; and
authenticating the transaction.

2. The apparatus of claim 1 , wherein:
the authentication information is a correct key PIN;
the executable instructions, when executed by the processor, cause the processor to perform the further steps of:
encrypting the second encryption key under the correct key PIN; and
generating the incorrect encryption key when an incorrect key PIN is received as the input; and
the second encryption key, prior to decryption, and the incorrect encryption key have the same data structure.

3. The apparatus of claim 2 , wherein:
the executable instructions, when executed by the processor, cause the processor to perform the further step of:
determining the input required for the second level of authentication based on a transaction condition; and
the transaction condition comprises at least one of an individual transaction amount, an aggregate amount over a predetermined time period, a geographic area, a merchant, a product type, and a particular account.

4. The apparatus of claim 2 , wherein:
the first level of authentication corresponds to a financial transaction that is less than or equal to a predetermined transaction amount; and
the second level of authentication corresponds to a financial transaction that is greater than the predetermined transaction amount.

5. The apparatus of claim 1 , wherein the executable instructions, when executed by the processor, cause the processor to perform the further steps of:
requesting an other input via the user interface of the apparatus when the second level of authentication is required;
receiving input of a correct other input via the user interface of the apparatus; and
recovering the second encryption key when the correct other input is received.

6. The apparatus of claim 1 , wherein:
the apparatus further comprises an endorsement key that is provided in hardware of the apparatus and that is shared with trusted software; and
the executable instructions, when executed by the processor, cause the processor to perform the further steps of: encrypting the second encryption key utilizing the endorsement key; and
recovering the endorsement key when the first input that is received is the same as the authentication information and recovering and decrypting the second encryption key with the endorsement key when the second encryption key is requested by the trusted software.

7. The apparatus of claim 6 , wherein the executable instructions, when executed by the processor, cause the processor to perform the further steps of:
Encrypting a third encryption key associated with a third level of authentication utilizing the endorsement key; and
requesting a further input, recovering the endorsement key when the further input is received
requesting a further input, recovering the endorsement key when the further input is received, and recovering and decrypting the third encryption key with the endorsement key when the third encryption key is requested by the trusted software.

8. The apparatus of claim 7 , wherein:
the first level of authentication corresponds to a financial transaction that is less than or equal to a predetermined transaction amount;
the second level of authentication corresponds to a financial transaction that is greater than the predetermined transaction amount; and
the third level of authentication corresponds to a financial transaction that is greater than the predetermined transaction amount and at least one of a non-trusted time period, a non-trusted geographic area, a non-trusted merchant, a non-trusted product type, and a non-trusted account.

9. A method for providing two or more levels of authentication for a transaction comprising:
storing, on a device, authentication information, a first encryption key associated with a first level of authentication, and a second encryption key associated with a second level of authentication;
receiving, by the device, transaction information for the transaction;
determining, by the device, that the first level of authentication is required for the transaction and, based on the determination, recovering the first encryption key with a processor of the device;
determining, by the device, that a second level of authentication is required for the transaction and, in response, requesting a first input via a user interface of the device;
receiving the first input via the user interface of the device;
comparing, by the device, the received first input to the authentication information;
determining, by the device, that the authentication information is different than the first input;
generating, by the device, an incorrect encryption key based on the first input being different than the authentication information, wherein the incorrect encryption key is different than the second encryption key;
signing, by the device, the transaction information using the incorrect key;
transmitting the signed transaction information to a server;
receiving, by the device, a message from the server, and based on the message, requesting, by the device, a second input via the user interface;
receiving, by the device, the second input into the user interface and transmitting, by the device, the second input to the server;
authenticating, by the device, the transaction.

10. The method of claim 9 , wherein:
the authentication information is a correct key PIN;
the method further comprises:
encrypting the second encryption key under the correct key PIN; and
generating incorrect encryption key when an incorrect key PIN is received as the input; and

the second encryption key, prior to encryption, and the incorrect encryption key have the same data structure.

11. The method of claim 10 , further comprising determining the input required for the second level of authentication based on a transaction condition, wherein the transaction condition comprises at least one of an individual transaction amount, an aggregate amount over a predetermined time period, a geographic area, a merchant, a product type, and a particular account.

12. The method of claim 10 , wherein:
the first level of authent

Assignees

• Varadarajan Rammohan
• Malpani Ambarish
• Ca Inc

Inventors

• Varadarajan Rammohan
• Malpani Ambarish

Classifications

• G06Q20/227

  characterised in that multiple accounts are available, e.g. to the payer · CPC title

• G06F21/31

  User authentication · CPC title

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title

• G06Q20/3823

  combining multiple encryption tools for a transaction · CPC title

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title