Authentication system and method

Patent metadata

Field	Value
Publication number	US-9697521-B2
Application number	US-201615047783-A
Country	US
Kind code	B2
Filing date	Feb 19, 2016
Priority date	Mar 3, 2008
Publication date	Jul 4, 2017
Grant date	Jul 4, 2017

Abstract

Aspects of the invention relate to a customer authentication system for authenticating a customer making a request related to a customer account. The customer authentication system may include multiple application level data receiving and processing mechanisms for receiving customer requests and collecting customer data. The customer authentication system may additionally include a central authentication system for receiving the customer requests and customer data from the multiple application level data receiving and processing mechanisms, the central authentication system determining, based on authentication policy, whether the collected customer data is sufficient to authenticate each customer in order to fulfill the customer request. The central authentication system may return its conclusions and instructions to the multiple application level data receiving and processing mechanisms. The customer authentication system may additionally include a fraud policy system for centrally managing authentication policy implemented by the central authentication system.

First claim

The invention claimed is:

1. An authentication computing system, the authentication computing system comprising:
a non-transitory memory storing at least a risk policy and a customer database that includes at least customer account information;
at least one computer processor coupled to the memory, executing instructions to perform at least the following:
receiving an authentication request from at least one communication channel, wherein the authentication request is received through an authentication dialog on a user interface;
wherein in response to receiving the authentication request from at least one communication channel, the at least one computer processor is activated to automatically perform at least the following:
retrieving and recording at least a portion of a customer activity with respect to a customer account;
determining one of more than two risk levels associated with the customer account by accessing rule sets for multiple risk levels associated with the policy, wherein the one of more than two risk levels account for recorded customer activity predictive of risky behavior and wherein the step of determining the one of more than two risk levels further comprises generating a confidence level value, and wherein the determining whether to approve the authentication request is further based on a comparison of the confidence level value and a confidence level value threshold;
determining, through the at least one computer processor, whether to approve the authentication request based on the authentication request, the one of more than two risk levels and application request activity associated with the customer account;
transmitting an authentication result based on determining whether to approve the authentication request; and
updating the customer account.

2. The authentication computing system of claim 1 , wherein the step of determining whether to approve the authentication request further comprises executing a risk policy.

3. The authentication computing system of claim 1 , wherein the step of determining the one of more than two risk levels comprises:
selecting a policy stored in non-transitory memory based on the authentication request; and
retrieving the policy from the policy store.

4. Then authentication computing system of claim 3 , wherein the selecting of the policy from the policy store is based on at least one of the following associated with the authentication request: communication channel, application, transaction risk pattern, and customer account attribute.

5. The authentication computing system of claim 1 , wherein the at least one computer processor further executes computer instructions to perform at least the following:
setting policy and risk parameters at the central authentication system; and
monitoring operation of the authentication computing system.

6. The authentication computing system of claim 5 , wherein the customer database stores customer security data, customer activity, including customer transactions, and the customer account profile.

7. The authentication computing system of claim 1 , wherein the at least one computer processor further executes computer instructions to perform at least the following:
receiving customer event information from at least one application;
updating at least one of a risk policy and a customer account associated with the customer event information; and
authenticating a second authentication request based on the updated at least one of a risk policy and a customer account.

8. The authentication computing system of claim 1 , wherein the authentication computing system receives receive authentication requests from multiple applications that include an origination application, a transaction application, and a servicing application, wherein the origination application establishes accounts and account features, the transactions application executes financial transactions, and the servicing application performs account related actions including customer profile changes and answering questions.

9. The authentication computing system of claim 1 , wherein the at least one computer processor further executes computer instructions to perform at least the following:
determining additional customer authentication information is required for authentication of the authentication request;
transmitting request to an application associated with the request for additional customer authentication information based on the policy, the request causing the application to request a customer to provide additional information authenticating the customer;
receiving additional customer authentication information from the application; and
processing the additional customer authentication information to determine whether to authenticate the authentication request.

10. The authentication computing system of claim 1 , wherein the authentication computing system receives authentication requests from multiple channels, including at least two of telephone, mobile device, internet, banking center, POS terminal, and ATM.

11. The authentication computing system of claim 1 , further comprising application level authentication tools selected for each channel, wherein the authentication level authentication tools passes received authentication information to the authentication computing system.

12. The authentication computing system of claim 11 , wherein the application level authentication tools include at least one of fingerprint recognitions, a voice recognition unit with a voice confidence level indicator, fingerprint recognition tools, iris pattern recognition tools, hand print recognition tools, spoken response recognition tools, tone recognition tools, pressure recognition tools, password recognition tools, PIN recognition tools, IP address recognition components, email address verification components, ANI, and SIM card recognition.

13. A computer-implemented method for providing authentication of a customer of a financial institution making a request related to a customer account of the financial institution from a receiving application through any one of multiple channels, the method comprising:
receiving, using at least one computer processor, an authentication request from at least one communication channel, wherein the authentication request is received through an authentication dialog on a user interface;
wherein in response to receiving the authentication request from at least one communication channel, the at least one computer processor is activated to automatically perform at least the following:
retrieving and recording at least a portion of a customer activity with respect to a customer account;
determining one of more than two risk levels associated with the customer account by accessing rule sets for multiple risk levels associated with the policy, wherein the one of more than two risk levels accounts for recorded customer activity predictive of risky behavior and wherein the step of determining the one of more than two risk levels further comprises generating a confidence level value, and wherein the determining whether to approve the authentication request is further based on a comparison of the confidence level value and a confidence level value threshold;
determining, through the at least one computer processor, whether to approve the authentication request based on the authentication request, the one of more than two risk levels and application request activity are associated with the customer account;
transmitting an authentication result based on the step of determining whether to approve the authentication request; and
updating the customer account.

Assignees

• Jpmorgan Chase Bank Na

Inventors

• Webb Timothy A
• Pletz Tracy M

Classifications

• G06F21/33

  using certificates · CPC title

• G06Q20/405

  Establishing or using transaction specific rules · CPC title

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title

• G06Q20/4014

  Identity check for transactions · CPC title