# US 10,373,164 B2 · Methods and systems for leveraging transaction data to dynamically authenticate a user > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,373,164 B2 - Document ID: US10373164B2 - Status: Granted - Kind: B2 - Application number: 15/676,739 - Filed: 2017-08-14 - Published: 2017-12-28 - Granted: 2019-08-06 - Earliest claimed: 2013-12-09 - Assignees: Mastercard International Incorporated - Applicants: MasterCard International Incorporated - Inventors: Debashis Ghosh; Randy Shuken - Web page: https://patentgrep.com/patent/US10373164B2 ## CPC - G06Q 20/4014: {Identity check for transactions} - G06F 21/31: User authentication - G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour} - H04L 9/3271: {using challenge-response} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - G06F 2221/2149: Restricted operating environment - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3273: {for mutual authentication (network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869)} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for authenticating a candidate user accessing a host computing device as an authentic user is provided. The host computing device is in communication with an authenticating computing device. The method includes receiving, by the authenticating computing device, a request to authenticate the candidate user as an authentic user. The authentication request includes a user identifier. The method also includes retrieving, by the authenticating computing device, transaction data including payment transactions performed by the authentic user based on the user identifier. The method also includes generating, by the authenticating computing device, a challenge question and a correct answer based on the transaction data associated with the authentic user, and transmitting the challenge question for display on a candidate user computing device used by the candidate user. ## Claims ### Claim 1 A computer-implemented method for authenticating a candidate user for facilitating accessing a host computing device as an authentic user, the host computing device in communication with an authenticating computing device, said method comprising: receiving, by the authenticating computing device, an authentication request for accessing secure data stored on the host computing device, the secure data not including transaction data; retrieving, by the authenticating computing device from a database, the transaction data associated with the authentic user based on a user identifier; generating, by the authenticating computing device, a challenge question and a correct answer to the challenge question based on the transaction data associated with the authentic user; generating, by the authenticating computing device, a plurality of incorrect answers to the challenge question by comparison to the transaction data; and transmitting, by the authenticating computing device, the challenge question, the correct answer, and the plurality of incorrect answers to the host computing device without exposing the transaction data to the host computing device. ### Claim 2 (depends on 1) The method of claim 1 further comprising: generating, by the authenticating computing device, the challenge question before receiving the authentication request; and storing, by the authenticating computing device, the challenge question within the database. ### Claim 3 (depends on 1) The method of claim 1 further comprising: generating, by the authenticating computing device, an answer to the challenge question before receiving the authentication request; and storing, by the authenticating computing device, the answer within the database. ### Claim 4 (depends on 1) The method of claim 1 further comprising generating, by the authenticating computing device, the challenge question in response to the authentication request. ### Claim 5 (depends on 1) The method of claim 1 further comprising generating, by the authenticating computing device, an answer to the challenge question in response to the authentication request. ### Claim 6 (depends on 1) The method of claim 1 further comprising generating, by the authenticating computing device, the challenge question based on the transaction data from a predefined period of time, wherein the predefined period of time is defined by at least one of a level of security and ease of use for the candidate user. ### Claim 7 (depends on 1) The method of claim 1 further comprising: transmitting, by the authenticating computing device, the challenge question along with a correct answer to the host computing device, wherein the host computing device is configured to: display the challenge question to the candidate user, receive a candidate answer from the candidate user to the challenge question, compare the candidate answer to the correct answer, and authenticate the candidate user as the authentic user by matching the candidate answer to the correct answer. ### Claim 8 An authenticating computing device for use in authenticating a candidate user accessing a host computing device as an authentic user, the host computing device in communication with the authenticating computing device, the authenticating computing device comprising a memory and a processor coupled to the memory, the processor configured to: receive an authentication request for accessing secure data stored on the host computing device, the secure data not including transaction data; retrieve, from a database, the transaction data associated with the authentic user based on a user identifier; generate a challenge question and a correct answer to the challenge question based on the transaction data associated with the authentic user; generate a plurality of incorrect answers to the challenge question by comparison to the transaction data; and transmit the challenge question, the correct answer, and the plurality of incorrect answers to the host computing device without exposing the transaction data to the host computing device. ### Claim 9 (depends on 8) The authenticating computing device of claim 8 further configured to: generate the challenge question before receiving the authentication request; and store the challenge question within the database. ### Claim 10 (depends on 8) The authenticating computing device of claim 8 further configured to: generate an answer to the challenge question before receiving the authentication request; and store the answer within the database. ### Claim 11 (depends on 8) The authenticating computing device of claim 8 further configured to generate the challenge question in response to the authentication request. ### Claim 12 (depends on 8) The authenticating computing device of claim 8 further configured to generate an answer to the challenge question in response to the authentication request. ### Claim 13 (depends on 8) The authenticating computing device of claim 8 further configured to generate the challenge question based on the transaction data from a predefined period of time, wherein the predefined period of time is defined by at least one of a level of security and ease of use for the candidate user. ### Claim 14 (depends on 8) The authenticating computing device of claim 8 further configured to: transmit the challenge question along with a correct answer to the host computing device, wherein the host computing device is configured to: display the challenge question to the candidate user, receive a candidate answer from the candidate user to the challenge question, compare the candidate answer to the correct answer, and authenticate the candidate user as the authentic user by matching the candidate answer to the correct answer. ### Claim 15 A non-transitory computer readable storage medium having computer-executable instructions for authenticating a candidate user accessing a host computing device as an authentic user embodied thereon, wherein, when executed by at least one processor, the computer-executable instructions cause the at least one processor to: receive an authentication request for accessing secure data stored on the host computing device, the secure data not including transaction data; retrieve, from a database, the transaction data associated with the authentic user based on a user identifier; generate a challenge question and a correct answer to the challenge question based on the transaction data associated with the authentic user; generate a plurality of incorrect answers to the challenge question by comparison to the transaction data; and transmit the challenge question, the correct answer, and the plurality of incorrect answers to the host computing device without exposing the transaction data to the host computing device. ### Claim 16 (depends on 15) The computer-executable instructions of claim 15 further cause the processor to: generate the challenge question before receiving the authentication request; and store the challenge question within the database. ### Claim 17 (depends on 15) The computer-executable instructions of claim 15 further cause the processor to: generate an answer to the challenge question before receiving the authentication request; and store the answer within the database. ### Claim 18 (depends on 15) The computer-executable instructions of claim 15 further cause the processor to generate the challenge question in response to the authentication request. ### Claim 19 (depends on 15) The computer-executable instructions of claim 15 further cause the processor to generate an answer to the challenge question in response to the authentication request. ### Claim 20 (depends on 15) The computer-executable instructions of claim 15 further cause the processor to generate the challenge question based on the transaction data from a predefined period of time, wherein the predefined period of time is defined by at least one of a level of security and ease of use for the candidate user. ### Claim 21 (depends on 15) The computer-executable instructions of claim 15 further cause the processor to: transmit the challenge question along with a correct answer to the host computing device, wherein the host computing device is configured to: display the challenge question to the candidate user, receive a candidate answer from the candidate user to the challenge question, compare the candidate answer to the correct answer, and authenticate the candidate user as the authentic user by matching the candidate answer to the correct answer.