# US 10,482,236 B1 · Methods, mediums, and systems for establishing and using security questions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,482,236 B1
- Document ID: US10482236B1
- Status: Granted
- Kind: B1
- Application number: 16/294,297
- Filed: 2019-03-06
- Granted: 2019-11-19
- Earliest claimed: 2018-10-05
- Assignees: Capital One Services, LLC
- Applicants: Capital One Services, LLC
- Inventors: Vincent Pham; Austin Grant Walters; Jeremy Edward Goodsitt; Fardin Abdi Taghi Abad; Anh Truong; Kate Key; Kenneth Taylor
- Web page: https://patentgrep.com/patent/US10482236B1

## CPC

- G06F 21/45: Structures or tools for the administration of authentication
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Exemplary embodiments relate to the secure storage of security questions through an immutable log, such as a blockchain. The security questions may be stored in a centralized location, accessible from an application or browser tab running on the user's device. When a security question is required, such as to perform a password reset on a website, the website may interact with the application or browser tab, which retrieves the question(s) from the blockchain. The user may enter their answers to the question(s), which may be hashed by the application or tab. The hashed answers may be entered into the original requesting website, which may verify with the blockchain that the correct answers have been provided. Thus, the requesting website sees neither the questions nor the answers. Additional security features may include logging requests for questions, so that a user can determine if a security question may have been compromised.

## Claims

### Claim 1

An apparatus comprising:
a network interface configured to interact with a server storing a blockchain;
a non-transitory computer-readable medium storing logic for a client-side program;
a hardware processor circuit;
browser logic executable on the processor circuit and configured to access, via a first browser process, a web site for which a password associated with a user is required;
password reset logic executable on the processor circuit and configured to receive a request to reset the password; and
second browser logic executable on the processor circuit and configured to:
instantiate a second browser process for resetting the password,
retrieve a question from the blockchain, the question stored in a block of the blockchain, the block comprising an answer corresponding with the question, and the block associated with the web site,
display the question,
receive a response to the question, and
create a hash of the response, wherein
the browser logic is further configured to receive the hash of the response via the first browser process,
the network interface is further configured to provide the hash of the response to the server, and
the browser logic is further configured to receive a determination that the response to the question matches the answered contained in the block of the blockchain and, in response to the determination, to reset the password.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the client-side program is configured to run as a background process on the hardware processor circuit.

### Claim 3 (depends on 1)

The apparatus of claim 1, further comprising authentication logic executable on the processor circuit and configured to authenticate the user with the server via the client-side program.

### Claim 4 (depends on 1)

The apparatus of claim 1, wherein the question from the blockchain is received in an encrypted format, and further comprising decryption logic executable by the program to decrypt the question from the blockchain.

### Claim 5 (depends on 1)

The apparatus of claim 1, further comprising auditing logic configured to:
receive an instruction to audit the blockchain; and
display a last request received with respect to the question.

### Claim 6 (depends on 1)

The apparatus of claim 1, further comprising question generation logic configured to receive a custom, non-preconfigured, question and store the custom question in the block of the blockchain.

### Claim 7 (depends on 6)

The apparatus of claim 6, the question generation logic configured to receive an answer to the custom question, and store the answer with the custom question and authentication information in the block of the blockchain.

### Claim 8 (depends on 7)

The apparatus of claim 7, wherein the answer, the custom question, and the authentication information are stored in the block of the blockchain and the block identified by a blockchain identifier.

### Claim 9

A computer-implemented method, comprising:
receiving, by client-side logic of a client-side device, a request to reset a password to access a web site associated with a user;
retrieving, by the client-side logic, a question from a block of a blockchain, the block having an answer associated with the question, and the block associated with the web site;
displaying, by the client-side logic, the question on a display device;
receiving, via an input device of the client-side device, a response to the question for the user;
creating, by the client-side logic, a hash of the response;
providing, by the client-side logic, the hash of the response to a server, the server coupled via network with the client-side device; and
receiving, by the client-side logic, a determination that the response to the question matches the answer contained in the block of the blockchain and, in response to the determination, resetting the password.

### Claim 10 (depends on 9)

The computer-implemented of claim 9, comprising authenticating, via client-side logic, the user with the server.

### Claim 11 (depends on 9)

The computer-implemented method of claim 9, wherein the question from the blockchain is received in an encrypted format, and further comprising decrypting, by the client-side logic, the question from the blockchain.

### Claim 12 (depends on 9)

The computer-implemented method of claim 9, comprising auditing, by the client-side logic, including:
receiving an instruction to audit the blockchain; and
displaying, on the display device, a last request received with respect to the question.

### Claim 13 (depends on 9)

The computer-implemented method of claim 9, comprising receiving, by the client-side logic, a custom, non-preconfigured, question, and storing the custom question in the block of the blockchain.

### Claim 14 (depends on 13)

The computer-implemented method of claim 13, comprising receiving, by the client-side logic, an answer to the custom question, and storing the answer with the custom question and authentication information in the block of the blockchain.

### Claim 15 (depends on 14)

The computer-implemented method of claim 14, wherein the answer, the custom question, and the authentication information are stored in block of the blockchain and the record identified by a blockchain identifier.

### Claim 16

A non-transitory computer-readable medium storing instructions that, when executed, cause one or more processors to:
receive a request to reset a password to access a web site associated with a user;
retrieve, via a network, a question from a blockchain, the question stored in a block of the blockchain, the block comprising an answer corresponding with the question, and the block associated with the web site;
display, on a display, the question;
receive, via an input device, a response to the question for the user;
create a hash of the response;
provide the hash of the response to a server; and
receive a determination that the response to the question matches the answer contained in the blockchain and, in response to the determination, resetting the password.

### Claim 17 (depends on 16)

The medium of claim 16, wherein the question from the blockchain is received in an encrypted format, and further storing instructions to cause the one or more processors to decrypt the question from the blockchain.

### Claim 18 (depends on 16)

The medium of claim 16, further storing instructions to cause the one or more processors to receive and process a custom, non-preconfigured, question, and store the custom question in the block of the blockchain.

### Claim 19 (depends on 18)

The medium of claim 18, further storing instructions to cause the one or more processors to receive and process an answer to the custom question, and store the answer with the custom question and authentication information in the block of the blockchain.

### Claim 20 (depends on 19)

The medium of claim 19, wherein the answer, the custom question, and the authentication information are stored in the block of the blockchain and the record identified by a blockchain identifier.