# US 12,002,048 B1 · Authentication system and method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,002,048 B1 - Document ID: US12002048B1 - Status: Granted - Kind: B1 - Application number: 17/061,968 - Filed: 2020-10-02 - Granted: 2024-06-04 - Earliest claimed: 2012-04-20 - Applicants: Wells Fargo Bank, N.A. - Inventors: Alexander Zaharopoulos Hughes - Web page: https://patentgrep.com/patent/US12002048B1 ## CPC - G06Q 20/4014: {Identity check for transactions} - G06F 21/31: User authentication - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - G06F 2221/2103: Challenge-response - H04L 2463/102: applying security measure for e-commerce - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An indication that a user wishes to conduct a bank transaction is received. An authentication path to be presented to the individual is pseudo-randomly determined. The authentication path comprises a combination of authentication challenges to be presented to the individual. A determination is made whether the user presented valid responses to the authentication challenges. The user is authenticated to conduct the bank transaction based on whether the user is determined to have presented valid responses to the authentication challenges. ## Claims ### Claim 1 A method, comprising: receiving, by one or more processors, an indication that a user has requested to perform an activity requiring authorization; determining, by the one or more processors, that authorization of the activity requires a pseudo-random authentication process; generating, by the one or more processors, an authentication path for presentation to the user, the authentication path comprising a first portion and a second portion, wherein: the first portion of the authentication path comprises at least one authentication challenge of a plurality of authentication challenges determined and presented to the user responsive to the indication that the user has requested to perform the activity and prior to the user specifying parameters of the activity; and the second portion of the authentication path comprises two or more authentication challenges of the plurality of authentication challenges determined and presented to the user after the user specifies the parameters of the activity, an order of the second portion being pseudo-randomly determined responsive to the parameters of the activity being specified by the user and based on a type of the activity being specified by the user, wherein the second portion of the authentication path is presented to the user after valid responses to the at least one authentication challenge of the first portion have been provided; determining, by the one or more processors, that the user presented valid responses to the second portion of the authentication path; and authorizing, by the one or more processors, responsive to determining that the user presented valid responses to the second portion of the authentication path, the user to perform the activity requiring authorization. ### Claim 2 (depends on 1) The method of claim 1, wherein at least one of the plurality of authentication challenges is an authentication question, and wherein generating the authentication path comprises pseudo-randomly selecting the authentication question as at least one of the two or more authentication challenges of the second portion. ### Claim 3 (depends on 1) The method of claim 1, wherein the at least one authentication challenge of the plurality of authentication challenges of the first portion includes a request for a valid login identifier (ID) and password combination. ### Claim 4 (depends on 1) The method of claim 1, wherein generating the authentication path further comprises pseudo-randomly determining, by the one or more processors, a number of authentication challenges in the second portion of the authentication path. ### Claim 5 (depends on 1) The method of claim 1, wherein the second portion of the authentication path is to be presented to the user in response to the user presenting a first valid response to the at least one authentication challenge of the first portion. ### Claim 6 (depends on 1) The method of claim 1, wherein the at least one authentication challenge of the first portion is pseudo-randomly selected from the plurality of authentication challenges prior to the user specifying the parameters of the activity. ### Claim 7 (depends on 1) The method of claim 1, wherein the plurality of authentication challenges comprise at least one of swiping a transaction card, providing photo identification, entering a personal identification number (PIN), or providing a valid signature. ### Claim 8 (depends on 1) The method of claim 1, wherein the activity is a transaction, and wherein receiving the indication that the user has requested to perform the activity comprises: receiving a transaction request that identifies the user and the transaction; and receiving the parameters of the activity, the parameters identifying a transaction type comprising at least one of a withdrawal of funds, a purchase of a good or service, a transfer of funds from one account to another account, or a change in account information. ### Claim 9 (depends on 1) The method of claim 1, further comprising: providing, by the one or more processors, an online banking website for display on a computing device; and wherein the indication that the user has requested to perform the activity is received via the online banking website. ### Claim 10 (depends on 1) The method of claim 1, further comprising modifying, by the one or more processors, the authentication path when the user is in a location proximate to another user. ### Claim 11 A system, comprising: a processor and non-transitory machine readable storage media having instructions stored therein that, when executed by the processor, cause the processor to: receive an indication that a user has requested to perform an activity requiring authorization; determine that authorization of the activity requires a pseudo-random authentication process; generate an authentication path for presentation to the user, the authentication path comprising a first portion and a second portion, wherein: the first portion of the authentication path comprises at least one authentication challenge of a plurality of authentication challenges determined and presented to the user responsive to the indication that the user has requested to perform the activity and prior to the user specifying parameters of the activity; and the second portion of the authentication path comprises two or more authentication challenges of the plurality of authentication challenges determined and presented to the user after the user specifies the parameters of the activity, an order of the second portion being pseudo-randomly determined responsive to the parameters of the activity being specified by the user and based on a type of the activity being specified by the user, wherein the second portion of the authentication path is presented to the user after valid responses to the at least one authentication challenge of the first portion have been provided; determine that the user presented valid responses to the second portion of the authentication path; and authorize, responsive to the determination that the user presented valid responses to the second portion of the authentication path, the user to perform the activity requiring authorization. ### Claim 12 (depends on 11) The system of claim 11, wherein at least one of the plurality of authentication challenges is an authentication question, and the instructions, when executed by the processor, further cause the processor to pseudo-randomly select the authentication question as at least one of the two or more authentication challenges of the second portion. ### Claim 13 (depends on 11) The system of claim 11, wherein the at least one authentication challenge of the plurality of authentication challenges of the first portion includes a request for a valid login identifier (ID) and password combination. ### Claim 14 (depends on 11) The system of claim 11, wherein the instructions, when executed by the processor, further cause the processor to pseudo-randomly determine a number of authentication challenges in the second portion of the authentication path. ### Claim 15 (depends on 11) The system of claim 11, wherein the second portion of the authentication path is to be presented to the user in response to the user presenting a first valid response to the at least one authentication challenge of the first portion. ### Claim 16 (depends on 11) The system of claim 11, wherein the at least one authentication challenge of the first portion is pseudo-randomly selected from the plurality of authentication challenges prior to the user specifying the parameters of the activity. ### Claim 17 (depends on 11) The system of claim 11, wherein the plurality of authentication challenges comprise at least one of swiping a transaction card, providing photo identification, entering a personal identification number (PIN), or providing a valid signature. ### Claim 18 (depends on 11) The system of claim 11, the activity is a transaction, and wherein the instructions, when executed by the processor, further cause the processor to: receive a transaction request that identifies the user and the transaction; and receive the parameters of the activity, the parameters identifying a transaction type comprising at least one of a withdrawal of funds, a purchase of a good or service, a transfer of funds from one account to another account, or a change in account information. ### Claim 19 (depends on 11) The system of claim 11, wherein the instructions, when executed by the processor, further cause the processor to: provide, for display on a computing device of the user, an online banking website, and wherein the indication that the user has requested to perform the activity is received via the online banking website. ### Claim 20 (depends on 11) The system of claim 11, wherein the instructions, when executed by the processor, further cause the processor to modify the authentication path when the user is in a location proximate to another user.