# US 8,789,153 B2 · Method for secure user and transaction authentication and risk management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,789,153 B2
- Document ID: US8789153B2
- Status: Granted
- Kind: B2
- Application number: 13/011,587
- Filed: 2011-01-21
- Published: 2011-07-28
- Granted: 2014-07-22
- Earliest claimed: 2010-01-27
- Assignees: Authentify, Inc.
- Applicants: Ravi Ganesan
- Inventors: Ravi Ganesan
- Web page: https://patentgrep.com/patent/US8789153B2

## CPC

- H04L 63/0838: {using one-time-passwords}
- G06Q 20/385: {using an alias or single-use codes}
- H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key}
- H04L 9/3247: {involving digital signatures}
- H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)}
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- H04L 2209/80: Wireless
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

To provide a user signature on a network transaction, a security server receives transaction information representing a transaction between a network user and a network site, such as a website. The security server calculates a one-time-password based on the received transaction information and a secret shared by the security server and the network site, but not by the user. The security server transmits the calculated one-time-password for application as the user's signature on the transaction. The one-time-password is independently calculable by the network site based on the shared secret.

## Claims

### Claim 1

A method of providing a user signature on a network transaction, comprising:
receiving, by a security server, transaction information representing a transaction between a network user and a network site;
calculating, by the security server, a one-time-password based on (i) the received transaction information and (ii) a secret shared by the security server and the network site, but not by the user, wherein the one-time-password is independently calculable by the network site based on the shared secret and the transaction information; and
transmitting, by the security server, the calculated one-time-password for application as the user's signature on the transaction and verification by the network site;
wherein the calculated one-time-password is transmitted, by the security server to one user network device, for presentation on a window displayed by that user network device and entry by the user onto a network page associated with the network site and displayed on another user network device.

### Claim 2 (depends on 1)

The method of claim 1, wherein:
the network site is a web site; and
the transaction information is received from a web page associated with the network site and displayed on a network device associated with the user.

### Claim 3 (depends on 1)

The method of claim 1, wherein:
the one user network device is of a type that is different than the other user network device.

### Claim 4 (depends on 3)

The method of claim 3, wherein:
the one user network device is a personal mobile network device, and
the other user network device is a computer.

### Claim 5 (depends on 3)

The method of claim 3, wherein:
the one user network device is a mobile smart phone; and
the other user network device is a desktop computer.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
storing, at the security server, a log of transactions between the user and the network site.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
computing, by the security server, a risk profile of the user based on the stored transactions log.

### Claim 8 (depends on 6)

The method of claim 6, further comprising:
transmitting, by the security server to a third party, the stored transactions log for risk analysis.

### Claim 9

A method of providing a user signature on a network transaction, comprising:
receiving, by one user agent on a user network device from a security server, a one-time-password corresponding to (i) transaction information representing a transaction between a user and a network site and (ii) a secret shared by the security server and the network site, but not by the user, wherein the one-time-password is independently calculable by the network site based on the shared secret and the transaction related information;
transferring the one time password from the one user agent to another user agent on another different user network device; and
transmitting, by the other user agent to the network site, the calculated one-time-password as the user's signature on the transaction for verification by the network site.

### Claim 10 (depends on 9)

The method of claim 9, wherein:
the one user agent is a window displayed on the user network device; and
the other user agent is a network page associated with the network site and displayed on the other different user network device.

### Claim 11

A method of authenticating a user on a network, comprising:
receiving, by a security server, a request of a network site to have a user authenticated;
calculating, by the security server, a one-time-password based on a secret shared by the security server and the network site, but not by the user, wherein the one-time-password is independently calculable by the network site based on the shared secret; and
transmitting, by the security server to a window displayed on a network device of the user, the calculated one-time-password for entry by the user onto a network page associated with the network site and displayed on another network device of the user, and for subsequent verification by the network site to thereby authenticate the user.

### Claim 12 (depends on 11)

The method of claim 11, further comprising:
also receiving, by the security server, transaction information relating to a transaction between the user and the network site; and
wherein the one-time-password is calculated based also on the transaction information.

### Claim 13 (depends on 11)

The method of claim 11, wherein:
the user network device is of a type that is different than the other user network device.

### Claim 14 (depends on 13)

The method of claim 13, wherein:
the user network device is a mobile smart phone; and the other user network device is a computer.

### Claim 15

A method of authenticating a user on a network, comprising:
receiving, by a user agent on a network device of a user, a one-time-password corresponding to a secret shared by a security server and a network site, but not by the user;
transferring, by the user, the received one-time-password from the user agent on the network device to another user agent on another network device; and
transmitting, by the other user agent to the network site, the transferred one-time-password for subsequent verification by the network site to thereby authenticate the user;
wherein the one-time-password is independently calculable by the network site based on the shared secret.

### Claim 16 (depends on 15)

The method of claim 15, wherein:
the user agent is a window displayed on the user network device; and
the other user agent is a network page associated with the network site and displayed on the other user network device.