Checkfree Corporation

Authentify, Inc.

Tricipher, Inc.

Other

Early Warning Services, LLC

Vmware, Inc.

Checkfree Services Corporation

Safemashups Inc.

Payfone, Inc.

Wmware, Inc.

Ravi Ganesan

Ravinderpal Sandhu

Brett Schoppert

Mihir M Bellare

Hans Daniel Dreyer

Colin Joseph deSa

Kenneth Hobday

Matt Lewis

Peter J Kight

Andrew Paul Cottrell

Kyle Austin

Mark T Harris

Kathryn Randall Wolfe

Andrew Robert Rolfe

D Kenneth Hobday, Jr

Peter George Tapling

Ravi Singh Sandhu

Timothy Scott Renshaw

Donald Kenneth Hobday, Jr

Sally Sheward

Tim Herdklotz

Matthew Sheridan Lewis

Jim Magers

A method comprising: when a user attempts to access: redirecting the user to a Triple Blind Identity Exchange Service (TBIES) Discovery Service (TBIES DS); redirecting, by the TBIES DS, the user back while providing a blinded name of a selected Identity Provider (IdP), redirecting the user to a TBIES-Service Provider (SP) proxy with a federation request; and blinding, by the TBIES-SP proxy, the identity of the SP and any user identifiable data and redirecting the user to a TBIES-IdP proxy, which performs any required data manipulation and redirects the user to the IdP. The IdP authenticates the user, and redirects the user to the TBIES-IdP proxy, which blinds the identity of the IdP, blinds all user information, and redirects to the SP-Proxy, which unblinds the transaction and redirects the user to the SP, where the SP consumes the assertion and decides whether to permit the user access.

Augmented design for a triple blinded identity system

To provide a user signature on a network transaction, a security server receives transaction information representing a transaction between a network user and a network site, such as a website, directly from the network site. The security server calculates a one-time-password based on the received transaction information and a secret shared by the security server and the network site, but not by the user. The security server transmits the calculated one-time-password for application as the user's signature on the transaction. The one-time-password is independently calculable by the network site based on the shared secret.

Method for secure user and transaction authentication and risk management

The present innovation extends the innovations inherent in our prior work on security and privacy enhanced geolocation to address specific problems of determining the proximity of two Internet connected devices. This could be used for applications such as determining proximity of a user's smartphone to an ATM machine they are using. Or to determine the physical proximity of a shopper and a cashier at a check out line. A straightforward application of the prior work will not suffice, as devices may have very different types of connectivity to the Internet. We solve this problem by placing reciprocal slave servers on each of the devices and giving high weight to the time taken for messages to travel from each device to the slave on the other device. The system can be extended to more than two entities by performing the calculation in a pairwise fashion and using further optimizations.

Proximity in privacy and security enhanced internet geolocation

Transaction authentication with techniques and geolocation are combined to provide privacy and security enhanced geolocation. In an example implementation, a user initiates a transaction at a web service which in turns triggers a security server. The security server uses its always on connection with the combined client on user security device to perform geolocation, proximity and transaction authentication. These results may be used by the web service to make a decision on whether to proceed with the transaction.

Enhancing transaction authentication with privacy and security enhanced internet geolocation and proximity

An Identity Exchange that communicates and processes data exchanged between Identity Providers (IdP) and Relying Partys (RP) remains blinded from the attribute values of the data flowing through it. To make this happen each IdP and RP are issued anonymous certificates by a Certificate Authority, using which they perform key exchange with each other to exchange session keys, which are used subsequently to encrypt/decrypt all attribute values they exchange via the Identity Exchange.

Triple blind identity exchange

Systems and methods for making a payment on behalf of a payer to a payee are provided. A request to make a payment on behalf of a payer to a payee is received at a first payment service provider. The first payment service provider supports a first payment network within a plurality of payment networks that each include a respective plurality of payers and payees. The payer is one of the plurality of payers and payees associated with the first payment network, and the payor is not one of the plurality of payers and payees associated with the first payment network. A second payment network within the plurality of payment networks with which the payee is associated is identified by the first payment service provider. A payment instruction to make the payment to the payee is transmitted by the first payment service provider to a second payment service provider associated with the second payment network.

Inter-network financial service

To validate a user's identity a network validation server receives a smartphone image of a preexisting user credential, including both a user biometric and a unique identifier associated with the credential and stores them in a database. The validation server also receives the unique identifier from a registrar network device seeking to validate the user, and in response transmits a validation code to the user's smartphone for display by the user's smartphone and/or the registrar's network device for display by the registrar's network device. The validation server additionally receives confirmation from the registrar's network device that a validation code displayed on the user's smartphone is the transmitted validation, thereby confirming that the user has been validated by the registrar.

Validating biometrics without special purpose readers

A method of operating a security server to securely transact business between a user and an enterprise via a network includes receiving, at the security server from an enterprise with which the user is currently connected via the network, a request of the enterprise to activate a secure communications channel over the network between the user and the security server. The request includes contact information for contacting the user via other than the network. The security server, in response, transmits an activation code for delivery to the user via other than the network and in a manner corresponding to the received contact information. The security server receives, from the user via the network, an activation code and compares the received activation code with the transmitted activation code to validate the received activation code. The secure communications channel is then activated based on the validation of the received activation code.

Enterprise triggered 2CHK association

A portable apparatus is removably and communicatively connectable to a network device to communicate authentication or authorization credentials of a user in connection with the user logging into or entering into a transaction with a network site. The apparatus includes a communications port to connect and disconnect the apparatus to and from the network device and to establish a communication link with the network device when connected thereto. A processor receives a secure message from the network security server via the port. The message has a PIN for authenticating the user to the network site, and is readable only by the apparatus. The processor either transfers, via the port, the received PIN to an application associated with the network site that is executing on the network device or causes the apparatus to display the received PIN for manual transfer to the application associated with the network site.

Key management using quasi out of band authentication architecture

A security server receives a request of a user to activate a secure communications channel over the network and, in response, transmits an activation code for delivery to the user via another network. The security server receives an activation code from the user network device via the network, compares the received activation code with the transmitted activation code to validate the received activation code, and activates the secure communications channel based on the validation. The security server next receives a query including a question for the user from an enterprise represented on the network, transmits the received enterprise query to the user network device via the secure communications channel, and receives, from the user network device via the secure communications channel, a user answer to the transmitted enterprise query. The security server then transmits the received user answer to the enterprise to further authenticate the user to the enterprise.

Enhanced 2CHK authentication security with query transactions

A network server is operated so as to facilitate legal eavesdropping by receiving, from the first user via a network, a session key (SK) encrypted with a second user's public key, k, and the SK encrypted with an escrow server's (ES) public key, k. The kkey is the public key of the second user asymmetric private/public key pair k/kThe kkey is the public key of the ES asymmetric private/public key pair k/k. The received SK encrypted with kis stored. The SK encrypted with kis transmitted to the second user via the network. A message encrypted with the SK is received from one of the first and the second users via the network, stored, and transmitted to the other of the first and the second users via the network.

Efficient encryption, escrow and digital signatures

The present invention provides a new method of site and user authentication. This is achieved by creating a pop-up window on the user's PC that is in communication with a security server, and where this communication channel is separate from the communication between the user's browser and whichever web site they are at. A legitimate web site embeds code in the web page which communicates to the security server from the user's desktop. The security server checks the legitimacy of the web site and then signals both the web page on the user's browser, as well as the pop-up window to which it has a separate channel. The security server also sends a random image to both the pop-up window and the browser. If user authentication is requested by the web site the user is first authenticated by the security server for instance by out of band authentication. Then the security server computes a one time password based on a secret it shares with the web site and sends it to the pop up window. The user copies this one time password into their browser which sends it to the web site, which can re-compute the one time password to authenticate the user.

Method for secure site and user authentication

Secure and efficient authentication using plug-in hardware compatible with desktops, laptops and/or smart mobile communication devices such as iPhones&#x2122;

Growing community of inventors

Half Moon Bay, CA, United States of America

Ravi Ganesan