Patent Application
20180032722
The present invention relates to the security of user accesses of websites, applications and other computer elements.
Existing systems require a user logon and password. Typically, attempts to access are monitored by a web server or other provider without user involvement. An email or other notice may be sent to the user reporting activity that has the potential to be disruptive or a suspect transaction, and may require a password reset, freezing an account, etc. However, the user is typically not otherwise involved.
The present invention relates to involving the user on each access of a website, application or other computer element, and leveraging the user to enhance security.
In one embodiment, a Post widget (application or code snippet) is placed on a website login page on the user's browser or the login of an application. The Post widget will record access activity and report the activity to a remote Access Alert server. Upon each subsequent access, a pop-up display (whisper) will indicate to the user access history, such as recent successful or unsuccessful access activity. The user can then determine whether the access activity was his/her own (authorized), or unauthorized. The pop-up display can be color coded to convey information, such as red to indicate a possibly unauthorized access and green to indicate an authorized access.
In one embodiment, a Post widget is also placed on the user device to log device activation and access (e.g., device turn-on password) activity. This access activity is reported to the remote Access Alert server. The Access Alert server can combine both device and website/application access information for an alert sent to the user upon access of the device and/or website/application.
In one embodiment, for a site or account that provides for transactional activity, the transactional activity is also monitored and included in the reported activity. The activity and accesses of any related products can also be monitored, such as off line activity and transactions, as well as online activity. The activity of other entities, companies or products related to the same user can also be combined and displayed when the user is on the site or application of any one of a group of entities serving the same user.
In an alternate embodiment, Post widget 108 is maintained at website server 102 for additional security. Post widget 108 will monitor the success or failure of user logon, and other information, from server 102 and send a post message to Access Alert server 112. The post message will identify the event, the application and the user.
Alternately, or in addition, the Post widget can be added to the original logon page before the user enters the user name and password. The website server can determine the device corresponds to a registered user based on the device ID detected when the user accesses the website. In another embodiment, the Post widget is provided to the browser of every device which accesses the logon page of the website, including unauthorized access attempts. The Post command sends a message to Access Alert server 112, which then tries to match the device information or user name to a registered user.
In one embodiment, a Post widget/code snippet 114 is added to the device itself. Post widget 114 will detect when the user activates the device, and when the user unlocks the device with a device password. A post message is then sent to Access Alert server 112. Access Alert server 112 can combine the device and website access information into one alert message which is sent to the user computer 104 for display as a pop-up notification or whisper 116.
In one embodiment, the post widget is added to an application downloaded to the user's device. The application itself may require a password to open or access certain information. Also, the application may require a password to access a remote server for more information, synchronization, etc. Such access attempts will be monitored and reported by the post widget.
In one embodiment, Access Alert server 112 monitors multiple websites or entities where the user is registered or has an account. When the user is on a website, or accessing an application, of any one of the sites or entities registered with the Access Alert server, a notification can be provided regarding activity for other entities or sites. For example, multiple login alerts could be confirmed by a user as having updated all his/her passwords, or could indicate identity theft. The whisper could include information on other sites or entities, or a separate whisper could be provided for other sites or entities. Information in the whisper for a website or application could also be sent to other entities, or could be sent upon user action indicating the reported access or other activity may be unauthorized, such as changing a password by the user in response to a whisper.
In one embodiment, additional features can be added to a whisper, such as recent transactions or other user activity. The whisper can simply indicate that there is such activity, such as with a number, and the user can click on the whisper for more details.
In one embodiment, rather than a post widget, the website or entity provides an API or other access to the Access Alert server. The Access Alert server is provided log-in records maintained by the website or entity. Alternately, the website or entity can have a widget or program loaded that monitors the logins of users registered with the Access Alert server program, and pushes the log-in data to the Access Alert server, or other server or computer for collecting the data.
With every attempted login, successful or unsuccessful, the authentication process will write a “log” record to an appropriate server. That record will contain sufficient information for the system to capture (and associate with a consumer) the information. The data is written to a database (optimized for performance), with a record being inserted into the database. The system will determine if an updated whisper should be sent to the owner's primary device. In one embodiment, different devices can be associated with a user. Each time a user successfully logs onto his/her account the system will compare the device's thumb print (i.e. hardware, browser (version), operating software/version, and cookies present, etc.). Subsequent logins by a user will compare the device that was used to login, against a history of logins by the consumer with the device's thumb print. If this is the first time the device has been used to access (e.g. Account “123”) then it is assumed that this is a new device. If a known device attempts to login (and that device is associated to a single/limited number of UIDs) and the UID entered is NOT on file, that is also captured. Code snippet 114 causes a SOAP or Restful call that formats the data, according to the API and sends the data to the appropriate end point. The application embeds the snippet at appropriate places in order to achieve this desired effect.
Event information can include the following:
In one embodiment, other types of access information can be monitored. For example, electronic or remote access to a physical door lock can be monitored. The user can be a business owner, and the monitoring can be of all employee devices provided by the owner. In one embodiment, the types of actions monitored and posted can be customized by the user or the website or application owner.
In one embodiment, the devices can be identified by associating a common name during a registration process, or a user can be prompted the first time the device ID appears in an alert. For example, common names can be Mark's phone, Mark's tablet, wife's phone, den computer, etc. This allows quick and easy recognition of whether an access is authorized or not.
In one embodiment, if a red whisper is provided, the user can determine if the conditions that caused the red condition were OK (expected). To facilitate user review, the user is told if new actions/events caused the status to be moved to red again. Alternately, if it was red for valid reasons it can remain red for a period of time (e.g., the next 30 days), regardless of whether the user has indicated it is OK.
In one embodiment, depending upon the alert, various recommended actions can be presented to the user. For example, the user can be prompted to change a password, verify an account, or check recent activity or a bank balance. If the detected unauthorized access suggests a device may be compromised, an alert can be sent to another authorized and registered device associated with the user, or by other means (e.g., email, mobile text messages, IVR outbound calls, postal mail). A prompt to notify the website or application owner (e.g., the user's bank) can be provided.
In one embodiment, access alerts can provide other access related information, such as the last time an application or website was viewed or input provided, etc. This can be for actions subsequent to a logon (including profile updates, etc.), or for sites or applications that don't require a logon.
In one embodiment, a whisper 406 is used instead of whisper 404, on the side, instead of the top, and with less information. Any variety of placements, shapes and amounts of information can be used in various embodiments.
In one embodiment, a post is provided from every page for an access attempt, including unauthorized accesses. However, the access alerts are not sent to a device, web page or application where an unauthorized access is being attempted. Rather, the access alert will only be sent to a verified, registered user device.
In one embodiment, access alert summaries are sent to the web page server 102 of
As described, the inventive service may involve implementing one or more functions, processes, operations or method steps. In some embodiments, the functions, processes, operations or method steps may be implemented as a result of the execution of a set of instructions or software code by a suitably-programmed computing device, microprocessor, data processor, or the like. The set of instructions or software code may be stored in a memory or other form of data storage element which is accessed by the computing device, microprocessor, etc. In other embodiments, the functions, processes, operations or method steps may be implemented by firmware or a dedicated processor, integrated circuit, etc.
It should be understood that the present invention as described above can be implemented in the form of control logic using computer software in a modular or integrated manner. Based on the disclosure and teachings provided herein, a person of ordinary skill in the art will know and appreciate other ways and/or methods to implement the present invention using hardware and a combination of hardware and software.
Any of the software components or functions described in this application may be implemented as software code to be executed by a processor using any suitable computer language such as, for example, Java, C++ or Perl using, for example, conventional or object-oriented techniques. The software code may be stored as a series of instructions, or commands on a computer-readable medium, such as a random access memory (RAM), a read-only memory (ROM), a magnetic medium such as a hard-drive or a floppy disk, or an optical medium such as a CD-ROM. Any such computer-readable medium may reside on or within a single computational apparatus, and may be present on or within different computational apparatuses within a system or network.
While certain exemplary embodiments have been described in detail and shown in the accompanying drawings, it is to be understood that such embodiments are merely illustrative of and not intended to be restrictive of the broad invention, and that this invention is not to be limited to the specific arrangements and constructions shown and described, since various other modifications may occur to those with ordinary skill in the art.
This application claims the benefit of U.S. Provisional Patent Application No. 62/368,405 filed Jul. 29, 2016, entitled “Visual Access Alert System”, the disclosure of which is hereby incorporated herein by reference in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| 62368405 | Jul 2016 | US |
