Transaction-Based Text Authentication With Merchant Guessability Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems are vulnerable to malicious users who can guess correct answers due to predetermined authentication questions, potentially revealing sensitive account information and allowing unauthorized access.
Innovation Solution
Implement a machine learning model to process free-form user responses to authentication questions, determining the guessability of merchants based on transaction data and geographic popularity, and adjust authentication scores accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If predetermined authentication questions are used, then authentication process is simple and fast, but security is weakened because malicious users can guess correct answers
Solution Approach 1:
The patent transforms static predetermined authentication questions into dynamic questions generated from the user's actual transaction history. The authentication questions adapt based on real transaction data, making them unpredictable to attackers while remaining answerable by the legitimate user. This dynamic generation resolves the contradiction by eliminating fixed patterns that malicious users could exploit.
Solution Approach 2:
The system changes the parameters of authentication questions from predetermined fixed values to dynamically generated values based on transaction attributes (merchant names, amounts, dates, locations). By changing the source material from static databases to dynamic transaction records, the system maintains simplicity for users while dramatically increasing security against guessing attacks.
2Ease of operation
If multiple-choice format is used for authentication questions, then user response is easy to provide, but malicious users can brute force authentication by guessing correct answers
Solution Approach 1:
The patent extracts the answer choices from a fixed predetermined set and replaces them with dynamically generated options based on the user's specific transaction history. By taking out the static multiple-choice structure and replacing it with context-specific questions about actual transactions, the system maintains ease of response while eliminating the brute force vulnerability inherent in fixed answer sets.
Solution Approach 2:
The system introduces transaction data as an intermediary between the authentication question and the answer choices. Instead of directly presenting fixed options, the system uses transaction history as a mediator to generate unique, context-specific questions for each authentication attempt, preventing malicious users from pre-computing or guessing answers.
3Ease of operation
If authentication questions are based on real transactions only, then user can easily answer from memory, but malicious users can use personal knowledge to guess answers
Solution Approach 1:
The system performs preliminary action by generating authentication questions from transaction data that occurs after the user's knowledge could potentially be compromised. By using recent transaction history and dynamically selecting questions after any potential data breach, the system ensures that even if malicious users obtain personal information, they cannot predict future authentication questions based on past transactions.
Solution Approach 2:
The patent implements periodic updates to authentication questions based on ongoing transaction activity. Instead of using fixed historical transactions, the system continuously generates new questions from recent transactions, ensuring that the authentication challenge evolves over time. This periodic regeneration prevents malicious users from using static personal knowledge to guess answers.
Data Source
AI summary
Methods, systems, and apparatuses are described herein for authenticating access to an account using questions which allow users to provide textual information about transactions conducted by an account. A machine learning model may be trained to predict the guessability of merchants. A request for access to an account may be received, and transaction data for that account may be received. An authentication question may be presented. For example, a user may be prompted to list places they have shopped recently. A user response comprising text data may be received. The text data may be processed to identify one or more merchants. If the one or more merchant(s) are represented in the transaction data, the machine learning model may be used to determine the guessability of the one or more merchants. An authentication score may be determined based on the guessability, and access to the account may be provided.