US 11,917,069 B1
Methods and systems for secure user authentication
Ronald Chu, Los Angeles, CA (US); Mark Kogen, Torrance, CA (US); Warren Tan, Thousand Oaks, CA (US); Simon Ma, Torrance, CA (US); Yosif Smushkovich, Santa Monica, CA (US); Gerry Glindro, Carson, CA (US); and Jeffrey Nicholas, Los Angeles, CA (US)
Assigned to CITICORP CREDIT SERVICES, INC. (USA), Jacksonville, FL (US)
Filed by CITICORP CREDIT SERVICES, INC. (USA), Jacksonville, FL (US)
Filed on Jun. 29, 2023, as Appl. No. 18/216,515.
Application 18/216,515 is a continuation of application No. 17/845,954, filed on Jun. 21, 2022.
Application 17/845,954 is a continuation of application No. 15/677,894, filed on Aug. 15, 2017, granted, now 11,394,553.
Application 15/677,894 is a continuation of application No. 13/019,333, filed on Feb. 2, 2011, granted, now 9,768,963.
Application 13/019,333 is a continuation of application No. 11/789,054, filed on Apr. 23, 2007, granted, now 9,002,750.
Application 11/789,054 is a continuation in part of application No. 11/636,839, filed on Dec. 11, 2006, granted, now 7,904,946.
Claims priority of provisional application 60/784,970, filed on Mar. 22, 2006.
Claims priority of provisional application 60/749,230, filed on Dec. 9, 2005.
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/00 (2006.01); H04L 9/32 (2006.01)
CPC H04L 9/3228 (2013.01) 20 Claims
OG exemplary drawing
 
1. A computer-implemented method for secure user authentication, the method comprising:
receiving, by a validation server executing a one-time password (OTP) generator, a PIN from a user device associated with a user, wherein the PIN is not stored at the user device;
dynamically generating, by the validation server, a shared secret based upon the PIN received from the user device and personalized OTP data;
generating, by the validation server, an OTP based on the shared secret and one or more moving factors of the OTP generator, wherein the OTP has a time-sensitive expiration according to at least one moving factor;
presenting, by the validation server, the OTP for display on a graphical user interface for the user via a first channel;
receiving via a second channel, by the validation server, the OTP and a user credential associated with the user from a challenge website of a second server coupled to the validation server; and
responsive to the validation server determining that the user credential and the OTP received from the challenge web site is valid according to a record of the user stored in a non-transitory machine-readable storage media:
transmitting, by the validation server, access rights for the challenge web site of the second server for the user according to the record of the user.