Self Service Anywhere: Interactive Voice Response systems

In organizations where each network login ID is already associated with some unique numeric ID, the simple solution is to ask users to log into the IVR system by keying in their numeric ID on the telephone touch pad. Examples of such numeric ID include employee numbers, or home telephone numbers.

Alternately, if a user registration process will be used (e.g., to collect personal security question data for user authentication), then users may be asked to key in or select a new numeric personal identifier. An example might be the user’s driver’s license number. In this case, users will log into the IVR with their new numeric ID.

In some cases, numeric IDs are not available. This may happen if there are no existing numeric IDs available for all users, or if what numeric IDs exist are not correlated to network login IDs, or if a registration process is undesirable.

In these cases, users may be asked to log in by pressing the keys on their telephone marked with the letters and numbers of their network login ID. For example, the user smith01 would type 7648401.

Since the digit mapping of two different alpha-numeric login IDs may produce the same number (e.g., poguh01 also maps to 7648401), an IVR system that uses this technique must allow for number collisions, and ask the caller to select the correct ID when the entered number resolves to more than one alpha-numeric login ID.

You can change the profile and request attribute that is used as a source of users’ IVR IDs (the digits users enter to identify themselves to the IVR phone system). By default, the telephone keypad translations of users’ profile IDs are used as their IVR IDs. Phone Password Manager finds a users’ profile ID by searching on their "numid" and "altnumid".

The TPM ID ATTR option allows you to change the source of IVR IDs by specifying a new profile and request attribute. When TPM ID ATTR is in use, Phone Password Manager finds users’ profile IDs by searching on the specified attribute.

For example:

A simple process to authenticate users is to ask them to answer one or more security questions with numerical answers. Numerical security questions should have the following characteristics:

Here are a few examples of numerical security questions that meet the above criteria:

Since all of these may be acquired by a third party, it makes sense to use more than a single question, to randomize which questions are used for any given authentication session, and to lock out users who repeatedly fail to authenticate.

Using too few numerical security questions, or using data that is too easily acquired by an intruder, has the effect of reducing password strength on the network. Biometric voice print verification is a stronger technology.

You can set up one or more question sets for IVR systems that use touch-tone authentication. Users authenticate over the phone by keying in numerical answers to questions that you define in Bravura Pass .

Ensure that:

Learn more about adding question sets .

You can use Bravura Pass to facilitate an automated, reliable, secure and effective process to:

You can use Bravura Pass ’s Generate voice print enrollment PIN (PSI) module to reliably register voice print samples for all users. You can use this facility for new IVR deployments or for new users on existing systems.

Without Bravura Pass , IVR users are commonly provided with a short PIN via email, and are required to key in the PIN when they first register with the IVR system. This presents a security weakness: PINs are short, guessable, and sent via an insecure media (email).

Bravura Pass ’s Generate voice print enrollment PIN (PSI) module streamlines and increases the security of the registration process by requiring users to authenticate to receive a longer PIN that is only good for a single use, and expires after a definable period.

A user registers in the following way:

Bravura Security offers two options to customers who wish to enable telephone access to Bravura Pass :

Bravura Security offers a turn-key IVR option, Phone Password Manager , which uses touch-tone caller authentication, and leverages the Web-based Bravura Pass registration process to build user profiles for numeric security question authentication. This solution is tightly integrated with Bravura Pass, using the secure API.

Bravura Pass has an open interface specification, which allows other IVR biometric voice print authentication systems, such as Vocent, to leverage Bravura Pass for general enterprise password management.

See Phone Password Manager to learn how to set up Bravura Pass to work with the Phone Password Manager and voice print authentication systems such as Vocent.

Organizations with an existing IVR system may choose to continue to use an existing caller authentication process, or to strengthen it prior to activating self-service password reset.

The existing identification and authentication process may have to be replaced because it is not secure enough and would weaken password security if it enables self-service password reset.

To enable IVR users to authenticate and reset their own forgotten or locked-out passwords from a telephone:

See also