Method and device for identification and authentication

• US 20020170960A1
• Filed: 05/15/2002
• Published: 11/21/2002
• Est. Priority Date: 02/18/2000
• Status: Active Grant

• Current Assignee: Jakob Ehrensvard, Stina Grip
• Original Assignee: Jakob Ehrensvard, Stina Grip
• Inventors: Grip, Stina, Ehrensvard, Jakob
• Granted Patent: US 6,616,035 B2
• Time in Patent Office: Days
• US Class Current: 235/380
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/105 involving programming of a portable memory device, e.g. IC cards, "electronic purses"
• CPC Class Codes: G06Q 20/1085 involving automatic teller machines [ATMs]
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A method and a device of identification and authentication of a holder of a mobile electronic transaction device in an electronic transaction process between a transaction service provider and a transaction terminal in communication via a computer network. The mobile electronic has transceiver means for transmitting information to and receiving information from the transaction terminal, data input means, data processing means, data storage means for storing information including an externally accessible device identity, a non-retrievable reference user identification, and including a non-retrievable secret key to be processed by the processing means and used in communication with the service provider by the transceiver means over the network via the transaction terminal for validating a transaction, and means supplying electric energy to the device. The transceiver means is adapted for transmitting the device identity to the transaction terminal and receiving a challenge transaction identifier from the service provider via the transaction terminal. The processing means is adapted for determining an authenticity of a user identification input by comparison with the reference user identification, and for performing a cryptographic transformation of the transaction identifier using the secret key only on the identification input being determined as authentic The transceiver means is also adapted for transmitting a response result of the cryptographic transformation to the service provider via the transaction terminal for validating the transaction.

Claims

1. A method of identification and authentication of a holder of a mobile electronic transaction device in an electronic transaction process between a transaction service provider and a transaction terminal in communication via a computer network, said mobile transaction device comprising transceiver means for transmitting information to and receiving information from said transaction terminal, data input means, data processing means, data storage means having information stored therein including an externally accessible device identity, a non-retrievable reference user identification, and including a non-retrievable secret key to be processed by said processing means and used in communication with the service provider by said transceiver means over said network via the transaction terminal for validating a transaction, and means supplying electric energy to the device, said method comprising:

transmitting the device identity to the transaction terminal;

transmitting a challenge transaction identifier to the device;

said holder entering a user identification input using said input means;

said processing means determining an authenticity of said identification input by comparison with said reference user identification; and

only on said identification input being determined as authentic;

said processing means performing a cryptographic transformation of the transaction identifier using said secret key; and

transmitting a response result of said cryptographic transformation to the service provider via said transaction terminal for validating said transaction.

2. The method of claim 1, comprising the holder entering said reference identification prior to a first time use of the transaction device.

3. The method of claim 1, comprising said transceiver means automatically communicating with the service provider on placing the device in close proximity to said transaction terminal.

4. A mobile electronic transaction device for identification and authentication of a holder of the device in an electronic transaction process between a transaction service provider and a transaction terminal in communication via a computer network, said mobile transaction device having contained therein:

transceiver means for transmitting information to and receiving information from said transaction terminal, data input means, data processing means, data storage means for storing information including an externally accessible device identity, a non-retrievable reference user identification, and including a non-retrievable secret key to be processed by said processing means and used in communication with the service provider by said transceiver means over said network via the transaction terminal for validating a transaction, and means supplying electric energy to the device;

wherein

said transceiver means being adapted for transmitting the device identity to the transaction terminal and receiving a challenge transaction identifier from the service provider via the transaction terminal;

said processing means being adapted for determining an authenticity of a user identification input by comparison with said reference user identification, and for performing a cryptographic transformation of the transaction identifier using said secret key only on said identification input being determined as authentic; and

said transceiver means also being adapted for transmitting a response result of said cryptographic transformation to the service provider via said transaction terminal for validating said transaction.

5. The device of claim 4, wherein said transceiver means comprises a first transceiver for communication with said service provider on placing the device in a proximity relationship to a second transceiver being part of said transaction terminal.

6. The device of claim 5, wherein said first and second transceivers forming respective first and second parts of an electric circuit, the first part being contained in the device and the second part being contained in the transaction terminal, said circuit being physically divided into said units in a an area defining a respective dielectricum of a plurality of capacitors connected in said circuit when said card is placed in said proximity relationship to the transaction terminal.

7. The device of claim 6, wherein said means supplying electric energy to the device is comprised in said first and second parts of said electric circuit.

8. The device of claim 4, wherein the device has a shape of a credit card.