Identifying persons seeking access to computers and networks

• US 20040088551A1
• Filed: 01/06/2003
• Published: 05/06/2004
• Est. Priority Date: 07/05/2000
• Status: Abandoned Application

• Current Assignee: Cellusafe Incorporated
• Original Assignee: Cellusafe Incorporated
• Inventors: Dor, Erez, Drach, Zipora Dorit
• Application Number:
  US10/332,256
• Publication Number:
  US 20040088551A1
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

Method and apparatus for verifying the identity of a person seeking access to a computer, whether directly or thorough a digital network, including the Internet or to some data within the computer or a facility provided by it. The basic principle of the invention is to carry out such identification automatically by means of the person'"'"'s cellular telephone, connected through a suitable adapter, to the computer with which he physically interacts. Also disclosed are means for increasing the security of the identification and the manner of using the method in a variety of applications, including approval of credit-account transactions.

Claims

1. A method for verifying the identity of a person seeking to gain access to a local computer, to any computer communicative therewith or to any facility accessible through any of these computers, the method comprising:

(i) Providing a cellular telephone, to be termed cell-phone, associated with a cellular network and registered to the person or legitimately in the person'"'"'s possession, the cell-phone having at least one reference number stored therein;

(ii) Providing a direct communication link between said cell-phone and the local computer, the link possibly including an adapter;

(iii) Storing in any of the computers copies of one or more reference numbers stored in said cell-phone;

(iv) Reading any of the reference numbers stored in said cell-phone, comparing it with the corresponding one of said stored numbers and accordingly verifying the identity of the person.

2. The method of claim 1, wherein in step (ii) said communication link includes a wireless link.

3. The method of claim 1, wherein in step (ii) said communication link includes an adapter.

4. The method of any of claims 1-3, wherein one of the reference numbers is the unique hardware number of the cell-phone.

5. The method of any of claims 14, wherein one of the reference numbers is the call number of the cell-phone.

6. The method of any of claims 1-5, wherein the cell-phone has data storage memory and one of the reference numbers is any number or word stored in said memory.

7. The method of any of claims 1-6, wherein said communication link in step (ii) includes an adapter that includes at least one security means.

8. The method of claim 7, wherein said security means includes a number stored in said adapter, and further comprising:

(v) storing an adapter-identifying number in any of the computers;

(vi) reading said stored number from said adapter and comparing it with the number stored in step (v).

9. The method of claim 7 or 8, wherein said identification numbers stored in step (iii) are encrypted versions of the corresponding reference numbers, said security means includes an encryption module and step (iv) includes encrypting said any read reference number by means of said encryption module.

10. The method of any of claim 7-9, wherein said security means includes a lock that affects the communication between said cellular telephone and the local computer, and further comprising:

(vii) unlocking said lock be by the person before step (iv) can be carried out.

11. The method of any of claims 1-10, further comprising detecting whether step (iv) is being performed and, if affirmative, making a note, issuing a warning or signaling accordingly.

12. The method of any of preceding claims, wherein the local computer is a non-portable computer.

13. The method of any of the preceding claims, wherein the local computer is a portable computer.

14. The method of any of the preceding claims, wherein said reading of any reference number occurs through said communication link between said cellular telephone and the computer.

15. The method of any of the preceding claims, further comprising:

(viii) providing a telephone connection between the local computer and a dial-up network, the connection being associated with a dialing number;

and wherein step (iv) includes;

(a) sending a signal from the local computer to said cell-phone that causes the cell-phone to initiate a call to said dialing number, thereby causing at least one reference number stored in the cell-phone to be read out and transmitted over the cellular system;

(b) Receiving a call over said telephone connection;

(c) extracting from the received call any transmitted reference number.

16. The method of claim 15, wherein the received call is not answered.

17. The method of claim 16, wherein substep (a) of step (iv) includes manual intervention by the person, the intervention selected from among (1) pressing one or more buttons on said cell-phone, (2) pressing one or more keys on a keyboard of the local computer, (3) clicking on one or more locations on the display of the local computer.

18. The method according to any of claims 1-13 for verifying the identity of a person seeking to gain access through a local computer to any remote computer communicative therewith through a network, or to any facility accessible through the remote computer, the remote computer being termed a target computer, the method further comprising:

(ix) providing one or more telephone connections between any remote computer and a dial-up telephone network said remote computer being termed a response computer, the response computer being communicative with the local computer through the network and being communicative, or identical, with the target computer, and each of said telephone connections being associated with a dialing number; and

(x) transmitting one or more numbers, corresponding to said dialing numbers, to the local computer;

and wherein in step (iii) said storing includes storing in the response computer and step (iv) includes;

(d) sending a signal from the local computer to said cell-phone that causes the cell-phone to dial any of said dialing numbers of step (x), this operation initiating a call and causing at least one reference number stored in the cell-phone to be read and transmitted over the cellular system; and

(e) the response computer receiving the call initiated in substep (d) and extracting therefrom any transmitted reference number.

19. The method of claim 18, wherein in substep (e) the received call is not answered.

20. The method of claim 18, wherein steps (x) and (iv) are repeated periodically.

21. The method of claim 18, further comprising:

(xi) storing in the response computer one or more expected geographic locations of said cell-phone; and

(xii) obtaining the geographic location of said cell-phone and comparing it with said stored locations.

22. The method of claim 21, wherein the cellular system is capable of geographically locating any communicating cell-phone and in step (xii) said obtaining includes obtaining the location of said cell-phone from the cellular system.

23. The method of claim 21, wherein said cell-phone is equipped to sense its geographic location by means of a satellites-based system and in step (xii) said obtaining includes obtaining from said cell-phone its thus sensed location.

24. The method of claim 21, further including:

(xiii) providing at any of said expected locations one or more sensors for sensing radiation from said cell-phone and extracting therefrom its call number;

and wherein in step (xii) said obtaining includes obtaining from any of said sensors an indication as to the presence of said cell-phone at the corresponding location.

25. The method of any of claims 18-21, wherein in step (ix) there are provided a plurality of telephone connections and step (x) includes selecting said one of said dialing numbers from among all possible ones.

26. The method of claim 25, wherein in step (x) said transmitting is over the digital network or over the cellular system and said cell-phone.

27. The method of claim 25, wherein said transmitted numbers are not displayed and not retrievable.

28. The method of claim 25, wherein in step (x) the transmitted number is an encrypted version of the corresponding dialing number, the encryption key being specific to the person or to the local computer, and wherein substep (d) of step (iv) includes decrypting the transmitted number, to obtain said dialing number.

29. The method of claim 28, wherein said communication link in step (ii) includes an adapter and said decrypting is performed within said adapter.

30. The method of claim 28, wherein said decrypting is performed within said cell-phone.

31. The method of any of claims 18-30, further cooperating with any other security system

32. The method of any of claims 18-31, wherein the facility accessible through the target computer is a data-base management system or provision of a service, including an information service, or provision of an intellectual property.

33. The method of any of claims 18-32, wherein the response computer is identical to, or locally connected with, the target computer.

34. The method of claim 33, wherein the network is an open network, including the Internet, and the facility accessible through the target computer is e-mail authentication, the method further comprising receiving an e-mail message from the local computer, inserting into the received message a mark that certifies the person as being the originator and sending the message on.

35. The method of claim 34, wherein step (x) includes storing said transmitted numbers in the local computer.

36. The method of claim 33, wherein the network is an open network, including the Internet, and wherein steps (x) and (iv) are performed with respect to any person seeking access to the target computer after the target computer has sensed a massive attack on itself.

37. The method of claim 33, wherein the facility accessible through the target computer is digital signature authentication, the method further comprising receiving a document from the local computer and inserting into the document an indelible mark that certifies the person as being a signer of the document.

38. The method of claim 37, further comprising sending the document to another local computer for similar authentication.

39. The method of claim 33, wherein the facility accessible through the target computer is document delivery attestation, the method further comprising:

(xiv) receiving a document from a source;

(xv) sending said document to the local computer; and

(xvi) sending a corresponding delivery affirmation note to said source;

whereby step (xvi) is performed after step (iv).

40. The method of any of claims 18-32, wherein the facility accessible through the target computer is provision of an intellectual property, to be transmitted as a data package to the local computer, the method further comprising inserting into the data package an indelible identification number that uniquely corresponds to the identity of the person or to a registered number of said cell-phone.

41. The method of any of claims 18-32, wherein the network is an open network, including the Internet.

42. The method of claim 41, wherein the facility accessible through the target computer is selected from—

accessing a personal account managed by a commercial, medical or governmental organization,

using a restricted-access service, including a pre-paid service, and participation in a chat group.

43. The method of claim 41, wherein said response computer is distinct from said target computer and is associated with a mediation service.

44. The method of claim 43, wherein the facility accessible through the target computer is vending of merchandise or service and said mediation service is handling of credit-account transactions.

45. The method of claim 44, further comprising:

(xvii) sending transaction-related data from the target computer to the local computer and to the response computer;

(xviii) sending transaction-related data from the local computer to the response computer;

(xix) comparing between any of the data received by the response computer in steps (xvii) and (xviii) and between said received data and any stored credit-account data related to the person, to yield an approval verdict;

(xx) sending said approval verdict to the target computer and to the local computer.

46. The method of claim 44 or 45, further comprising:

(xxi) providing within the response computer a limited-access storage;

(xxii) transmitting transaction-related data from the local computer, over said cell-phone, the cellular network and said dialed telephone connection, to the response computer;

(xxiii) storing data transmitted in step (xxii) in said limited-access storage.

47. The method of claim 46, wherein the data transmitted in step (xxii) and stored in step (xxiii) includes data representing oral words spoken by the person.

48. The method of any of claims 43-47, whereby no credit-account numbers and/or no data identifying the person is communicated to the target computer.

51. The method of claim 33, wherein the facility accessible through the target computer is an auction and the person is a seller, who offers an item for sale through the facility, or a buyer, who submits a bid for an item offered for sale through the facility, the method further comprising storing at the target computer, in association with the person'"'"'s identity, if a seller—

any data related to the item, or, if a buyer—

any bid submitted by the person for the item.

85. The method of claim 33, wherein the facility accessible through the target computer is approval of credit-account transactions, the local computer is located at a place of business and the person is a customer who seeks the access in order to gain approval of payment through his credit account for a transaction at the place of business.

86. The method of claim 85, wherein there is also data from the person'"'"'s credit card sent to the target computer and the decision on the approval of payment is based, inter alia, on said comparison in step (iv) and on said data from the credit card.

92. For use in any of the method claims 15-17—

steps (iii), (viii) and substeps (b) and (c) of step (iv).

93. For use in any of the method claims 18-52—

steps (iii), (ix), and (x) and substep (e) of step (iv).

94. For use in any of the method claims 21-51—

steps (xi) and (xii).

49. The method of any of claims 4348, wherein the target computer is associated with a corporate entity, the method further comprising:

(xxiv) authenticating the identity of the corporate entity, associated with the target computer, with respect to the response computer;

(xxv) sending to the local computer a corroboration of the identity of the corporate entity.

50. The method of claim 49, wherein in step (xxiv) said authenticating includes:

(a) Providing a cell-phone, associated with a cellular network and registered to the corporate entity, the cell-phone having at least one reference number stored therein;

(b) Providing a direct communication link between said cell-phone and the target computer, the link possibly including an adapter;

(c) Storing in the response computer copies of one or more reference numbers stored in said cellular telephone;

(d) Reading any of the reference numbers stored in said cell-phone and comparing it with the corresponding one of said stored numbers.

52. A method for verifying the identity of a person seeking to gain access through a local computer to any remote computer communicative therewith through a network, or to any facility accessible through the remote computer, the method comprising:

(viii) Providing a cellular telephone, to be termed cell-phone, associated with a dial-up cellular network and registered to the person or legitimately in the person'"'"'s possession, the cell-phone having at least one reference number stored therein;

(ix) Providing a direct communication link between said cell-phone and the local computer;

(x) providing at any remote computer one or more dial-up telephone connections, said remote computer being termed a response computer, the response computer being communicative with the local computer through the network,

(xi) Storing in the response computer copies of one or more reference numbers stored in said cell-phone;

(xii) causing the local computer to command said cell-phone, through said link, to initiate a call to any of said telephone connections and to thereby cause at least one reference number stored in the cell-phone to be read out and transmitted;

(xiii) the response computer receiving the call initiated in step (v) and extracting therefrom any transmitted reference numbers; and

(xiv) comparing any reference number extracted in step (vi) with the corresponding one of said stored numbers and accordingly verifying the identity of the person.

53. An access controlled computer—

directly linkable to a cellular telephone that has at least one reference number stored therein, the link possibly including an adapter;

having stored therein copies of one or more of said reference numbers; and

configured to automatically obtain from a cell-phone linked thereto any reference numbers stored therein, to compare it with said stored copies and accordingly to verify the identity of a person seeking to gain access to the computer or to any computer communicative therewith or to any facility accessible through any of these computers.

54. The computer of claim 53, one of said reference numbers being the unique hardware number of the cell-phone.

55. The computer of claim 53 or 54, one of said reference numbers being the call number of the cell-phone.

56. The computer of any of claims 53-55, being linkable to a cellular telephone through an adapter, which has a number permanently stored therein;

the computer having an adapter-identifying number stored therein and being further configured to automatically retrieve the number stored in said adapter and to compare it with said adapter-identifying number.

57. The computer of claim 53, connectable to a dial-up telephone network, the connection being associated with a dialing number, and being further configured—

to automatically send a signal to any linked cell-phone, such that will initiate a call to said dialing number, thereby causing at least one reference number stored in the cell-phone to be read out and transmitted over the cellular system with which it is in communication; and

to receive a call from said telephone network and to extract therefrom any transmitted reference number of the cell-phone.

58. A local computer for controllably accessing any remote computer communicative therewith through a network, or any facility accessible through the remote computer, the local computer being—

directly linkable to a cellular telephone that has at least one reference number stored therein, the link possibly including an adapter, and

configured to obtain a dialing number from a remote computer and to automatically send a signal to any linked cell-phone, such that will initiate a call to said dialing number, thereby causing at least one reference number stored in the cell-phone to be read and transmitted over the cellular system with which it is in communication.

59. The computer of claim 58, being linkable to a cellular telephone through an adapter, which has a number permanently stored therein;

the computer having an adapter-identifying number stored therein and being further configured to automatically retrieve the number stored in said adapter and to compare it with said adapter-identifying number.

60. An access controlling computer, connectable to a digital network and having one or more telephone connections to a dial-up telephone network, each telephone connection being associated with a dialing number, the computer being configured—

to communicate with any other computer, termed “

requesting computer”

, on the digital network about gaining access by a requesting person through the requesting computer to any computer on the network or to any facility provided thereby;

to store copies of cellular reference numbers and other data pertaining to persons having permission to access any computer on the network or to access or use any facility provided thereby; and

to receive a call over any of the telephone connections, to check whether the call originated from a cellular telephone, to extract therefrom any reference number transmitted from the cellular telephone, to compare any such extracted number with said stored copies and to accordingly verify the identity of said requesting person.

61. The access controlling computer of claim 60, being further configured to store acceptable cellular locations in association with said data pertaining to persons, to extract from said received call location data provided by the cellular system and to compare such location data with said stored cellular locations.

62. The computer of claim 60 or 61, being further configured to select any one of said dialing numbers, to encrypt it and to send it to the requesting computer.

63. The access controlling computer of any of claims 60-62, wherein said any facility includes a data-base management system or provision of a service, including an information service, or provision of an intellectual property.

64. The access controlling computer of any of claims 60-62, wherein said any facility includes a document authentication function, the computer being further configured to receive a document from a person through the requesting computer and to insert into the document an indelible mark that certifies the person as being a signer of the document.

65. The access controlling computer of any of claims 60-62, wherein said any facility includes provision of an intellectual property, to be transmitted as a data package to the requesting computer, for use by a person, the computer being further configured to insert into the data package an indelible identification code that uniquely corresponds to the identity of the person.

66. The access controlling computer of any of claims 60-65, also comprising, or being communicative with, a security management facility and being further configured to coordinate any of the claimed functions with said security management facility.

67. The access controlling computer of any of claims 60-65, wherein the digital network is an open network, including the Internet.

68. The access controlling computer of claim 67, wherein said any facility includes e-mail authentication, the computer being further configured to receive an email message from a person through the requesting computer, to insert therein an indelible mark that certifies the person as being the originator and sending the message on.

69. The access controlling computer of claim 67, wherein said any facility includes auction management over the network, the computer being further configured to receive from the requesting computer data about an item offered to be auctioned or a bid for an item being auctioned and to store any of them in association with identification data or with a cell-phone reference number.

70. The access controlling computer of claim 67, wherein said any facility includes handling of credit-account transactions, the computer being further configured to receive, with respect to any transaction conducted over the network between a person at the requesting computer and any vending node, data pertaining to the transaction from both the requesting computer and the vending node and to use the received data, as well as the stored data pertaining to the person, in the process of approving the transaction to the vending node.

71. The access controlling computer of claim 70 comprising a limited-access storage and further configured to receive data pertaining to the transaction from the requesting computer over any of said telephone connections and to store any such data in said limited-access storage.

72. The access controlling computer of claim 71 wherein the data received over the telephone connection and stored in the limited-access storage includes data representing oral words spoken by the requesting person.

73. The access controlling computer of any of claims 70-72, the vending node

being associated with a corporate entity, the computer being further configured to store cellular vendor reference numbers and other data pertaining to the corporate entity associated with the vending node;

to send a dialing number, or an encrypted version thereof, to the vending node; and

to receive a call over the telephone connection associated with said dialing number, to check whether the call originated from a cellular telephone, to extract therefrom any reference number transmitted from the cellular telephone, to compare any such extracted number with said stored cellular vendor reference numbers and to use the results of the comparison in corroborating the authenticity of the corporate entity to the requesting computer.

74. The access controlling computer of claim 67, wherein said any facility includes site authentication and the requesting computer is associated with a corporate entity, the access controlling computer being further configured to send to any other node a corroboration of the authenticity of the corporate entity.

75. An adapter, operative to transmit data between a computer and a cell-phone, comprising at least one security means.

76. The adapter of claim 75, wherein said security means includes a number permanently stored in the adapter and readable from the computer.

77. The adapter of claim 75, wherein said security means includes a lock that affects the data transmission between the cellular telephone and the computer.

78. The adapter of claim 77, wherein the means of unlocking said lock is selectable from a group including—

a password code sent from the computer,

a password code entered manually into a keypad on the adapter,

a card readable by the lock or by any other component of the adapter,

a key physically interacting with the lock or with any other component of the adapter.

79. The adapter of claim 75, wherein said security means includes a decryption means, operative to decrypt any data transmitted from the computer to the cell-phone or to encrypt any data sent from the cell-phone to the computer.

80. The adapter of claim 79, wherein said decryption means is operative to decrypt any dialing number transmitted to the cell-phone.

81. A controller, connectable to a computer, termed response computer, that is, in turn, connectable to a computer network, there being linked to any other computer connected to the network at least one cellular telephone, communicative with a cellular network and having one or more reference numbers stored therein which are readable during a call dialed therefrom, said response computer having one or more telephone connections to a dial-up telephone network, each telephone connection being associated with a dialing number, the controller being operative—

to receive a call over any one of the telephone connections,

to check whether the call originated from a cellular telephone and to extract therefrom any reference number transmitted from the cellular telephone, and

to convey any extracted reference number to said response computer.

82. The controller of claim 81, being further operative to extract from said received call location data provided by the cellular system.

83. The controller of claim 81 or 82, being further operative to select any of said dialing numbers, to encrypt it and to cause it to be sent to another computer on the digital network.

84. An access controlled digital system, comprising a plurality of computers,

inter-connected by a network, and one or more telephone lines, connected to a dial-up telephone network, each line being associated with a dialing number;

at least one of the computers being a requesting computer, operated by a requesting person, and at least one of the computers being a responding computer;

each responding computer being connectable to one or more of said telephone lines and being operative—

to store cellular reference numbers and other data pertaining to persons having permission to access said responding computer or to access or use any facility provided therein,

to select a dialing number corresponding to one of said lines, to send it to any requesting computer with which it communicates, and

to receive a call over the telephone connection associated with said selected dialing number, to check whether the call originated from a cellular telephone, to extract therefrom any reference number transmitted from the cellular telephone, to compare any such extracted number with said stored cellular reference numbers and to accordingly verify the identity of said requesting person; and

each requesting computer being connectable to a cellular telephone, either directly or through an adapter, and configured—

to obtain a dialing number from a responding computer with which it communicates and

to automatically send a signal to any linked cell-phone, such that will cause the cell-phone to dial said dialing number, thereby causing at least one reference number stored in the cell-phone to be read and transmitted over the cellular system with which it is in communication.

87. A method for approving a credit account payment by a person for a transaction at a place of business, the approval being by a remote approval agency that is associated with a computer, the method comprising:

(xv) Providing a cell-phone, associated with a cellular network and registered to the person or legitimately in the person'"'"'s possession, the cell-phone having at least one reference number stored therein;

(xvi) Storing in the computer, in association with other data related to the person, one or more identification numbers corresponding to reference numbers stored in said cellular telephone;

(xvii) providing one or more telephone connections between the computer and a dial-up telephone network each of said telephone connections being associated with a dialing number;

(xviii) dialing one of said dialing numbers of step (xxviii) by said cell-phone, this operation initiating a call and causing at least one reference number stored in the cell-phone to be read and transmitted over the cellular system;

(xix) the computer receiving the call initiated in step (xxix) and extracting therefrom any transmitted reference number;

(xx) retrieving from the computer'"'"'s storage any one of said identification numbers that corresponds to the number extracted in step (xxx), together with any of said associated data, and using said retrieved data in the process of approval.

88. The method of claim 87, further comprising communicating the number to be dialed in step (xxix) from the computer or the agency to the person.

89. The method of claim 88, wherein said communicating is by means of said cell-phone.

90. The method of claim 87, wherein the number to be dialed in step (xxix) is displayed at the place of business.

91. The method of claim 90, wherein the place of business is a vending machine that has a keyboard, the method further comprising:

(xxi) communicating a code from the computer or the agency to the person by means of said cell-phone;

(xxii) the person keying said code into the keyboard of the vending machine.