Facilitating And Authenticating Transactions

• US 20070226805A1
• Filed: 10/09/2003
• Published: 09/27/2007
• Est. Priority Date: 10/17/2002
• Status: Active Grant

• Current Assignee: David Jeal, George Stronach
• Original Assignee: David Jeal, George Stronach
• Inventors: Stronach, George, Jeal, David
• Granted Patent: US 8,825,928 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06K 7/10237 the reader and the record carrier being capable of selectively switching between reader and record carrier appearance, e.g. in near field communication [NFC] devices where the NFC device may function as an RFID reader or as an RFID tag
• CPC Class Codes: G06Q 20/1235 with control of digital rights management [DRM]
• CPC Class Codes: G06Q 20/305 using wired telephone networks
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/3552 Downloading or loading of personalisation data
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 20/40975 using encryption therefor
• CPC Class Codes: G07F 7/0886 the card reader being portable for interacting with a POS or ECR in realizing a payment transaction
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

A device or “dongle” (30) is provided for controlling communications between a Subscriber Identity Module (or SIM) (12), such as of the type used in a GSM cellular telephone system, and a computer, such as a Windows-based PC (10). The SIM (12) can be authenticated by the telephone network, in the same way as for authenticating SIMs of telephone handset users in the network, and can in this way authenticate the user of the PC (10) or the PC (10) itself. Such authentication can, for example, permit use of the PC (10) for a time-limited session in relation to a particular application which is released to the PC (10) after the authentication is satisfactorily completed. The application may be released to the PC (10) by a third party after and in response to the satisfactory completion of the authentication process. A charge for the session can be debited to the user by the telecommunications network and then passed on to the third party. The dongle (30) provides additional security for the authentication data stored on the SIM by requiring a PIN to be entered and/or by only being responsive to requests received from the PC (10) which are encrypted using a key, which requests are generated by a special PC interface driver (38). The PIN may be stored only temporarily. The dongle (30) has an electrical connector (34), and means may be provided for selectively rendering the connector (34) available for coupling to the PC (10).

Claims

1. A device for connection to a data processing apparatus, the device including:

first coupling means for operative coupling to authentication storage means storing predetermined information relating to the authentication of a transaction with the data processing apparatus;

second coupling means for operative coupling to the data processing apparatus, the device when operatively coupled to the data processing apparatus being responsive to an authentication process carried out via a communications link for authenticating the transaction, the authentication process involving the use of the predetermined information;

and security data entry means for obtaining security data independently of the data processing apparatus; and

means for storing the security data temporarily.

2. The device of claim 1, wherein the security data is stored temporarily by means of a transient power source.

3. The device of claim 2, wherein the transient power source comprises piezo electric means.

4. The device of claim 3, wherein the piezo electric means comprises one or more piezo electric cells.

5. The device of claim 2, wherein the transient power source is charged by the security data entry means.

6. The device of claim 2, wherein the transient power source comprises a rechargeable battery.

7. The device of claim 1, comprising means for analysing the entered security data for determining whether to allow access to the predetermined information.

18. The device of claim 1, wherein the device controls access to the predetermined information.

19. The device of claim 1, wherein the security data entry means comprises alphanumeric data entry means.

20. The device of claim 1, wherein the security data entry means comprises a keypad.

21. The device of claim 1, wherein the security data comprise a Personal Identification Number (PIN) and analysing means compares the PIN obtained by the security data means with a PIN stored on the authentication storage means and only allows access to the predetermined information when the respective PINs match.

22. The device of claim 1, comprising a display for displaying security information.

23. The device of claim 1, comprising a data processing module for controlling the communication with the data processing apparatus.

24. The device of claim 23, wherein the data processing module of the device is configured for communicating with a corresponding data processing module of the data processing apparatus.

25. The device of claim 24, wherein communication between the authentication storage means and the data processing apparatus is performed via the respective data processing modules.

26. The device of claim 23, wherein the data processing module of the device includes means for decrypting encrypted data received from the data processing module of the data processing apparatus.

27. The device of claim 23, wherein the data processing module of the device includes means for encrypting data transmitted to the data processing module of the data processing apparatus.

28. The device of claim 26, wherein the data processing module of the device comprises a key for allowing decryption of data.

29. The device of claim 28, wherein the key comprises a shared secret key for each of the respective data processing modules.

30. The device of claim 1, wherein the device is operatively coupleable to one of more of a plurality of said authentication storage means, each of which is registerable with a common telecommunication system, and wherein the authentication process is performed by a communications link with the telecommunications system.

31. The device of claim 30, in which the predetermined authentication information stored by each authentication storage means corresponds to information which is used to authenticate a user of that authentication storage means in relation to the telecommunications system.

32. The device of claim 31, in which each user is authenticated in the telecommunications system by means of the use of a smart card or subscriber identity module, and in which the authentication storage means respective to that user corresponds to or simulates the smart card for that user.

33. The device of claim 1, in which the transaction is a transaction involving use of data processing functions of the data processing apparatus.

34. The device of claim 1, in which the authentication storage means is specific to that device.

35. The device of claim 1, in which the authentication process involves the sending of a message and the generation of a response dependent on the message and the predetermined information.

36. The device of claim 30, wherein the telecommunications system includes means for levying a charge for the transaction when authorised.

37. The device of claim 1, wherein the security data entry means comprises a rotary knob.

38. The device of claim 1, in combination with the data processing apparatus.

39. The device of claim 1, in combination with the telecommunications system.

40. The device of claim 1, wherein the authentication storage means communicates wirelessly to authenticate the transaction.

41. The device of claim 1, wherein the authentication storage means (12) comprises a subscriber identity module which authenticates the transaction when the subscriber identity module is operable in a mobile terminal.

42. The device of claim 30, wherein the authentication storage means (12) comprises a subscriber identity module which is further operable to authenticate a mobile terminal for use in the system.

8. A device for connection to a data processing apparatus, the device including:

first coupling means for operative coupling to authentication storage means storing predetermined information relating to the authentication of a transaction with the data processing apparatus;

second coupling means for operative coupling to the data processing apparatus, the device when operatively coupled to the data processing apparatus being responsive to an authentication process carried out via a communications link for authenticating the transaction, the authentication process involving the use of the predetermined information; and

configuration means for selectively rendering the second coupling means available for coupling to the data processing apparatus.

9. The device of claim 8, wherein the configuration means comprises means for selectively making the second coupling means available externally of the device housing.

10. The device of claim 9, wherein the configuration means comprises a removable cap.

11. The device of claim 9, wherein the configuration means comprises a closure member coupled to and moveable with respect to the housing for selectively closing an aperture in the housing.

12. The device of claim 11, comprising interconnection means for connecting the closure member and the second coupling means, the arrangement being such that, as the closure member is moved to open the aperture, the second coupling means emerges from the aperture.

13. The device of claim 8, comprising a knob mounted on the device housing for rotation with respect thereto, and means for converting rotation of said knob into linear movement of the second coupling means such that rotation of said knob in a first direction causes the second coupling means to emerge from an aperture in the device housing and rotation of said knob in a second direction causes the second coupling means to be retracted through said aperture.

14. The device of claim 9, wherein the device housing includes two parts moveable with respect to one another between a first arrangement where the second coupling means is contained within the housing and a second arrangement where the second coupling means is exposed for connection to the data processing apparatus.

15. The device of claim 14, wherein the two parts are pivotally coupled together.

16. The device of claim 8, comprising security data entry means for obtaining security data independently of the data processing apparatus, and means for analysing the entered security data for determining whether to allow access to the predetermined information.

17. The device of claim 8, comprising security data entry means (276;

296) for obtaining security data independently of the data processing apparatus; and

means for storing the security data temporarily.

43. The device of claim 8, wherein the device controls access to the predetermined information.

44. The device of claim 16, wherein the security data entry means comprises alphanumeric data entry means.

45. The device of claim 16, wherein the security data entry means comprises a keypad.

46. The device of claim 16, wherein the security data comprise a Personal Identification Number (PIN) and analyzing means compares the PIN obtained by the security data means with a PIN stored on the authentication storage means and only allows access to the predetermined information when the respective PINs match.

47. The device of claim 8, comprising a display for displaying security information.

48. The device of claim 8, comprising a data processing module for controlling the communication with the data processing apparatus.

49. The device of claim 48, wherein the data processing module of the device is configured for communicating with a corresponding data processing module of the data processing apparatus.

50. The device of claim 48, wherein communication between the authentication storage means and the data processing apparatus is performed via the respective data processing modules.

51. The device of claim 48, wherein the data processing module of the device includes means for decrypting encrypted data received from the data processing module of the data processing apparatus.

52. The device of claim 48, wherein the data processing module of the device includes means for encrypting data transmitted to the data processing module of the data processing apparatus.

53. The device of claim 52, wherein the data processing module of the device comprises a key for allowing decryption of data.

54. The device of claim 53, wherein the key comprises a shared secret key for each of the respective data processing modules.

55. The device of claim 8, wherein the device is operatively coupleable to one of more of a plurality of said authentication storage means, each of which is registerable with a common telecommunication system, and wherein the authentication process is performed by a communications link with the telecommunications system.

56. The device of claim 55, in which the predetermined authentication information stored by each authentication storage means corresponds to information which is used to authenticate a user of that authentication storage means in relation to the telecommunications system.

57. The device of claim 56, in which each user is authenticated in the telecommunications system by means of the use of a smart card or subscriber identity module, and in which the authentication storage means respective to that user corresponds to or simulates the smart card for that user.

58. The device of claim 8, in which the transaction is a transaction involving use of the data processing functions of the data processing apparatus.

59. The device of claim 8, in which the authentication storage means is specific to that device.

60. The device of claim 8, in which the authentication process involves the sending of a message and the generation of a response dependent on the message and the predetermined information.

61. The device of claim 55, wherein the telecommunications system includes means for levying a charge for the transaction when authorised.

62. The device claim 16, wherein the security data entry means comprises a rotary knob.

63. The device of claim 8 in combination with the data processing apparatus.

64. The device of claim 8 in combination with the telecommunications system.

65. The device of claim 8, wherein the authentication storage means communicates wirelessly to authenticate the transaction.

66. The device of claim 8, wherein the authentication storage means comprises a subscriber identity module which authenticates the transaction when the subscriber identity module is operable in a mobile terminal.