Authentication Method

• US 20080046988A1
• Filed: 10/19/2005
• Published: 02/21/2008
• Est. Priority Date: 10/20/2004
• Status: Active Grant

• Current Assignee: Salt Group Pty Ltd.
• Original Assignee: Salt Group Pty Ltd.
• Inventors: Baharis, Chris, Oakley, Ross
• Granted Patent: US 8,752,125 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

There is disclosed an authentication method comprising requesting a user of a personal mobile terminal to enter a personal code into a personal mobile terminal in response to receipt of an authentication request transmitted to the personal mobile terminal, the authentication request being related to an action that requires user authentication, and processing an entered personal code together with challenge data corresponding to the authentication request to determine whether one or more predetermined conditions are met and, if one or more predetermined conditions are met, producing a valid and signed authentication code that the user can provide in order to authenticate the action.

Claims

1. An authentication method comprising:

requesting a user of a personal mobile terminal to enter a personal code into a personal mobile terminal in response to receipt of an authentication request transmitted to the personal mobile terminal, the authentication request being related to an action that requires user authentication; and

processing an entered personal code together with challenge data corresponding to the authentication request to determine whether one or more predetermined conditions are met and, if one or more predetermined conditions are met, producing a valid and signed authentication code that the user can provide in order to authenticate the action.

2. An authentication method as claimed in claim 1, comprising transmitting challenge data to said personal mobile terminal as part of said authentication request.

3. An authentication method as claimed in claim 1, comprising generating, at said personal mobile terminal, challenge data corresponding to at least part of said authentication request.

4. An authentication method as claimed in claim 1, wherein at least one of said one or more predetermined condition is that the personal code is correct.

5. An authentication method as claimed in claim 1, comprising also processing the entered personal code together with at least one key stored on the mobile phone.

6. An authentication method as claimed in claim 5, wherein at least one of said one or more predetermined conditions is that the key is correct.

7. An authentication method as claimed in claim 1, wherein details of the action are included in the authentication request, and the method comprises displaying the details of the action to the user before the user enters the user'"'"'s personal code.

8. An authentication method as claimed in claim 7, wherein the transaction details are only displayed after the personal code is entered.

9. A computer program that when executed by a personal mobile terminal enables the personal mobile terminal to:

request a user of the mobile terminal to enter a personal code following receipt of an authentication request transmitted to the mobile terminal, the authentication request being related to an action that requires user authentication;

process an entered personal code together with a challenge corresponding to the authentication request; and

produce a valid and signed authentication code that the user can provide in order to authenticate the action if one or more predetermined conditions are met.

10. A computer program as claimed in claim 9, that enables a personal mobile terminal to process challenge data transmitted to said personal mobile terminal as part of said authentication request.

11. A computer program as claimed in claim 9, wherein said computer program generates, at said personal mobile terminal, challenge data corresponding to at least part of said authentication request.

12. A computer program as claimed in claim 9, wherein at least one of said one or more predetermined condition is that the personal code is correct.

13. A computer program as claimed in claim 9, wherein the computer program enables the personal mobile terminal to process the entered personal code together with at least one key stored on the mobile phone.

14. A computer program as claimed in claim 13, wherein at least one of said one or more predetermined conditions is that the key is correct.

15. A computer program as claimed in claim 9, wherein details of the action are included in the authentication request, and the computer program causes the personal mobile terminal to display the details of the action to the user before the user enters the user'"'"'s personal code.

16. A computer program as claimed in claim 15, wherein the transaction details are only displayed after the personal code is entered.

17. A computer program as claimed in claim 9, wherein the computer program is executed by the personal mobile terminal upon receipt of the authentication request.

18. A computer program as claimed in claim 9, that causes the personal mobile terminal to automatically provide the authentication code on the user'"'"'s behalf after completion of processing of the personal code.

19. A personal mobile terminal configured to:

request a user of the mobile terminal to enter a personal code following receipt of an authentication request transmitted to the mobile terminal, the authentication request being related to an action that requires user authentication;

process an entered personal code together with challenge data corresponding to the action data to determine whether one or more predetermined conditions are met; and

produce a valid and signed authentication code that the user can provide in order to authenticate the action if the one or more predetermined conditions are met.

20. An authentication method comprising:

transmitting an authentication request to a personal mobile terminal designated as belonging to a user in response to the initiation of an action that requires authentication by the user;

receiving the authentication request at the personal mobile terminal;

prompting a user to enter a personal code into the personal mobile terminal;

processing the personal code together with challenge data corresponding to the authentication request and if one or more predetermined conditions are met, producing a valid and signed authentication code that the user can provide in order to authenticate the action.

21. An authentication method as claimed in claim 20, wherein the action is a transaction initiated by the user.

22. An authentication method as claimed in claim 21, wherein the transaction is a banking transaction.

23. An authentication method as claimed in claim 21, wherein the transaction is an order for a product or service.

24. An authentication method as claimed in claim 20, wherein the action is a transaction initiated by the an entity whose actions require authorisation by said user.

25. A system for authenticating actions comprising:

an action authentication server; and

one or more personal mobile terminals belonging to respective ones of one or more users of the system, the action authentication server being configured to transmit an authentication request to a personal mobile terminal of a user in response to initiation of an action requiring authentication by a user;

each users'"'"' personal mobile terminal being configured to;

request the user of the personal mobile terminal to enter a personal code following receipt of the authentication request;

process an entered personal code together with challenge data corresponding to the authentication request; and

produce a valid and signed authentication code that the user can provide in order to authenticate the action if one or more predetermined conditions are met.

26. A system as claimed in claim 25, wherein the action authentication server is configured to receive the authentication code and authenticate the action if the authentication code is valid.

27. A method of configuring a personal mobile terminal to participate in an authentication system comprising:

providing an activation code to a user by a means independent of the user'"'"'s personal mobile terminal

placing a security application on a web server for retrieval by the user'"'"'s personal mobile terminal;

providing details of the security application to the user that are sufficient for the user to retrieve the security application;

running the security application on the user'"'"'s personal mobile terminal in order to prompt the user for the activation code and to generate a confirmation code if the activation code is entered into the personal mobile terminal; and

providing the confirmation code to the authentication system; and

activating the user if the confirmation code is valid.

28. A method as claimed in claim 27, wherein the confirmation code is provided by a means independent of the user'"'"'s personal mobile terminal.

29. A method as claimed in claim 27, wherein the user initiates a configuration of the user'"'"'s personal mobile terminal by accessing the web server.

30. A method as claimed in claim 27, wherein the security application is personalised for said user.