METHOD AND SYSTEM FOR ONLINE PAYMENT AND IDENTITY CONFIRMATION WITH SELF-SETTING AUTHENTICATION FOMULA

• US 20100153276A1
• Filed: 07/20/2006
• Published: 06/17/2010
• Est. Priority Date: 07/20/2006
• Status: Abandoned Application

• Current Assignee: Kamfu Wong
• Original Assignee: Kamfu Wong
• Inventors: Wong, Kamfu
• Application Number:
  US12/374,086
• Publication Number:
  US 20100153276A1
• Time in Patent Office: Days
• US Class Current: 705/72
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/3226 Use of secure elements separate from M-devices
• CPC Class Codes: G06Q 20/3255 using mobile network messaging services for payment, e.g. SMS
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions

Abstract

A system and a method are used for certification when paying online or confirming the user'"'"'s identity using the communication network. The system mainly includes a certification system (1), a bank website (2), a mobile telephone network (3), a user terminal (4) and a user mobile telephone (5) and so on. The method includes: the step for certification between the certification system (1) and the user mobile telephone (5) using the mobile telephone network (3), the step for calculating the certification code (8) using a certification formula (7) defined by the user (6), the step for certification by sending the certification formula (7) defined by the user (6) to the certification system (1) and storing it therein, then calculating the certification code (8) in the certification system (1) or by sending the certification formula (7) defined by the user (6) to the bank website (2) and storing it therein, then calculating the certification code (8) in the bank website (2). The present invention may efficiently prevent any hacker from hacking the certification code (8), and thus the use of the method and system provides high security for online payment.

Claims

1. A method for certification when paying online and/or confirming a user'"'"'s identity using a communication network, the method comprising the following steps:

certificating between a certification system (1) and a user mobile telephone (5) through a mobile telephone network (3);

calculating a certification code (8) using a certification formula (7) defined by the user (6);

certificating by the user (6) by sending the certification formula (7) defined by the user (6) to the certification system (1) or a bank website (2) wherein the certification formula (7) being stored and the certification code (8) being calculated.

2. The method for certification according to claim 1, comprising the following steps of A1, A2, A3, A4, A5, A6, A7 and A8, wherein:

A1. the user (6) defining and storing the certification formula (7) in the certification system (1) in advance, then the certification system (1) calculating the certification code (8) for certification;

A2. the user (6) logging on to the bank website (2) using a user terminal (4) by entering a log-in account number and password (0) therein;

A3. after checking that the log-in account number and password (0) of the user (6) are correct, the bank website (2) finding the number of the user mobile telephone (5) according to the log-in account number of the user (6), and sending the number of the user mobile telephone (5) to the certification system (1);

A4. the certification system (1) generating a random dynamic code having a length of N digits through a dynamic code generator (1-1), and then dialing the number of the user mobile telephone (5) through a dialer (1-2) using a caller number composed of a main telephone number of the certification system (1) and the random dynamic code, and hanging up as soon as the call being connected;

A5. the user (6) receiving the caller number of the certification system (1) by means of a caller ID display on the mobile telephone (5), the last N digits of the number of the incoming call being the random dynamic code, and then calculating the certification code (8) using the certification formula (7) pre-defined by the user;

A6. the user (6) replacing the original random dynamic code with the N digits of the certification code (8) in order to form a certification telephone number including the certification code (8), and then dialing the certification telephone number to the certification system (1) through the user mobile telephone (5), and hanging up as soon as the call being connected;

A7. upon receipt of the incoming call from the user (6), the certification system (1) finding the number dialed to the user mobile telephone (5) in step A4 and the random dynamic code from the records of the certification system (1) based on the number of the incoming call from the user mobile telephone (5), calculating the certification code (8) and the certification telephone number based on the random dynamic code using the certification formula (7) defined by the user in step A1, the certification is successful when the certification telephone number calculated is the same as the certification telephone number dialed by the user mobile telephone;

A8. upon successful certification, the certification system (1) informing the bank website (2) that the number of the mobile telephone (5) just sent by the bank website (2) in step A3 is certificated successfully, and the bank website (2) may permit the user (6) to log on formally.

3. The method for certification according to claim 1, comprising the following steps of B1, B2, B3, B4, B5, B6, B7, and B8, wherein:

B1. the user (6) defining the certification formula (7) in a bank in advance and storing the certification formula (7) in the bank website (2), then the bank website (2) calculating the certification code (8) for certification;

B2. the user (6) logging on to the bank website (2) using a user terminal (4) by entering a log-in account number and password (0) therein;

B3. after checking that the log-in account number and password of the user (6) are correct, the bank website (2) finding a number of the user mobile telephone (5) from the log-in account number of the user (6), and sending the number of the user mobile telephone (5) to the certification system (1);

B4. the certification system (1) generating a random dynamic code having a length of N digits through a dynamic code generator (1-1), and sending the random dynamic code to the user by a method selected from the group consisting of B41, B42, and B43;

B41. dialing the number of the mobile telephone (5) of the user (6) through a dialer (1-2) using a telephone line of a telephone number composed of a main telephone number of the certification system (1) and the random dynamic code, and hanging up as soon as the call being connected;

B42. the certification system (1) sending the random dynamic code to the user mobile telephone (5) via text message;

B43. the certification system (1) sending the random dynamic code to the user mobile telephone (5) via MMS and to the bank website (2) at the same time;

B5. when the user (6) receiving the random dynamic code by receiving the caller number of the certification system (1) by means of a caller ID display on the mobile telephone (5) wherein the last N digits of the number of the incoming call being the random dynamic code, or receiving the random dynamic code from the content of the text message or MMS, then calculating the certification code (8) using the certification formula (7) pre-defined by the user (6);

B6. the user (6) sending the N digits of the certification code (8) to the bank website (2);

B7. the bank website calculating the certification code (8) using the certification formula defined by the user (6) in step B1 from the random dynamic code sent by the certification system (1) in step B4, the certification being successful when the certification code (8) calculated being the same as the certification code entered by the user (6) in step B6;

B8. upon successful certification, the bank website (2) may permit the user (6) to log on formally.

4. The method for certification according to claim 1, comprising the following set C of steps, wherein:

C1. the user (6) defining and storing the certification formula (7) in the certification system (1) in advance, then the certification system (1) calculating the certification code (8) for certification;

C2. the user (6) logging on to the bank website (2) using a user terminal (4) by entering a log-in account number and password (0) therein

C3. after checking that the log-in account number and password of the user (6) are correct, the bank website (2) finding a number of the user mobile telephone (5) from the log-in account number of the user (6), and sending the number of the user mobile telephone (5) to the certification system (1);

C4. the certification system (1) generating a random dynamic code having a length of N digits through a dynamic code generator (1-1), and sends the random dynamic code to the user mobile telephone (5) by means of text message or MMS;

C5. the user (6) knowing that the text message or MMS is sent by the certification system (1) based on the caller number in the text message or MMS, receiving the random dynamic code from the content of the text message or MMS, and then calculating the certification code (8) using the certification formula (7) pre-defined by the user (6);

C6. the user (6) using his/her own mobile telephone (5) to transmit the certification code (8) back to the certification system (1) by means of text message or MMS;

C7. upon receipt of the certification code (8) sent back by the user (6) using his/her mobile telephone (5), the certification system (1) finding the random dynamic code sent to the user (6) in step C4 from the records of the certification system (1) based on the number of the incoming call from the user mobile telephone (5), calculating the certification code (8) based on the random dynamic code using the certification formula (7) defined by the user (6) in step C1, the certification being successful when the certification code (8) calculated is the same as the certification code sent back by the user mobile telephone;

C8. upon successful certification, the certification system (1) informing the bank website (2) that the number of the mobile telephone (5) just sent by the bank website (2) in step C3 is certificated successfully, and the bank website (2) may permit the user (6) to log on formally.

5. The method for certification according to claim 1, when the user (6) makes a transaction of a large amount of money, the bank website (2) will again ask the user to certificate, in order to ensure the security of the user account.

6. The method for certification according to claim 1, when the non-integer result is obtained by calculating the random dynamic code using the certification formula (7), the decimal point of the result will be ignored, and the first N digits will be the certification code (8).

7. The method for certification according to claim 1, wherein the certification method performs certification using two different approaches, one being the currently-used Internet, the other being a mobile telephone network (3).

8. The method for certification according to claim 1, wherein both the random dynamic code and the certification code (8) are transmitted using caller ID display.

9. The method for certification according to claim 1, the method being applied to all online payment certifications and applications that require certification, selected from the group consisting of e-bank certification, credit card certification, ATM withdrawing certification, credit card companies, stock broker companies, file storage certification, financial institutions, and website and personal information certification.

10. A communication network certification system for online payment and/or identity confirmation using a communication network comprising:

a certification system (1), which is a communication device having a computer, mainly including a random dynamic code generator (1-1) and a dialer (1-2), wherein the random dynamic code generator (1-1) is a computer server, having a random code generation program installed therein for generating a random numeric string code of specified length, in accordance with predetermined procedures;

the dialer (1-2) is a telephone exchange device connected to a mobile telephone network directly or through a fixed telephone network, wherein a number of a user mobile telephone may be dialed in accordance with predetermined procedures using the line of the telephone number provided by the mobile telephone network or fixed telephone network operator, or the random dynamic code may be sent to the user by means of SMS or MMS in accordance with the predetermined procedures;

a bank website (2), which is an online transaction website for financial institutions or a website that requires certification of the user'"'"'s identity;

a mobile telephone network (3), which is a common mobile telephone network;

a user terminal (4) selected from the group consisting of a computer and an electronic device that can be connected to the network and be capable of online payment;

a user mobile telephone (5); and

a certification formula (7), defined by the user (6) wherein the certification code (8) is calculated by the user sending the certification formula (7) to the certification system (1) or to the bank website (2), storing it therein, and the certification system (1) or the bank website (2) calculating the certification code (8).