Electronic System for Securing Electronic Services

• US 20100299731A1
• Filed: 03/08/2007
• Published: 11/25/2010
• Est. Priority Date: 03/08/2006
• Status: Active Grant

• Current Assignee: Fiserv Incorporated
• Original Assignee: Monitise Group Ltd. (Fiserv Incorporated)
• Inventors: Atkinson, Steven Paul
• Granted Patent: US 8,869,253 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 2463/081 applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords

Abstract

A method of accessing an internet based service, involves using a cellular telephony device to obtain a token from the provider of the internet based service, and within the cellular telephony device, using the token to calculate a time-limited password. The time-limited password is used in combination with at least one further user identification parameter to obtain access to the internet based service.

Claims

1. A method of accessing an internet based service, the method comprising:

using a cellular telephony device to obtain a token from the provider of the internet based service;

within the cellular telephony device, using the token to calculate a time-limited password, wherein the time-limitation of the password is dependent on the token; and

using the time-limited password to obtain access to the internet based service.

2. A method as claimed in claim 1, wherein obtaining access to the internet based service further comprises using at least one further user identification parameter.

5. A method as claimed in any preceding claim, wherein the calculation of the time-limited password takes into account the current time.

6. A method as claimed in any preceding claim, wherein the calculation of the time-limited password takes into account an identity parameter of the cellular telephony device.

7. A method as claimed in any preceding claim, wherein the calculation of the time-limited password uses the function:

Password=f(IP XOR NT XOR t), where t is a measurement of the current time, IP is an identity parameter of the cellular telephony device and NT is the numeric token.

8. A method as claimed in claim 7, wherein the function f comprises:

f(x)=RightTrunc(Decimal(SHA(x))), wherein RightTrunc is a function to extract a lowest number of bits, Decimal is a function to convert a byte array to an integer value, and SHA is a secure hash algorithm.

9. A method as claimed in claim 2 or 4, wherein the at least one further user identification parameter comprises a username.

10. A method as claimed in claim 9, wherein the at least one further user identification parameter comprises a user password or personal identification number.

11. A method as claimed in any preceding claim, wherein the token comprises a numeric token in the form of a salt value.

12. A method as claimed in any preceding claim, wherein the token has time limited validity.

13. A method as claimed in claim 12, wherein the validity is limited to a value between 1 hour and 1 week.

14. A method as claimed in claim 12 or 13, wherein during the validity of the token, access to the internet based service is enabled without requiring communication with the server used to generate the token.

15. A method as claimed in any one of claims 12 to 14, wherein the validity of the token is defined as a time window, with time windows for sequential tokens overlapping.

16. A method as claimed in any preceding claim, wherein the provision of the token to the cellular telephony device is dependent on authentication of the cellular telephony device.

17. A method as claimed in claim 16, wherein the authentication comprises verifying the at least one further user identification parameter as being associated with the specific cellular telephony device using a registered user database.

18. A method as claimed in claim 17, wherein the specific cellular telephony device is identified using the MSISDN.

19. A method as claimed in any preceding claim, wherein when providing the token, clock synchronisation between the cellular telephone device and the provider of the internet based service is also implemented.

20. A method as claimed in any preceding claim, wherein access to the internet based service is implemented over an internet connected device.

21. A method as claimed in claim 20, wherein the internet connected device comprises one of a personal computer, a PDA, a TV set top box and a games console.

22. A computer program comprising code, which when executed on a computer causes the computer to perform all of the steps of any preceding claim.

23. A computer program product comprising a computer program as claimed in claim 22 embodied on a computer readable medium.

3. A method of providing access to an internet based service, the method comprising:

generating a token and providing the token to a cellular telephony device of a user seeking access to the service;

using the token to calculate a time-limited password for the specific user, wherein the time-limitation of the password is dependent on the token;

receiving a time-limited password from the user calculated using the token; and

verifying the time-limited password to grant access to the internet based service.

4. A method as claimed in claim 3, wherein at least one further user identification parameter is received with the time-limited password, and wherein verifying the time-limited password and the at least one further user identification parameter is verified with the time-limited password to grant access to the internet based service.

24. A system for providing access to an internet based service from a cellular telephony device, the system comprising:

a server of a provider of the internet based service, and comprising means for generating a token; and

a software application for installation on a cellular telephony device, the software application enabling calculation of a time-limited password from the token, wherein the time-limitation of the password is dependent on the token,

wherein the server further comprises means for verifying the time-limited password to enable or prohibit access to the internet based service.

25. A system as claimed in claim 24, wherein the server further comprises means for verifying at least one further user identification parameter.

26. A system as claimed in claim 24 or 25, wherein the calculation of the time-limited password uses the function:

Password=f(IP XOR NT XOR t), where t is a measurement of the current time, IP is an identity parameter of the cellular telephony device and NT is the numeric token.

27. A system as claimed in claim 26, wherein the function f comprises:

f(x)=RightTrunc(Decimal(SHA(x))), wherein RightTrunc is a function to extract a lowest number of bits, Decimal is a function to convert a byte array to an integer value, and SHA is a secure hash algorithm.