Authentication Method

• US 20140245391A1
• Filed: 10/30/2012
• Published: 08/28/2014
• Est. Priority Date: 10/31/2011
• Status: Active Grant

• Current Assignee: Money and Data Protection Lizenz GmbH & Co. KG (Money and Data Protection Lizenz Verwaltungs GmbH)
• Original Assignee: Money and Data Protection Lizenz GmbH & Co. KG (Money and Data Protection Lizenz Verwaltungs GmbH)
• Inventors: Adenuga, Dominic
• Granted Patent: US 9,246,903 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G07F 7/1025 Identification of user by a PIN code
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

A method of authenticating a user to a transaction at a terminal (10), wherein a user identification is transmitted from the terminal (10) to a transaction partner (12) via a first communication channel (14), and an authentication device (18) uses a second communication channel (20) for checking an authentication function that is implemented in a mobile device (16) of the user, and, as a criterion for deciding whether the authentication to the transaction shall be granted or denied, the authentication device (18) checks whether a predetermined time relation exists between the transmission of the user identification and a response from the second communication channel, and the authentication function is normally inactive and is activated by the user only preliminarily for the transaction, the response from the second communication channel (20) includes the information that the authentication function is active, and the authentication function is automatically deactivated.

Claims

1. A method of authenticating a user to a transaction at a terminal, comprising the steps of:

transmitting a user identification from the terminal to a transaction partner via a first communication channel,

providing an authentication step in which an authentication device uses a second communication channel for checking an authentication function that is implemented in a mobile device of the user,

as a criterion for deciding whether the authentication to the transaction shall be granted or denied, having the authentication device check whether a predetermined time relation exists between the transmission of the user identification and a response from the second communication channel,

providing that the authentication function is normally inactive and is activated by the user only preliminarily for the transaction,

providing that said response from the second communication channel includes information that the authentication function is active, and

thereafter providing that the authentication function is automatically deactivated.

2. The method according to claim 1, wherein the step of thereafter providing that the authentication function is automatically deactivated includes the step of deactivating the authentication function after a predetermined time interval after at least one of:

activation thereof and

when an active state thereof has been checked.

3. The method according to claim 1, wherein said authentication step includes the step of logging-on the mobile device to a mobile communications network that provides the second communication channel.

4. The method according to claim 3, further including the step of having the mobile communications network permit the authentication device to detect the logged-on state of the mobile device and hence an active state of the authentication function by checking only a communication register of the network, without having to communicate with the mobile device.

5. The method according to claim 1, further comprising the step of having the authentication device determine a current location of the mobile device and denying the authentication of the user when the locations of the terminal and of the mobile device do not fulfil a predetermined spatial relationship.

6. The method according to claim 5, wherein the second communication channel involves a mobile communications network supporting Location Based Services, and further comprising the step of having the authentication device use these Location Based Services for locating the mobile device.

7. The method according to claim 5, further comprising the step of having the mobile device detect its own location and send location information to the authentication device.

8. The method according to claim 1, further comprising the steps of:

having the authentication device determine a current location of the mobile device and authenticate the user when the locations of the terminal and of the mobile device fulfil a predetermined spatial relationship, and

checking the active state of the authentication function in the mobile device only when said spatial relationship is not fulfilled.

9. The method according to claim 1, wherein the authentication device is remote from the transaction partner and further comprising the steps of:

having the authentication device communicate with the transaction partner via a third communication channel,

storing information linking the user identification to an address of the mobile device in the mobile communications network only in the authentication device, and

having the authentication device notify to the transaction partner only whether or not the user is authenticated, without disclosing any further data pertaining the user and the mobile device.

10. The method according to claim 1, further comprising the step of transmitting a password to the transaction partner via the authentication device.

11. The method according to claim 10, further comprising the steps of one of storing and generating the password in the mobile device and transmitting the password to the authentication device.

12. The method according to claim 10, further comprising the step of one of storing and converting the password in the authentication device.

13. The method according to claim 1, further comprising the steps of:

interfacing the mobile device to an identity token of the user to read identity data therefrom, and

transmitting these identity data to the authentication device via the second communication channel.

14. A mobile device for use with the authentication method according to claim 1, comprising:

a wireless transceiver,

an ON-switch and

an electronic controller that implements said authentication function and is configured to activate the authentication function in response to the ON-switch being operated and to deactivate the authentication function one of;

after it has been active for a predetermined time interval

after its state has been checked.

15. The device according to claim 14, further comprising:

a rechargeable battery and

a connector for connecting the battery to a voltage source.

16. The device according to claim 15, comprising a display for indicating the charge state of the battery.

17. The device according to claim 15, wherein the connector is one of

a USB connector and

a micro-USB connector.

18. The device according to claim 15, wherein the connector is a male connector covered by a removable cap that includes two female connectors permitting to connect the male connector to a voltage source via one of the female connectors while the other of the female connectors is coupled to the male connector.

19. The device according to claim 14, comprising a positioning function for wireless detection of its own position, wherein the authentication function includes a function of sending a detected location via the transceiver.

20. The device according to claim 14, wherein the authentication function consists only of activating and deactivating the transceiver.

21. The device according to claim 14, comprising a body that encapsulates at least the controller and prevents access thereto.

22. The device according to claim 14, comprising a self-destruction function configured to be activated by an attempt of enforced access.

23. The device according to claim 14, wherein the transceiver constitutes an only data input and output port of the controller.

24. The device according to claim 14, comprising a storage for a plurality of mobile addresses, and an input including the ON-switch and adapted to selectively activate one of a plurality of authentication functions each of which is assigned to a different one of said mobile addresses.

25. The device according to claim 14, comprising a storage for a plurality of mobile addresses, wherein the controller is configured to select one out of the plurality of mobile addresses according to a predetermined algorithm.

26. The device according to claim 14, comprising an acoustic transducer for providing an acoustic feedback signal upon at least one of activation and deactivation of the authentication function.