Method for authorizing in data transmission systems

• US 6,078,908 A
• Filed: 04/22/1998
• Issued: 06/20/2000
• Est. Priority Date: 04/29/1997
• Status: Expired due to Term

• Current Assignee: Kim Schmitz
• Original Assignee: Kim Schmitz
• Inventors: Schmitz, Kim
• Primary Examiner(s): Cosimano, Edward R.
• Application Number:
  US09/064,421
• Time in Patent Office: 790 Days
• Field of Search: 340/825.3, 340/825.31, 380/3, 705/1, 705/44, 705/50, 705/51
• US Class Current: 705/50
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security

Abstract

The invention relates to a method and to a device for the authorization in data transmission systems employing a transaction authorization number (TAN) or a comparable password. According to a first step, the user sends a qualifying identification of the data input apparatus together with a request for the generation or for the selection of a transaction authorization number TAN or of comparable password from a data file from the data input apparatus to an authorization computer. In a second step the authorization computer generates the transaction authorization number TAN or the comparable password or selects them form a data file. According to a third step, the authorization computer sends the transaction authorization number TAN or the comparable password over a second transmission path different from the first transmission path to a monitor, for example a pager. According to a fourth step, the user reads this transaction authorization number TAN or the comparable password from the receiver and enters the transaction authorization number TAN or the comparable password into the data input apparatus. According to a fifth step, this transaction authorization number TAN or the comparable password is transmitted to the authorization computer. According to a sixth step, the authorization computer verifies the validity of the transaction authorization number TAN or of the comparable password in order to establish or switch free, according to a seventh step, a connection between the data input apparatus and the receiver unit.

Claims

1. A method for the authorization of data transmission systems comprising

entering a qualifying identification of a user into a data input apparatus;

transmitting the qualifying identification and a request for an authorization signal from the data input apparatus to an authorization computer along a first transmission path;

establishing the authorization signal in the authorization computer;

sending the authorization signal from the authorization computer to a monitor along a second transmission path different as compared to the first transmission path;

reading the authorization signal at the monitor by the user;

entering the authorization signal into the data input apparatus;

transmitting the authorization signal from the data input apparatus to the authorization computer;

verifying the validity of the authorization signal in the authorization computer;

establishing a connection between the data input apparatus and a receiver unit upon verification of the validity of the authorization signal.

2. The method according to claim 1, wherein the authorization signal is transmitted from the data input apparatus to the authorization computer along the first transmission path.

3. The method according to claim 1, further comprising limiting acceptance of the authorization signal during verification of the validity of the authorization signal by the authorizing computer to a predefined number of times.

4. The method according to claim 1, further comprising limiting acceptance of the authorization signal during verification of the validity of the authorization signal by the authorizing computer to a predefined user time.

5. The method according to claim 1, further comprising limiting acceptance of the authorization signal during verification of the validity of the authorization signal by the authorizing computer depending on a predefined number of data files being transmitted.

6. The method according to claim 1, further comprising limiting acceptance of the authorization signal during verification of the validity of the authorization signal by the authorizing computer depending on a predefined size value of data files being transmitted.

7. The method according to claim 1, further comprising employing a password for allowing accessing a member selected from the group consisting of the data input apparatus, the monitor, and the receiver unit.

8. The method according to claim 1, further comprising encoding the data transmitted from the data input apparatus to the receiver unit and vice versa.

9. The method according to claim 1, further comprising encoding the data transmitted from the data input apparatus to the authorization computer and vice versa.

10. A method for the authorization of data transmission systems employing a transaction authorization number (TAN) or a comparable password, wherein

a user sends according to a first step his or her qualifying identification through a data input apparatus (1), together with a request for generating or for selecting a transaction authorization number TAN or a comparable password from a data file, to an authorization computer (2),

wherein the authorization computer (2) generates the transaction authorization number TAN or the comparable password or selects the transaction authorization number TAN or the comparable password from a data file according to a second step,

wherein the authorization computer (2) sends the transaction authorization number TAN or the comparable password through a different transmission path as compared to the transmission path of the first step to a receiver (3) according to a third step,

wherein the user takes this transaction authorization number TAN or the comparable password from the receiver (3) and enters the transaction authorization number TAN or the comparable password into the data input apparatus (1) according to a fourth step,

wherein this transaction authorization number TAN or the comparable password is transmitted again to the authorization computer (2) according to a fifth step,

wherein the authorization computer (2) verifies the validity of the transaction authorization number TAN or of the comparable password according to a sixth step, in order to establish a connection between the data input apparatus (1) and a receiver unit (4) according to a seventh step.

11. The method according to claim 10, wherein the transaction authorization number TAN or the comparable password is a one-time usable transaction authorization number TAN or a one time usable password;

wherein

the validity of the transaction authorization number TAN or of the comparable password is limited to a predefined user time;

wherein

the validity of the transaction authorization number TAN or of the comparable password is dependent on a predefined number of the transmitted data files;

wherein

the validity of the transaction authorization number TAN or of the comparable password is dependent on a predefined size value of the transmitted data files.

12. The method according to claim 10, wherein access to the data input apparatus (1) and/or to the receiver (3) and/or the receiver unit (4) is protected by a password;

wherein

the data transmitted from the data input apparatus (1) to the receiver unit (4) or vice versa are encoded;

wherein

the data transmitted from the data input apparatus (1) to the authorization computer (2) or vice versa are encoded.

13. An apparatus for authorizing access to a communication line comprising

a data input apparatus for entering a qualifying identification of a user and for entering an authorization signal;

an authorization computer connected through a first transmission path to the data input apparatus for establishing an authorization signal and for verifying a received authorization signal;

a monitor connected to the authorization computer and disposed such that upon reading of an authorization signal on a monitor by a user, the user can enter the authorization signal into the data input apparatus;

a receiver unit connectable to the data input apparatus through a line switchable by the authorization computer between a connected state and a disconnected state upon verification of the validity of the entered authorization signal in the authorization computer.

14. The apparatus according to claim 13, wherein

the monitor 51 is a member selected from the group consisting of

a pager, a cellular phone, an email address, a net address, a telefax machine, a language output apparatus, an audio reproduction unit, a radio receiver, and a telephone.

15. The apparatus according to claim 13, further comprising

a first encoding module present in the authorization computer;

a second encoding module present in the monitor, wherein an encoding provided by the first encoding module matches an encoding of the second encoding module.

16. The apparatus according to claim 13, wherein the receiver unit furnishes a door-locking mechanism.

17. The apparatus according to claim 13, wherein the authorization computer and the receiver unit are integrated into a single apparatus.

18. The apparatus according to claim 13, wherein the data input apparatus, the authorization computer, and the receiver unit are integrated into one single apparatus.

19. The apparatus according to claim 13, wherein the data input apparatus serves for entering a qualifying identification of a user into the data input apparatus and for transmitting the qualifying identification and a request for an authorization signal from the data input apparatus to the authorization computer along a first transmission path;

wherein the authorization computer serves for establishing the authorization signal in the authorization computer, and for sending the authorization signal from the authorization computer to a monitor along a second transmission path different as compared to the first transmission path;

wherein the monitor serves for reading the authorization signal at the monitor by the user;

wherein the data input apparatus further serves for entering the authorization signal into the data input apparatus by the user and for transmitting the authorization signal from the data input apparatus to the authorization computer;

wherein the authorization computer further serves for verifying the validity of the authorization signal in the authorization computer and for establishing a connection between the data input apparatus and the receiver unit upon verification of the validity of the authorization signal.

20. The apparatus according to claim 13, wherein the monitor is a radio receiver incorporated into the data input apparatus, wherein the radio receiver furnishes the authorization signal on a display monitor of the data input apparatus.

21. The apparatus according claim 20, wherein the radio receiver includes a user identification element furnished by a member selected from the group consisting of a magnetic card reader, a chip card reader, a graphic device for finger-print identification, and a graphic device for picture identification.