Method and system for authentication of a service request

• US 6,947,727 B1
• Filed: 09/22/2000
• Issued: 09/20/2005
• Est. Priority Date: 10/01/1999
• Status: Expired due to Fees

• Current Assignee: Ab Tryggit
• Original Assignee: Ab Tryggit
• Inventors: Brynielsson, Thore
• Primary Examiner(s): Tran, CongVan
• Application Number:
  US10/089,548
• Time in Patent Office: 1,824 Days
• Field of Search: 455/411, 455/403, 455/407, 455/410, 4554121-4122, 455/415, 455/418, 455/419, 455/420, 455/558, 455/560, 455/414.1
• US Class Current: 455/411
• CPC Class Codes: G06Q 20/3224 Transactions dependent on location of M-devices
• CPC Class Codes: G06Q 20/341 Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/42 Confirmation, e.g. check or permission by the legal debtor of payment
• CPC Class Codes: G06Q 20/425 using two different networks, one for transaction and one for security confirmation
• CPC Class Codes: G07F 7/1008 Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system

Abstract

A method and a system is directed to authentication of a commission from a customer to a service provider. A set of randomly generated code words are stored in a memory circuit associated with a mobile-telephone subscription in a mobile telephone, as well as in a database together with an association to the mobile-telephone subscription. The method includes the steps of determining the identify of the customer, of identifying the mobile-telephone subscription on the basis of the identity of the customer, of retrieving a code word from the memory circuit, and of checking the presence of the code word in the code word set in the database that is associated with the mobile-telephone subscription, in order to thus authenticate the commission.

Claims

1. A method of authenticating a commission from a customer to a service provider, comprising the steps of

forming a plurality of sets of randomly generated code words;

storing one of said plurality of code word sets in a memory circuit of a mobile telephone, which circuit is associated with a mobile-telephone subscription;

storing an identical code word set in a database together with an association to said mobile-telephone subscription; and

at the time of requesting the commission, identifying said mobile-telephone subscription, retrieving at least one code word from the memory circuit and checking the presence of said code word in the code word set in the database that is associated with said mobile-telephone subscription, thereby authenticating the commission.

2. A method as claimed in claim 1, wherein the code word is retrieved from the memory circuit in a predetermined sequence known to the database.

3. A method as claimed in claim 2, further comprising the step of registering, in at least in one of the memory circuit and the database, when a code word has been used, thus ensuring said predetermined sequence is followed.

4. A method as claimed in claim 1, wherein the step of identifying the mobile-telephone subscription comprises the steps of

determining the identity of the customer, and,

based on the identity of the customer, identifying the mobile-telephone subscription.

5. A method as claimed in claim 1, wherein a request to provide a code word is sent to the customer.

6. A method as claimed in claim 5, wherein the request is sent to the mobile telephone via the telecommunication network.

7. A method as claimed in claim 5, wherein the code word is transmitted from the mobile telephone to the database via the telecommunication network.

8. A method as claimed in claims 1, wherein

the identity of the customer and the code word retrieved from the memory circuit are transferred to the service provider,

the mobile-telephone subscription associated with the customer is identified by the service provider, and

the code word and the identity of the mobile-telephone subscription are transferred to the database by the service provider.

9. A method as claimed in claim 1, wherein a second code word is retrieved from the memory circuit and is transferred to the database to further authenticate the commission.

10. A method as claimed in claim 9, wherein the code words in the set are connected to one another in groups, said first and said second code words being included in the same group of code words.

11. A method as claimed in claims 9, wherein said first code word is transferred from the customer to the database, the database sends a request to the customer to provide said second code word, and said second code word is transferred from the customer to the database.

12. A method as claimed in claim 1, further comprising the steps of

associating at least one position indication with the mobile-telephone subscription and storing said indication in the database, and,

each time a commission is requested, establishing the location of the memory circuit and checking the position indication thus obtained against said position indication stored in the database.

16. A method as claimed in claims 2, wherein

the identity of the customer and the code word retrieved from the memory circuit are transferred to the service provider,

the mobile-telephone subscription associated with the customer is identified by the service provider, and

the code word and the identity of the mobile-telephone subscription are transferred to the database by the service provider.

17. A method as claimed in claims 3, wherein

the identity of the customer and the code word retrieved from the memory circuit are transferred to the service provider,

the mobile-telephone subscription associated with the customer is identified by the service provider, and

the code word and the identity of the mobile-telephone subscription are transferred to the database by the service provider.

18. A method as claimed in claim 6, wherein the code word is transmitted from the mobile telephone to the database via the telecommunication network.

19. A method as claimed in claims 10, wherein said first code word is transferred from the customer to the database, the database sends a request to the customer to provide said second code word, and said second code word is transferred from the customer to the database.

20. A method as claimed in claim 2, wherein a request to provide a code word is sent to the customer.

13. A method of authenticating a commission from a customer to a service provider, wherein a set of randomly generated code words has been stored in a memory circuit associated with a mobile-telephone subscription in a mobile telephone as well as in a database together with an association to said mobile-telephone subscription, comprising the steps of:

establishing the identity of the customer;

identifying the mobile-telephone subscription on the basis of the identity of the customer;

retrieving a code word from the memory circuit; and

checking the presence of said code word in the code word set in the database that is associated with said mobile-telephone subscription, in order to thus authenticate the commission.

14. A system for authenticating a commission from a customer to a service provider, comprising:

a mobile telephone having a memory circuit associated with a mobile-telephone subscription;

means to enable the customer to disclose his identity to the service provider;

a database;

a set of randomly generated code words, said set stored in the first place in the memory circuit and in the second place in the database, where it is associated with the mobile-telephone subscription;

means to identify the mobile-telephone subscription based on the identity of the customer;

means to enable the customer to retrieve a code word from the memory circuit and to transfer said code word to the database; and

checking means for checking that said code word is present in the code word set in the database that is associated with said mobile-telephone subscription, in order to thus authenticate the commission.

15. A system as claimed in claim 14, wherein said checking means comprises a communication means for communication between the database and the mobile telephone.