Facilitating and authenticating transactions

• US 20070143828A1
• Filed: 07/28/2004
• Published: 06/21/2007
• Est. Priority Date: 10/09/2003
• Status: Active Grant

• Current Assignee: Vodafone Group PLC
• Original Assignee: Vodafone Group PLC
• Inventors: Jeal, David, Debney, Charles, Stronach, George
• Granted Patent: US 9,485,249 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/123 by using dedicated hardware, e.g. dongles, smart cards, cryptographic processors, global positioning systems [GPS] devices
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

A computer, such as a Windows-based PC (10), has associated with it a Subscriber Identity Module (or SIM) (12), such as of the type used in a GSM cellular telephone system. The SIM (12) can be authenticated by the telephone network (16), in the same way as for authenticating SIMs of telephone handset users in the network, and can in this way authenticate the user of the PC (10) or the PC (10) itself. Such authentication can, for example, permit use of the PC (10) in relation to a particular application (22) which is released to the PC (10) after the authentication is satisfactorily completed. The application may be released to the PC (10) by a third party after and in response to the satisfactory completion of the authentication process. A charge for the session can be debited to the user by the telecommunications network and then passed on to the third party.

Claims

1. A method for carrying out an authentication process for authenticating a transaction with an entity by means of a data processing apparatus, in which:

the entity generates transaction data relating to the transaction, and

at least during the authentication process the data processing apparatus has operatively associated with it a selected one of a plurality of authentication storage means each for storing predetermined authentication information, the authentication storage means being registerable with a common system,

the method including the step of carrying out the authentication process via a communications link with that system, the authentication process being carried out by authenticating means incorporated in the system and involving the use of the predetermined authentication information stored by the selected one authentication storage means and the transaction data,

wherein in order to authenticate the transaction, the transaction data is transmitted between the data processing apparatus and the system via a transaction manager implemented by the data processing apparatus, and the predetermined authentication information is also transmitted between the authentication storage means and the system via the transaction managers.

2. A method according to claim 1, in which the predetermined authentication information stored by each authentication storage means corresponds to information which is used to authenticate a user of that authentication storage means in relation to the system.

3. A method according to claim 1, wherein the system is a telecommunications system.

5. A method according to claim 1, wherein each user is authenticated in the telecommunications system by means of the use of a smart card or subscriber identity module (e.g. SIM), and in which the authentication storage means respective to that user corresponds to or simulates the smart card for that user.

6. A method according to claim 5, wherein the smart card or SIM authenticates the transaction when the smart card or SIM is operable in a terminal usable in a mobile and/or cellular telecommunications system.

7. A method according to claim 6, wherein the smart card or SIM is operable to authenticate the terminal in the mobile and/or cellular telecommunications system.

11. A method according to claim 1, in which the authentication storage means is incorporated on a data carrier for data or software for use by that data processing apparatus.

12. A method according to claim 1, in which the authentication process involves the sending of a message and the generation of a response dependent on the message and the predetermined information.

17. A method according to claim 1, including operatively coupling the authentication storage means to a carrier.

19. A method according to claim 17, wherein the carrier is operatively coupled to the data processing apparatus by a wireless link.

20. A method according to claim 17, wherein the authentication storage means is removably coupled to the carrier.

27. A method according to claim 17, wherein communication with the data processing apparatus is controlled by a data processing module.

30. A method according to claim 27, wherein the data processing module of the carrier decrypts encrypted data received from the data processing module of the data processing apparatus.

31. A method according to claim 27, wherein the data processing module of the carrier encrypts data transmitted to the data processing module of the data processing apparatus.

32. A method according to claim 30, wherein the respective data processing modules comprise a key for allowing encryption and/or decryption of data.

33. A method according to claim 32, wherein the key comprises a shared secret key for each of the respective data processing modules.

34. A method according to claim 17, wherein the carrier is operatively coupled to a plurality of authentication storage means for respectively enabling the said authentication process and one or more other authentication processes.

36. A method according to claim 1, including routing communications between the authentication storage means and the system via the transaction manager.

37. A method according to claim 1, wherein the transaction manager is implemented by the data processing apparatus.

38. A method according to claim 1, wherein the transaction manager detects the operative coupling of the authentication storage means.

39. A method according to claim 36, wherein the transaction manager transmits data relating to an authenticated transaction to the entity to which that transaction relates.

4. (canceled)

8-10. -10. (canceled)

13-16. -16. (canceled)

18. (canceled)

21. (canceled)

24. (canceled)

22. A method according to claim 24, comprising using said carrier to obtain security data independently of the data processing apparatus, and analysing the security data for determining whether to allow access to the predetermined information.

23. A method according to claim 22, wherein the security data is obtained by alphanumeric data entry means.

25. A method according to claim 22, wherein the security data comprises a Personal Identification Number (PIN) and the analysing step compares the PIN obtained by the security data entry means with a PIN stored on the authentication storage means and only allows access to the predetermined information when the respective PINs match.

26. (canceled)

28-29. -29. (canceled)

35. (canceled)

40-51. -51. (canceled)

52. Data processing apparatus in combination with a selected one of a plurality of authentication storage means each for storing predetermined authentication information relating to the carrying out of an authentication process for authenticating a transaction with an entity by means of the data processing apparatus, the entity being operable to generate transaction data relating to the transaction, and the authentication storage means all being registrable with a common system, the authentication storage means when operatively associated with the data processing apparatus being operative to carry out the authentication process via a communications link with that system, the authentication process being carried out by authenticating means incorporated in the system and involving the use of the predetermined authentication information stored by the selected one authentication storage means, wherein in order to authenticate the transaction, the transaction data is transmitted between the data processing apparatus and the system via a transaction manager implemented by the data processing apparatus, and the predetermined authentication information is also transmitted between the authentication storage means and the system via the transaction manager.

53. Apparatus according to claim 52, in which the predetermined authentication information stored by each authentication storage means corresponds to information which is used to authenticate a user of that authentications storage means in relation to the system.

54. Apparatus according to claim 52, wherein the system is a telecommunications system.

56. Apparatus according to claim 53, in which each user is authenticated in the telecommunications system by means of the use of a smart card or subscriber identity module (e.g. SIM), and in which the authentication storage means respective to that user corresponds to or simulates the smart card for that user.

57. Apparatus according to claim 56, wherein the smartcard or SIM is operable in a terminal usable in a mobile and/or cellular telecommunication system to authenticate the transaction.

58. Apparatus according to claim 57, wherein the smartcard or SIM is operable to authenticate the terminal in the mobile and/or cellular telecommunication system.

61. Apparatus according to claim 52, in which the authentication process involves the sending of a message and the generation of a response dependent on the message and the predetermined information.

66. Apparatus according to claim 52, wherein a carrier is provided for the authentication storage means and the authentication storage means is operatively couplable to the carrier.

68. Apparatus according to claim 66, including means for allowing wireless communication between the carrier and the data processing apparatus.

69. Apparatus according to claim 66, including means for removably coupling the carrier to the authentication storage means.

71. Apparatus according to claim 66, wherein the carrier includes means for obtaining security data independently of the data processing apparatus and means for analysing the security data for determining whether to allow access to the predetermined information.

72. Apparatus according to claim 71, wherein the carrier comprises alphanumeric data entry means for allowing the security data to be obtained.

74. Apparatus according to claim 71, wherein the security data comprises a personal identification number (PIN) and the analysing means is operable to compare the PIN obtained by the security data entry means with a PIN stored on the authentication storage means and for only allowing access to the predetermined information when the respective PINs match.

76. Apparatus according to 66, wherein the carrier comprises a data processing module for controlling communication with the data processing apparatus.

79. Apparatus according to claim 76, wherein the data processing module of the carrier includes means for decrypting encrypted data received from the data processing module of the data processing apparatus.

80. Apparatus according to claim 76, wherein the data processing module of the carrier encrypts data transmitted to the data processing module of the data processing apparatus.

81. Apparatus according to claim 79, wherein the respective data processing modules comprise a key for allowing encryption and/or decryption of data.

82. Apparatus according to claim 81, wherein the key comprises a shared secret key for each of the respective data processing modules.

83. Apparatus according to claim 66, wherein the carrier includes means for operatively coupling the carrier to a plurality of authentication storage means for respectively enabling the said authentication process and one or more other authentication processes to be performed.

85. Apparatus according to claim 52, wherein data communications between the authentication storage means and the system are routed via the transaction manager

86. Apparatus according to claim 52, wherein the transaction manager is implemented by the data processing apparatus.

87. Apparatus according to claim 52, wherein the transaction manager is operable to detect the operative coupling of the authentication storage means to the data processing means.

88. Apparatus according to claim 52, wherein the transaction manager is operable to transmit data relating to an authenticated transaction to the entity to which that transaction relates.

55. (canceled)

59-60. -60. (canceled)

62-65. -65. (canceled)

67. (canceled)

70. (canceled)

73. (canceled)

75. (canceled)

77-78. -78. (canceled)

84. (canceled)

89-100. -100. (canceled)

101. A device for coupling to data processing apparatus for enabling an authentication process involving the use of separate authenticating means, the device being configured to provide a plurality of separately activatable authentication information records for use in the authentication process, the authentication information records being registered with a system including the authenticating means, the device being responsive to an input message for deriving a response dependent on the input message and on the activated authentication information record for enabling the authenticating means to carry out the authentication process via a communication link with the authenticating means in the said system whereby to authenticate a transaction.

102. The device of claim 101, including means for receiving a smart card or SIM which carries said plurality of authentication information record.

103. The device of claim 101, including means for receiving a plurality of smart cards or SIMs, each of which carries one of said plurality of authentication information records.

104. The device of claim 101, including means for releasably coupling one or a plurality of smart cards or SIMs thereto, the authentication information records being stored on the smart card(s) or SIM(s).

105. The device of claim 101, including means for receiving one or a plurality of smart cards or SIMs and for permanently coupling the smart card(s) or SIM(s) to the device.

106. The device of claim 101, including a data store for storing said plurality of separately activatable authentication information records.

107. The device of claim 101, wherein the plurality of authentication information records are selectively activated in response to a user input.

108. The device of claim 107, wherein the user input is provided by activation of a switch.

109. The device of claim 101, wherein the plurality of authentication information records are selectively activated in response to a signal received from the data processing device.

110. An authentication system for authenticating transactions of users registered with that system to enable a transaction with another system to be authenticated, the authentication system including authentication means for sending an authentication message in response to an authentication request from a subscriber and for receiving and analysing a response thereto to determine if the received response corresponds to an expected response to authenticate the identity of the user;

and security token generating means for generating a security token for use in performing a transaction with the other system.

111. The system of claim 110, wherein the security token includes data indicative of the identity of the user.

112. The system of claim 110, wherein the security token includes data indicative of the nature of the transaction.

113. The system of claim 110, including means for receiving a returned security token and for analysing the returned security token to determine its integrity and for providing a service in response to receipt of the returned security token.

114. The system of claim 113, wherein the service is the processing of a payment associated with the transaction.

115. The system of claim 110, including a register for storing data relating to a user for use in performing transactions.

116. The system of claim 115, including means for transmitting the user data in response to a request from the user.

117. The system of claim 115, including means for transmitting the user data in response to receipt of a returned security token.

118. The system of claim 115, including means for transmitting the user data in response to receipt of a returned security token, and wherein the register stores for each user separate data records for each of a plurality of other services with which the user performs transactions, and wherein only user data for a particular service is provided in response to a request for user data.

119. The system of claim 118, wherein the returned security token is analysed to determine to which service it relates, and in response thereto user data for that service is provided to that service.

120. A system for storing user data for use in performing transactions with a plurality of service providers, wherein for each user a plurality of data records are stored for use when performing transactions with respective service providers, and wherein only a data record relevant to a particular service provider is made available in response to a request on behalf of that service provider.

121. The system of claim 120, including means for authenticating a request for user data on behalf of a service provider.

122. A data packet for use in authenticating and performing a transaction between a client and a product or service provider, the data packet including data indicative of the product or service provider identity such that the data packet is only useable to authenticate and perform a transaction with that product or service provider.

123. The data packet of claim 122, wherein the data packet includes data indicative of the client identity such that the data packet is only useable to authenticate and perform a transaction with that client.

124. An authentication system for authenticating transactions between a client and a product or service provider, including means for generating a data packet according to claim 122 and means for transmitting the data packet to the service provider.

125. A method of facilitating transactions between a plurality of users registered with an authentication system and plurality of product or service providers, the method including:

providing each user with authentication storage means storing predetermined authentication information, each authentication storage means being couplable to data processing apparatus for data exchange therewith;

generating in response to a request, made using data processing apparatus, from a user to a product or service provider a transaction request data packet including data indicative of the identity of the user and the identity of the product or service provider;

transmitting the transaction request data packet to the authentication system via the data processing apparatus;

analysing in the authentication system the transaction request data packet and extracting therefrom the identity of the user;

transmitting from the authentication system an authentication request signal to the user'"'"'s authentication storage means via the data processing apparatus;

receiving via the data processing apparatus a response from the user'"'"'s authentication storage means at the authentication system;

analysing said response at the authentication system to determine whether said response corresponds to an expected response with reference to knowledge of said predetermined authentication information for that user;

generating an authentication token and providing this to the product or service provider via the data processing apparatus, the authentication token indicating to the product and service provider that the user is authenticated by the authentication system.

126. The method of claim 125, wherein the authentication token includes data indicative of the product or service provider that generated the transaction request data packet corresponding to the authentication token.

127. The method of claim 125, wherein the authentication token includes data indicative of the user.

128. The method of claim 125, including receiving from the service provider at the authentication system a request for payment token, including the authentication token to which it relates, checking the validity of the authentication token prior to authorising a payment to the product or service provider from the user'"'"'s account with the authentication system.

129. A method for carrying out an authentication process for authenticating a subsequent transaction by any one of a plurality of users with an entity by means of data processing apparatus, in which:

the entity generates transaction data relating to the transaction, and during the authentication process the data processing apparatus has operatively associated with it a selected one of a plurality of authentication storage means respective to the users, each authentication storage means storing predetermined authentication information and being registerable with a common telecommunications system for which the users have respective telecommunications terminals;

the method including the step of carrying out the authentication process via a communications link with the common telecommunications system, the authentication process being carried out by authenticating means incorporated in the telecommunications system and involving the use of the predetermined authentication information stored by the selected one authentication storage means, the predetermined authentication information stored by each authentication storage means corresponding to information which is used to authenticate that user'"'"'s telecommunications terminal in relation to the telecommunications system but the authentication process for authenticating the transaction by that user with the data processing apparatus not requiring use of that user'"'"'s telecommunications terminal nor requiring the telecommunications terminal to be actually authenticated by that information in relation to the telecommunications system;

wherein in order to authenticate the transaction, the transaction data is transmitted between the data processing apparatus and the system via a transaction manager implemented by the data processing apparatus, and the predetermined authentication information is also transmitted between the authentication storage means and the system via the transaction manager.