System and method for performing secure online transactions

• US 20090138405A1
• Filed: 11/17/2008
• Published: 05/28/2009
• Est. Priority Date: 11/26/2007
• Status: Active Grant

• Current Assignee: Werner Blessing
• Original Assignee: BIOMETRY.com AG
• Inventors: Blessing, Werner
• Granted Patent: US 8,370,262 B2
• Time in Patent Office: Days
• US Class Current: 705/67
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06Q 20/325 using wireless networks
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 30/00 Commerce
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored

Abstract

The system and method performing secure online-transactions based on challenge/response procedures executed by a terminal of at least one customer and by a terminal of a service provider, such as a bank, which terminals are connected to a network, preferably the Internet. The inventive method including:

• • capturing biometric elements, such as audio and video samples or related biometric data, from the customer during an enrolment procedure and storing the biometric elements in a database, which is accessible by the service provider'"'"'s terminal
  • executing synchronised challenge procedures for each transaction in order to produce identical challenges based on current transaction data;
  • capturing biometric data from the customer'"'"'s response to the challenge with the customer'"'"'s terminal;
  • delivering transaction data together with the biometric data of the customer'"'"'s response to the service provider'"'"'s terminal;
  • retrieving and assembling biometric elements according to the challenge in order to assemble response in the service provider'"'"'s terminal; and
  • comparing the biometric data of customer'"'"'s response with the data of the assembled response and performing the requested transaction in the event that the data of the responses match.

Claims

1. Method for performing secure online-transactions based on challenge/response procedures executed by a terminal of at least one customer and by a terminal of a service provider, such as a bank, which terminals are connected to a network, preferably the Internet, comprising the steps of

a) capturing biometric elements, such as audio and video samples or related biometric data, from the customer during an enrolment procedure;

b) storing the biometric elements in a database, which is accessible by the service provider'"'"'s terminal;

c) executing challenge procedures for each transaction in order to produce synchronised challenges based on current transaction data and identical processing instructions in a first challenge module provided in the service providers terminal and in a second challenge module provided in the customer'"'"'s terminals;

d) with a capturing module provided in the customer'"'"'s terminal, capturing biometric data from the customer'"'"'s response provided for the challenge established by the second challenge module;

e) delivering transaction data together with the biometric data of the customer'"'"'s response to the service provider'"'"'s terminal;

f) in a response module provided in the service providers terminal, retrieving and assembling biometric elements according to the challenge established by the first challenge module in order to create a separate response; and

g) with a biometric authentication module provided in the service providers terminal, comparing the biometric data of the customer'"'"'s response with the data of the assembled response and performing the requested transaction in the event that the responses match.

2. Method according to claim 1 comprising the steps of performing an enrolment procedure for the customer including capturing and storing biometric elements that relate to movements of the customer'"'"'s mouth region, particularly movements of the lips and tongue as well as simultaneously capturing corresponding audio information, preferably comprising vowels and consonants, or speech segments, preferably comprising the numbers of 0, . . . , 9.

3. Method according to claim 1 comprising the steps of examining the sequence of biometric data captured from the customer'"'"'s response in the service provider'"'"'s terminal in order to determine, whether an uninterrupted, seamless data stream has been provided and rejecting the requested transaction in the event that it is found that the data stream received from the customer'"'"'s terminal has been assembled.

4. Method according to claim 3 comprising the steps of enclosing a data sequence in the biometric data, such as the time or a sequence of numbers, in the customer'"'"'s terminal and extracting and examining the enclosed data sequence in the service provider'"'"'s terminal.

5. Method according to claim 1 comprising the steps of extracting at least part of the address of the beneficiary of the transaction and/or at least part of the transaction value, goods or numbers, out of the transaction data and performing the challenge procedures based on these data.

6. Method according to claim 1 comprising the steps of forwarding at least one set of processing instructions in a machine readable or in a non-machine readable format to the customer'"'"'s terminal for every transaction or for a number of transactions, which sets of processing instructions are applied manually, automatically in a sequence or according to a specific rule or reference, which is provided in a machine readable or in a non-machine readable format.

7. Method according to claim 6 comprising the steps of combining extracted transaction data with the current set of processing instructions that directly contains or indirectly points to specific fixed or variable data, such as a constant number or the current date or time.

8. Method according to claim 1 comprising the steps of additionally performing voice recognition and/or face recognition based on patterns capture and stored during enrolment.

9. A network-based system designed to operate according to a method as defined in claim 1 for performing secure online-transactions based on challenge/response procedures executed with at least one customer'"'"'s terminals, which is equipped with audio- and video-recording devices and with a terminal of at least one service provider, such as a bank, which is connected to a database that is containing biometric elements such as audio and video samples or related biometric data that were captured from the customer during an enrolment procedure, characterised in that

a) a first challenge module is provided in the service providers terminal and a second challenge module is provided in the customer'"'"'s terminal, which first and second challenge modules allow producing identical challenges for each transaction based on current transaction data and synchronised processing instructions;

b) a response module provided in the service providers terminal that allows assembling biometric elements according to the challenge established by the first challenge module in order to assemble response; and

c) a capturing module provided in the customer'"'"'s terminal that allows capturing biometric data from the customer'"'"'s response to the challenge established by the second challenge module;

d) a biometric authentication module provided in the service provider'"'"'s terminal that allows comparing the data of the assembled response with the data of the customer'"'"'s response that has been received from the customer'"'"'s terminal together with related transaction data in order to determine whether the responses match.

10. A network-based system according to claim 9 with

a) a first administration module provided in the service providers terminal designed for entering a session with the customer'"'"'s terminal and to process a login request sent by the customer based on a stored customer profile retrieved from the database;

and

b) a second administration module provided in the customer'"'"'s terminal designed for entering a session with the service provider'"'"'s terminal and to process and forward a login request.

11. A network-based system according to claim 9 with an authentication server that, together with a transaction server, is part of the service providers terminal.

12. A network-based system according to claim 9 with synchronisation means such as a dedicated data channel or a mobile memory unit for transferring encrypted or unencrypted sequence data that is used for synchronising the first and second challenge modules from the service providers terminal to the customer'"'"'s terminal.

13. A network-based system according to claim 9, with the customer'"'"'s terminal being a mobile phone that is equipped with a camera.