System and method for performing secure online transactions

• US 8,370,262 B2
• Filed: 11/17/2008
• Issued: 02/05/2013
• Est. Priority Date: 11/26/2007
• Status: Active Grant

• Current Assignee: Werner Blessing
• Original Assignee: BIOMETRY.com AG
• Inventors: Blessing, Werner
• Primary Examiner(s): Reagan, James A
• Application Number:
  US12/292,325
• Publication Number:
  US 20090138405A1
• Time in Patent Office: 1,541 Days
• Field of Search: 705/64
• US Class Current: 705/64
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06Q 20/325 using wireless networks
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/388 using mutual authentication without cards, e.g. challenge-response
• CPC Class Codes: G06Q 20/40145 Biometric identity checks
• CPC Class Codes: G06Q 30/00 Commerce
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored

Abstract

The system and method performing secure online-transactions based on challenge/response procedures executed by a terminal of at least one customer and by a terminal of a service provider, such as a bank, which terminals are connected to a network, preferably the Internet. The inventive method including:

• • capturing biometric elements, such as audio and video samples or related biometric data, from the customer during an enrollment procedure and storing the biometric elements in a database, which is accessible by the service provider'"'"'s terminal;
  • executing synchronized challenge procedures for each transaction in order to produce identical challenges based on current transaction data;
  • capturing biometric data from the customer'"'"'s response to the challenge with the customer'"'"'s terminal;
  • delivering transaction data together with the biometric data of the customer'"'"'s response to the service provider'"'"'s terminal;
  • retrieving and assembling biometric elements according to the challenge in order to assemble response in the service provider'"'"'s terminal; and
  • comparing the biometric data of customer'"'"'s response with the data of the assembled response and performing the requested transaction in the event that the data of the responses match.

Claims

1. A method for performing a requested secure online transaction based on challenge/response procedures executed by a terminal of a customer and by a terminal of a service provider, the terminal of the customer and the terminal of the service provider being connected to a network, the method comprising:

a) using the terminal of the service provider for capturing biometric elements from the customer during an enrolment procedure;

b) storing the biometric elements in a database that is accessible by the terminal of the service provider;

c) forwarding a set of processing instructions in a machine readable or in a non-machine readable format to the terminal of the customer for every transaction or for a number of transactions, the processing instructions defining operations to be performed on transaction data contained within a transaction summary that contains the customer'"'"'s requested transaction;

d) based on the processing instructions executing synchronized challenge procedures for each transaction in a first challenge module provided in the terminal of the service provider and in a second challenge module provided in the terminal of the customer, thus producing identical random challenges based on current transaction data and identical processing instructions;

e) capturing, with a capturing module provided in the terminal of the customer, biometric data from a customer'"'"'s response provided for the challenge established by the second challenge module;

f) delivering the transaction data and the biometric data of the customer'"'"'s response to the terminal of the service provider;

g) retrieving from the database and assembling, in a response module provided in the terminal of the service provider, biometric elements according to the challenge established by the first challenge module in order to create a separate response; and

h) comparing, with a biometric authentication module provided in the terminal of the service provider, the biometric data of the customer'"'"'s response with the data of the assembled separate response and performing the requested transaction in the event that the responses match.

2. The method according to claim 1 further comprising:

performing an enrolment procedure for the customer including capturing and storing biometric elements that relate to movements of the customer'"'"'s mouth region, as well as simultaneously capturing corresponding audio information comprising vowels and consonants, or speech segments.

3. The method according to claim 2, wherein the movements of the customer'"'"'s mouth region are movements of the lips and tongue.

4. The method according to claim 1 further comprising:

examining a sequence of the biometric data captured from the customer'"'"'s response in the terminal of the service provider in order to determine whether an uninterrupted, seamless data stream has been provided from the terminal of the customer and rejecting the requested transaction in the event that it is found that the data stream received from the terminal of the customer has been assembled.

5. The method according to claim 4 further comprising:

enclosing a data sequence in the biometric data, in the terminal of the customer and extracting and examining the enclosed data sequence in the terminal of the service provider.

6. The method according to claim 1 wherein the processing instructions are given so as to extract at least part of an address of a beneficiary of the transaction and/or at least part of a transaction value, goods or numbers, out of the transaction data and perform the challenge procedures based on the extracted data.

7. The method according to claim 1 further comprising:

applying the set of processing instructions manually, automatically in a sequence or according to a specific rule or reference, which is provided in a machine readable or in a non-machine readable format.

8. The method according to claim 7 further comprising:

combining extracted transaction data with a current set of processing instructions that directly contains, or indirectly points to, specific fixed or variable data.

9. The method according to claim 1 further comprising:

performing voice recognition and/or face recognition based on patterns captured and stored during enrolment.

10. The method according to claim 1, wherein the biometric elements comprise at least one of audio and video samples or related biometric data from the customer.

11. The method according to claim 1 further comprising:

as a separate challenge, displaying to the customer in a non-machine readable format a reference symbol that corresponds to the set of processing instructions;

wherein the synchronized challenge procedures are executed only after receiving from the customer a correct input that corresponds to the reference symbol.

12. A network-based system designed for performing a secure online transaction based on challenge/response procedures executed with a terminal of a customer, which is equipped with audio- and video-recording devices, and with a terminal of a service provider, which is connected to a database that contains biometric elements, including audio and video samples captured from the customer during an enrollment procedure or biometric data related to the audio and video samples, the system comprising:

a) a first challenge module that is provided in the terminal of the service provider and a second challenge module that is provided in the terminal of the customer, wherein the first and second challenge modules allow randomly producing identical challenges for each transaction based on synchronized processing instructions, the processing instructions defining operations to be performed on transaction data contained within a transaction summary that contains the customer'"'"'s requested transaction;

b) a response module provided in the terminal of the service provider that allows assembling biometric elements according to a challenge established by the first challenge module in order to assemble a response;

c) a capturing module provided in the terminal of the customer that allows capturing biometric data from a customer'"'"'s response to a challenge established by the second challenge module; and

d) a biometric authentication module provided in the terminal of the service provider that allows comparing data of the assembled response with data of the customer'"'"'s response that has been received from the terminal of the customer who provided the response to the challenge established by the second challenge module in order to determine whether the assembled response and the customer'"'"'s response match.

13. The network-based system according to claim 12, further comprising:

a) a first administration module provided in the terminal of the service provider designed for entering a session with the terminal of the customer and to process a login request sent by the customer based on a stored customer profile retrieved from the database; and

b) a second administration module provided in the terminal of the customer designed for entering a session with the terminal of the service provider and to process and forward a login request.

14. The network-based system according to claim 12, wherein the terminal of the service provider comprises an authentication server and a transaction server.

15. The network-based system according to claim 12, further comprising a dedicated data channel for transferring encrypted or unencrypted sequence data that are used for synchronizing the first challenge module provided in the terminal of the service provider with the second challenge module provided in the terminal of the customer.

16. The network-based system according to claim 15, wherein the synchronization means is a dedicated data channel or a mobile memory unit.

17. The network-based system according to claim 12, wherein the terminal of the customer is a mobile phone that is equipped with a camera.