US20170286957A1 - Mutual Authentication of a User and Service Provider - Google Patents
Mutual Authentication of a User and Service Provider Download PDFInfo
- Publication number
- US20170286957A1 US20170286957A1 US15/631,598 US201715631598A US2017286957A1 US 20170286957 A1 US20170286957 A1 US 20170286957A1 US 201715631598 A US201715631598 A US 201715631598A US 2017286957 A1 US2017286957 A1 US 2017286957A1
- Authority
- US
- United States
- Prior art keywords
- event
- key
- user
- computing device
- kgm
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/409—Device specific authentication in transaction processing
- G06Q20/4097—Device specific authentication in transaction processing using mutual authentication between devices and transaction partners
- G06Q20/40975—Device specific authentication in transaction processing using mutual authentication between devices and transaction partners using encryption therefor
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/08—Payment architectures
- G06Q20/20—Point-of-sale [POS] network systems
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0869—Network architectures or network communication protocols for network security for authentication of entities for achieving mutual authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
- H04L9/3228—One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/56—Financial cryptography, e.g. electronic payment or e-cash
Definitions
- Embodiments of the present disclosure relate to a mutual authentication between user and a service provider. More specifically, embodiments relate to a method of mutual authentication using secondary verification using out of band communication.
- the present disclosure provides a method for mutual authentication of user and a service provider by authenticating an event by a key generation module (KGM) wherein said even is generated on a computing device by a user, sending a shared secret of registered user for the event by an authentication server to a the KGM, generating one time key by the KGM for the initiated event, transmitting the one time key by appending the shared secret to registered user mobile device either as audio or video.
- KGM key generation module
- the KGM is a service provider server.
- the KGM comprises a service provider server and third party server.
- the event to be authenticated is transmitted by the service provider server to the authentication server through the third party server, said authentication server provides the shared secret to the third party server.
- the third party server generates the one time key.
- the event is terminated by locking the registered user's account.
- the appended key is transmitted using at least one of the communication channel including but is not limiting to Single Data Message Format (SDMF), Unstructured Supplementary Services Data (USSD), 3G video over voice and GPRS.
- SDMF Single Data Message Format
- USSD Unstructured Supplementary Services Data
- 3G video over voice and GPRS.
- the event is initiated by providing a missed call to the KGM.
- a mobile application is automatically invoked upon receipt of an authentication command on the mobile device to display the appended key.
- the shared secret includes but is not limiting to images, sound, word, phrase, numerical numbers and alphanumeric word.
- the one-time key includes but is not limiting to symbol, alphanumeric word, and numerical numbers.
- the authentication server generates a digital code and transmits it along with mobile number of the registered user to the service provider to unlock the registered user's account upon receipt of unlock request from the registered user.
- the present disclosure also provides a system for authenticating a user, said system comprising: a computing device to initiate an event to be authenticated, a KGM configured to generate a one-time key for the initiated event and appending the generated one-time key with shared secret of a user registered with a service provider, mobile device to receive the appended key from the server, wherein the user upon receipt of the appended key on his mobile device either as audio or video performs at least one of:
- the server transmits the appended key to the mobile device using at least one of the communication channel selected from the group comprising Single Data Message Format (SDMF), Multiple Data Message Format (MDMF), Unstructured Supplementary Services Data (USSD), 3G video over voice, interactive voice response IVR, place telephone call and GPRS.
- SDMF Single Data Message Format
- MDMF Multiple Data Message Format
- USSD Unstructured Supplementary Services Data
- 3G video over voice interactive voice response IVR
- place telephone call place telephone call and GPRS.
- the computing device includes but is not limiting to Automated Teller Machine (ATM), computer, mobile phone, Personal Digital Assistance (PDA), Point of Sale (POS) terminal, any device capable of doing e-banking and other related devices.
- ATM Automated Teller Machine
- PDA Personal Digital Assistance
- POS Point of Sale
- FIG. 1 illustrates a block diagram for two way authentications for an event according to one embodiment of the disclosure.
- FIG. 2 illustrates a block diagram of one exemplary embodiment where service provider acts as a key generation module.
- FIG. 3 illustrates a block diagram of one exemplary embodiment where a third party server generates a one-time key.
- FIG. 4 is a flow diagram illustrates step by step process for carrying out two way authentication.
- FIG. 1 illustrates an embodiment wherein an event to be authenticated is generated by user on a computing device 103 .
- the event could be user swiping a credit card on a point of sale terminal (POS).
- POS point of sale terminal
- KGM key generation module
- the KGM 102 will check for the corresponding user details of the credit card in an authentication server 101 .
- the authentication server 101 stores details of the credit card and its user who has registered his name in the authentication server 101 .
- the authentication server 101 stores mobile number of the user mobile device and a secret shared by the registered user.
- the KGM 102 fetches the shared secret and the mobile number of the registered user for the credit card.
- the one time key is then appended with the shared secret and is sent to the mobile device.
- the registered user receives and checks for shared secret. If the shared secret is same as one which he has already shared with the authentication server during registration, the registered user is sure about receiving the one time key form an authorized source and not from a impersonate party.
- the user who initiated the event is not the registered user, then he would not receive the one time key to enter in to enter on to the POS thus terminating the event by the KGB as it did not receive the valid one-time key associate with the event within a predefined time. Also, the registered user who receives the appended key having shared secret and one time key will have a choice to terminate the event or to lock his account by pressing a predetermined key on his mobile device.
- FIG. 2 shows one exemplary embodiment of the disclosure.
- User registers a phone number with customers account information within a financial institution such as a bank.
- This concept can be applied to other business/commerce entities as well that would like to allow its customers to purchase good online and make payment online via a mobile device.
- the process creates a non-repudiation overlay channel wherein the two parties that enter into a transaction of any type can fallback onto an accepted level of commitment upon themselves to honor the transaction.
- the mutual acceptance of the performance of a transaction is conducted in real-time before the transaction is completed. If the performance level is unacceptable to any party then the transaction is considered as failure and no annoyance or mistrust is created.
- the process uses an out-of-band channel of communication for the mutual authentication to be performed.
- the out-of-band communication channel is the mobile/cellular network, which is secure and robust.
- the process is not restrictive of having other media of communication to be incorporated into this out-of-band communication method, if desired.
- bank be a service provider who stores all customer's information in an authentication server.
- the authentication server also stores a shared secret between the service provider and the customer.
- User or customer initiates an event with a service provider by making a financial transaction, for example to transfer money from his account to other account on a computer.
- the service provider 201 will generate a one-time key for the event.
- the service provider 201 will check for the corresponding user details for the transaction in an authentication server 101 .
- the authentication server 101 will have the details of users who have registered his name with the authentication server 101 .
- the user who initiated the event has to enter the one time key onto the computer to complete the transaction.
- the server 101 comprises mobile number of the user mobile device and a secret shared by the registered user.
- the service provider 201 fetches the shared secret and the mobile number of the registered user for the credit card.
- the one time key is then appended with the shared secret and is sent to the mobile device.
- the registered user receives and checks for shared secret. If the shared secret is same as one which he has already shared with the authentication server during registration, the registered user is sure about receiving the one time key form an authorized source and not from a impersonate party.
- the user who initiated the event is same as the one who receives the appended key, then the user enters the one time key on to the computing device 103 which is computer in this example to authenticate himself with the service provider. This will enable the event to be processed further. Thus by using the shared secret and one time key mutual authentication is achieved.
- the user who initiated the event is not the registered user, then he would not receive the one time key to enter in to computing device 103 and thus results in terminating the event.
- the event would terminated if the one-time key is not enter on the computing device 103 within a predefined amount of time, say for example 15 minutes, or when an invalid/wrong key is entered.
- the registered user who receives the appended key having shared secret and one time key will have a choice to terminate the event or/and to lock his account. This is achieved by user entering a predetermined key sequence on his mobile device which will be sent to the service provider 201 .
- FIG. 3 illustrates an alternative embodiment for mutually authenticating the event.
- the service provider authenticates a third party server 301 to provide mutually authentication for the event.
- the third party server 301 then generates one time key for the event.
- the third party server 301 will check for the corresponding user details for the event from the authentication server 101 .
- the authentication server 101 stores details of the debit card and its user who has registered his name in the authentication server 101 .
- the user who initiated the event has to enter the one time key on to the computer to complete the transaction.
- the server 101 comprises mobile number of the user mobile device and a secret shared by the registered user.
- the third party server 301 fetches the shared secret and the mobile number of the registered user for the debit card.
- the one time key is then appended with the shared secret and is sent to the mobile device.
- the registered user receives and checks for shared secret. If the shared secret is same as one which he has already shared with the authentication server during registration, the registered user is sure about receiving the one time key form an authorized source and not from a impersonate party.
- the user who initiated the event is same as the one who receives the appended key, then the user enters the one time key on to the computer to authenticate himself with the third party server 301 . This will enable the event to be processed further. Thus by using the shared secret and one time key mutual authentication is achieved.
- the user who initiated the event is not the registered user, then he would not receive the one time key to enter in to enter on to the computer to complete the transaction thus terminating the event.
- the event will be automatically terminated by the third party server 301 if a valid key is not entered with a predefined time period.
- the registered user who receives the appended key having shared secret and one time key will have a choice to terminate the event or to lock his account by pressing a predetermined key on his mobile device.
- the third party server 301 when received the predetermined key sequence from the mobile device it would terminate the event and/or lock his account.
- the appended key is transmitted to the mobile device either as audio or video or using a caller ID mechanism or any other technically feasible means.
- the shared secret or credential might be a sound file, an image, or a PIN. It could also be a unique string, alphanumeric word, special characters, number sequence or a video.
- This new process creates a process of registering a phone number which will be related to the customer's account information within a financial institution such as a bank.
- This concept can be applied to other business/commerce entities as well that would like to allow its customers to purchase good online and make payment online.
- the process creates a non-repudiation overlay channel wherein the two parties that enter into a transaction of any type can fallback onto an accepted level of commitment upon themselves to honor the transaction.
- the mutual acceptance of the performance of a transaction is conducted in real-time before the transaction is completed. If the performance level is unacceptable to any party then the transaction is considered a failure and no annoyance or mistrust is created.
- the process uses an out-of-band channel of communication for the mutual authentication to be performed.
- the out-of-band communication channel is the mobile/cellular network, which is secure and robust. The process is not restrictive of having other media of communication to be incorporated into this out-of-band communication method, if desired.
- FIG. 4 is a flow diagram of method for authorizing a user, according to one embodiment of the invention. Although the method steps are described in conjunction with FIG. 1-3 , persons skilled in the art will understand that any system configured to perform the method steps, in any order, is within the scope of the invention.
- the method begins in step 401 , where an authorization event is initiated by user.
- the authorization request is initiated when the user attempts to log into a web page, presenting a user name and password as authorization credentials for financial transaction.
- the user may present a card or other form of identification device to initiate an authorization request like using a credit for shopping.
- the event could be generated after user login into his account by providing appropriate credentials for authentication.
- a one-time key is generated for the event by a KGM.
- This one time key is then appended with the shared secret of the user.
- the append key is then transmitted to registered user mobile device at step 404 . If the registered user has initiated the event then he would enter the one time key to complete the event 406 . If the KGM receives the one time key it would authenticate the event. The shared secret will confirm the registered user that the one-time key has not been initiated by any impersonator. If the registered user has not initiated the event then he would terminate the event or lock his account or both by pressing predefined sequence on the mobile device 407 . When the KGM receives the predefined sequence form the mobile device then it would initiate action to either terminate the event or lock the user account or do both.
- the event is automatically terminated.
- the event is terminated by KGM if one time key is not entered to with predefined time period.
- a register user generates an event by providing a missed call or by sending an SMS to the KGM.
Abstract
Description
- This application is a continuation of U.S. application Ser. No. 15/016,205, filed Feb. 4, 2016, to be issued as U.S. Pat. No. 9,699,183, which is a continuation of U.S. application Ser. No. 13/637,998, now U.S. Pat. No. 9,275,379, which is a 371 U.S. National Stage of International Application No. PCT/IB2011/051382, filed on Mar. 31, 2011, which claims priority to Indian Patent Application No. 915/CHE/2010, filed on Mar. 31, 2010, and Indian Patent Application No. 154/CHE/2010, filed on Apr. 22, 2010, each of which are incorporated by reference in their entirety.
- Embodiments of the present disclosure relate to a mutual authentication between user and a service provider. More specifically, embodiments relate to a method of mutual authentication using secondary verification using out of band communication.
- In electronic commerce, online transaction wherein a client logs into his/her bank or financial institutions account via the web-site offered by the financial institution has always fallen prey to hackers and phishers who guess login-id and passwords and perform fraud. The Financial transaction world has tried to avoid this by making passwords more and more complicated, login-id more obscure, images recognition, etc. The hackers and the phishers have always out-smarted them with newer techniques like key logging, transparent proxy-ing, dynamic DNS re-routing, etc.
- As electronic commerce expands, so does electronic fraud and identity theft. Because a single factor is sufficient to access a user account or perform a transaction, fraud and identity theft only requires a perpetrator to acquire the single factor knowledge. A consequence of the broad acceptance of single factor authentication is, therefore, broad and pervasive fraud and identity theft. Also, for example, a user accessing his financial account on-line is not sure whether the transaction he as initiate is with genuine financial institution website or with some hacker trying to impersonate the financial institution website. Hence there is a need to address the above mentioned issues.
- In light of forgoing discussion, there is a need for mutual authentication between user and a service provider to overcome the limitations stated above.
- The shortcomings of the prior art are overcome and additional advantages are provided through the provision of a method, device and a system as described in the description.
- In one embodiment, the present disclosure provides a method for mutual authentication of user and a service provider by authenticating an event by a key generation module (KGM) wherein said even is generated on a computing device by a user, sending a shared secret of registered user for the event by an authentication server to a the KGM, generating one time key by the KGM for the initiated event, transmitting the one time key by appending the shared secret to registered user mobile device either as audio or video. Authenticating the user for said event by the KGM when a registered user enters the one-time key on the computing device within a predetermined time period. Alternatively, terminating the event by the KGM upon receipt of predefined key sequence from the mobile device.
- In one embodiment, the KGM is a service provider server.
- In one embodiment, the KGM comprises a service provider server and third party server.
- In one embodiment, the event to be authenticated is transmitted by the service provider server to the authentication server through the third party server, said authentication server provides the shared secret to the third party server.
- In an alternative embodiment, the third party server generates the one time key.
- In one embodiment the event is terminated by locking the registered user's account.
- In one embodiment the appended key is transmitted using at least one of the communication channel including but is not limiting to Single Data Message Format (SDMF), Unstructured Supplementary Services Data (USSD), 3G video over voice and GPRS.
- In one embodiment, the event is initiated by providing a missed call to the KGM.
- In one embodiment, a mobile application is automatically invoked upon receipt of an authentication command on the mobile device to display the appended key.
- In one embodiment, the shared secret includes but is not limiting to images, sound, word, phrase, numerical numbers and alphanumeric word.
- In one embodiment, the one-time key includes but is not limiting to symbol, alphanumeric word, and numerical numbers.
- In one embodiment, the authentication server generates a digital code and transmits it along with mobile number of the registered user to the service provider to unlock the registered user's account upon receipt of unlock request from the registered user.
- In one embodiment, the present disclosure also provides a system for authenticating a user, said system comprising: a computing device to initiate an event to be authenticated, a KGM configured to generate a one-time key for the initiated event and appending the generated one-time key with shared secret of a user registered with a service provider, mobile device to receive the appended key from the server, wherein the user upon receipt of the appended key on his mobile device either as audio or video performs at least one of:
- entering the one-time key on the computing device for authenticating the user for said event, or
- pressing a predefined key sequence on the mobile device to lock the user's account to terminate the event, if the event is not initiated by the user.
- In one embodiment, the server transmits the appended key to the mobile device using at least one of the communication channel selected from the group comprising Single Data Message Format (SDMF), Multiple Data Message Format (MDMF), Unstructured Supplementary Services Data (USSD), 3G video over voice, interactive voice response IVR, place telephone call and GPRS.
- In one embodiment the computing device includes but is not limiting to Automated Teller Machine (ATM), computer, mobile phone, Personal Digital Assistance (PDA), Point of Sale (POS) terminal, any device capable of doing e-banking and other related devices.
- The foregoing summary is illustrative only and is not intended to be in any way limiting. In addition to the illustrative aspects, embodiments, and features described above, further aspects, embodiments, and features will become apparent by reference to the drawings and the following detailed description.
- The novel features and characteristic of the disclosure are set forth in the appended claims. The disclosure itself, however, as well as a preferred mode of use, further objectives and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying figures. One or more embodiments are now described, by way of example only, with reference to the accompanying figures wherein like reference numerals represent like elements and in which:
-
FIG. 1 illustrates a block diagram for two way authentications for an event according to one embodiment of the disclosure. -
FIG. 2 illustrates a block diagram of one exemplary embodiment where service provider acts as a key generation module. -
FIG. 3 illustrates a block diagram of one exemplary embodiment where a third party server generates a one-time key. -
FIG. 4 is a flow diagram illustrates step by step process for carrying out two way authentication. - In the following detailed description, reference is made to the accompanying figures, which form a part hereof. In the figures, similar symbols typically identify similar components, unless context dictates otherwise. The illustrative embodiments described in the detailed description, figures, and claims are not meant to be limiting. Other embodiments may be utilized, and other changes may be made, without departing from the spirit or scope of the subject matter presented herein. It will be readily understood that the aspects of the present disclosure, as generally described herein, and illustrated in the figures, can be arranged, substituted, combined, and designed in a wide variety of different configurations, all of which are explicitly contemplated and make part of this disclosure.
-
FIG. 1 illustrates an embodiment wherein an event to be authenticated is generated by user on acomputing device 103. For example, the event could be user swiping a credit card on a point of sale terminal (POS). Once the event is generated a key generation module (KGM) 102 generates a one-time key for the event to be authenticated. This one time key has to be entered by the user on the POS to complete the transaction. The KGM 102 will check for the corresponding user details of the credit card in anauthentication server 101. Theauthentication server 101 stores details of the credit card and its user who has registered his name in theauthentication server 101. Along with other user details, theauthentication server 101 stores mobile number of the user mobile device and a secret shared by the registered user. The KGM 102 fetches the shared secret and the mobile number of the registered user for the credit card. The one time key is then appended with the shared secret and is sent to the mobile device. The registered user receives and checks for shared secret. If the shared secret is same as one which he has already shared with the authentication server during registration, the registered user is sure about receiving the one time key form an authorized source and not from a impersonate party. - Now, if the user who initiated the event is same as the one who receives the appended key, then the user enters the one time key on to the POS to authenticate himself with the KGM. Thus KGM authenticates the event when it receives the valid one-time key associated with the event. This will enable the event to be processed further. Thus by using the shared secret and one time key mutual authentication is achieved.
- If the user who initiated the event is not the registered user, then he would not receive the one time key to enter in to enter on to the POS thus terminating the event by the KGB as it did not receive the valid one-time key associate with the event within a predefined time. Also, the registered user who receives the appended key having shared secret and one time key will have a choice to terminate the event or to lock his account by pressing a predetermined key on his mobile device.
-
FIG. 2 shows one exemplary embodiment of the disclosure. User registers a phone number with customers account information within a financial institution such as a bank. This concept can be applied to other business/commerce entities as well that would like to allow its customers to purchase good online and make payment online via a mobile device. The process creates a non-repudiation overlay channel wherein the two parties that enter into a transaction of any type can fallback onto an accepted level of commitment upon themselves to honor the transaction. The mutual acceptance of the performance of a transaction is conducted in real-time before the transaction is completed. If the performance level is unacceptable to any party then the transaction is considered as failure and no annoyance or mistrust is created. The process uses an out-of-band channel of communication for the mutual authentication to be performed. The out-of-band communication channel is the mobile/cellular network, which is secure and robust. The process is not restrictive of having other media of communication to be incorporated into this out-of-band communication method, if desired. As an example, let bank be a service provider who stores all customer's information in an authentication server. The authentication server also stores a shared secret between the service provider and the customer. - User or customer initiates an event with a service provider by making a financial transaction, for example to transfer money from his account to other account on a computer. When the user initiates the event, the
service provider 201 will generate a one-time key for the event. Also, theservice provider 201 will check for the corresponding user details for the transaction in anauthentication server 101. Theauthentication server 101 will have the details of users who have registered his name with theauthentication server 101. The user who initiated the event has to enter the one time key onto the computer to complete the transaction. - Along with other user details stored in the
authentication server 101, theserver 101 comprises mobile number of the user mobile device and a secret shared by the registered user. Theservice provider 201 fetches the shared secret and the mobile number of the registered user for the credit card. The one time key is then appended with the shared secret and is sent to the mobile device. The registered user receives and checks for shared secret. If the shared secret is same as one which he has already shared with the authentication server during registration, the registered user is sure about receiving the one time key form an authorized source and not from a impersonate party. - Now, if the user who initiated the event is same as the one who receives the appended key, then the user enters the one time key on to the
computing device 103 which is computer in this example to authenticate himself with the service provider. This will enable the event to be processed further. Thus by using the shared secret and one time key mutual authentication is achieved. - If the user who initiated the event is not the registered user, then he would not receive the one time key to enter in to
computing device 103 and thus results in terminating the event. The event would terminated if the one-time key is not enter on thecomputing device 103 within a predefined amount of time, say for example 15 minutes, or when an invalid/wrong key is entered. Also, the registered user who receives the appended key having shared secret and one time key will have a choice to terminate the event or/and to lock his account. This is achieved by user entering a predetermined key sequence on his mobile device which will be sent to theservice provider 201. -
FIG. 3 illustrates an alternative embodiment for mutually authenticating the event. When an event is generated, for example, online purchase of a commodity using a debit card on a computer, the service provider authenticates athird party server 301 to provide mutually authentication for the event. Thethird party server 301 then generates one time key for the event. Also, thethird party server 301 will check for the corresponding user details for the event from theauthentication server 101. Theauthentication server 101 stores details of the debit card and its user who has registered his name in theauthentication server 101. The user who initiated the event has to enter the one time key on to the computer to complete the transaction. - Along with other user details stored in the
authentication server 101, theserver 101 comprises mobile number of the user mobile device and a secret shared by the registered user. Thethird party server 301 fetches the shared secret and the mobile number of the registered user for the debit card. The one time key is then appended with the shared secret and is sent to the mobile device. The registered user receives and checks for shared secret. If the shared secret is same as one which he has already shared with the authentication server during registration, the registered user is sure about receiving the one time key form an authorized source and not from a impersonate party. - Now, if the user who initiated the event is same as the one who receives the appended key, then the user enters the one time key on to the computer to authenticate himself with the
third party server 301. This will enable the event to be processed further. Thus by using the shared secret and one time key mutual authentication is achieved. - If the user who initiated the event is not the registered user, then he would not receive the one time key to enter in to enter on to the computer to complete the transaction thus terminating the event. The event will be automatically terminated by the
third party server 301 if a valid key is not entered with a predefined time period. Also, the registered user who receives the appended key having shared secret and one time key will have a choice to terminate the event or to lock his account by pressing a predetermined key on his mobile device. Thethird party server 301 when received the predetermined key sequence from the mobile device it would terminate the event and/or lock his account. - The appended key is transmitted to the mobile device either as audio or video or using a caller ID mechanism or any other technically feasible means. The shared secret or credential might be a sound file, an image, or a PIN. It could also be a unique string, alphanumeric word, special characters, number sequence or a video.
- This new process creates a process of registering a phone number which will be related to the customer's account information within a financial institution such as a bank. This concept can be applied to other business/commerce entities as well that would like to allow its customers to purchase good online and make payment online. The process creates a non-repudiation overlay channel wherein the two parties that enter into a transaction of any type can fallback onto an accepted level of commitment upon themselves to honor the transaction. The mutual acceptance of the performance of a transaction is conducted in real-time before the transaction is completed. If the performance level is unacceptable to any party then the transaction is considered a failure and no annoyance or mistrust is created. The process uses an out-of-band channel of communication for the mutual authentication to be performed. The out-of-band communication channel is the mobile/cellular network, which is secure and robust. The process is not restrictive of having other media of communication to be incorporated into this out-of-band communication method, if desired.
-
FIG. 4 is a flow diagram of method for authorizing a user, according to one embodiment of the invention. Although the method steps are described in conjunction withFIG. 1-3 , persons skilled in the art will understand that any system configured to perform the method steps, in any order, is within the scope of the invention. - The method begins in
step 401, where an authorization event is initiated by user. In one embodiment, the authorization request is initiated when the user attempts to log into a web page, presenting a user name and password as authorization credentials for financial transaction. In an alternate embodiment, the user may present a card or other form of identification device to initiate an authorization request like using a credit for shopping. In one embodiment the event could be generated after user login into his account by providing appropriate credentials for authentication. - In step 402 a one-time key is generated for the event by a KGM. This one time key is then appended with the shared secret of the user. The append key is then transmitted to registered user mobile device at step 404. If the registered user has initiated the event then he would enter the one time key to complete the
event 406. If the KGM receives the one time key it would authenticate the event. The shared secret will confirm the registered user that the one-time key has not been initiated by any impersonator. If the registered user has not initiated the event then he would terminate the event or lock his account or both by pressing predefined sequence on themobile device 407. When the KGM receives the predefined sequence form the mobile device then it would initiate action to either terminate the event or lock the user account or do both. Further, if the user who initiated the event would not receive the one time key which is required to complete the event on his mobile device. Thus by not entering the one time key the event is automatically terminated. In one embodiment the event is terminated by KGM if one time key is not entered to with predefined time period. - In one embodiment, a register user generates an event by providing a missed call or by sending an SMS to the KGM.
- The present disclosure is not to be limited in terms of the particular embodiments described in this application, which are intended as illustrations of various aspects. Many modifications and variations can be made without departing from its spirit and scope, as will be apparent to those skilled in the art. Functionally equivalent methods and devices within the scope of the disclosure, in addition to those enumerated herein, will be apparent to those skilled in the art from the foregoing descriptions. Such modifications and variations are intended to fall within the scope of the appended claims. The present disclosure is to be limited only by the terms of the appended claims, along with the full scope of equivalents to which such claims are entitled. It is also to be understood that the terminology used herein is for the purpose of describing particular embodiments only, and is not intended to be limiting.
- With respect to the use of substantially any plural and/or singular terms herein, those having skill in the art can translate from the plural to the singular and/or from the singular to the plural as is appropriate to the context and/or application. The various singular/plural permutations may be expressly set forth herein for sake of clarity.
- In addition, where features or aspects of the disclosure are described in terms of Markush groups, those skilled in the art will recognize that the disclosure is also thereby described in terms of any individual member or subgroup of members of the Markush group.
- While various aspects and embodiments have been disclosed herein, other aspects and embodiments will be apparent to those skilled in the art. The various aspects and embodiments disclosed herein are for purposes of illustration and are not intended to be limiting, with the true scope and spirit being indicated by the following claims.
Claims (20)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/631,598 US20170286957A1 (en) | 2010-03-31 | 2017-06-23 | Mutual Authentication of a User and Service Provider |
Applications Claiming Priority (8)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
IN915CH2010 | 2010-03-31 | ||
IN915/CHE/2010 | 2010-03-31 | ||
IN154CH2010 | 2010-04-22 | ||
IN154/CHE/2010 | 2010-04-22 | ||
PCT/IB2011/051382 WO2011121566A1 (en) | 2010-03-31 | 2011-03-31 | A method for mutual authentication of a user and service provider |
US201213637998A | 2012-09-28 | 2012-09-28 | |
US15/016,205 US9699183B2 (en) | 2010-03-31 | 2016-02-04 | Mutual authentication of a user and service provider |
US15/631,598 US20170286957A1 (en) | 2010-03-31 | 2017-06-23 | Mutual Authentication of a User and Service Provider |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/016,205 Continuation US9699183B2 (en) | 2010-03-31 | 2016-02-04 | Mutual authentication of a user and service provider |
Publications (1)
Publication Number | Publication Date |
---|---|
US20170286957A1 true US20170286957A1 (en) | 2017-10-05 |
Family
ID=44711413
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/637,998 Expired - Fee Related US9275379B2 (en) | 2010-03-31 | 2011-03-31 | Method for mutual authentication of a user and service provider |
US15/016,205 Expired - Fee Related US9699183B2 (en) | 2010-03-31 | 2016-02-04 | Mutual authentication of a user and service provider |
US15/631,598 Abandoned US20170286957A1 (en) | 2010-03-31 | 2017-06-23 | Mutual Authentication of a User and Service Provider |
Family Applications Before (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/637,998 Expired - Fee Related US9275379B2 (en) | 2010-03-31 | 2011-03-31 | Method for mutual authentication of a user and service provider |
US15/016,205 Expired - Fee Related US9699183B2 (en) | 2010-03-31 | 2016-02-04 | Mutual authentication of a user and service provider |
Country Status (3)
Country | Link |
---|---|
US (3) | US9275379B2 (en) |
CN (1) | CN102906776A (en) |
WO (1) | WO2011121566A1 (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20170244565A1 (en) * | 2014-09-26 | 2017-08-24 | Intel Corporation | Securely exchanging vehicular sensor information |
Families Citing this family (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10263782B2 (en) * | 2011-10-12 | 2019-04-16 | Goldkey Corporation | Soft-token authentication system |
AU2012244214B2 (en) * | 2011-10-25 | 2016-05-12 | Commonwealth Bank Of Australia | Remote device authentication system and method |
JP6066586B2 (en) * | 2012-05-22 | 2017-01-25 | キヤノン株式会社 | Information processing system, control method thereof, and program thereof |
CN103280029A (en) * | 2013-05-15 | 2013-09-04 | 江苏奇异点网络有限公司 | Wireless access method for bank automatic teller machine |
US9686271B2 (en) * | 2013-09-27 | 2017-06-20 | Excalibur Ip, Llc | Method and system for system for controlling online user account using a mobile device |
CN103679937A (en) * | 2013-12-18 | 2014-03-26 | 河海大学常州校区 | ATM automatic reminding system with anti-card-retaining function |
US9641488B2 (en) | 2014-02-28 | 2017-05-02 | Dropbox, Inc. | Advanced security protocol for broadcasting and synchronizing shared folders over local area network |
CN104484801A (en) * | 2014-11-03 | 2015-04-01 | 深圳市任网游科技发展有限公司 | Net bar safety payment method |
CN104639566A (en) * | 2015-03-10 | 2015-05-20 | 四川省宁潮科技有限公司 | Transaction authorizing method based on out-of-band identity authentication |
WO2017123157A1 (en) * | 2016-01-14 | 2017-07-20 | Voxp Pte Ltd | System and method for responding to a fraudulent event |
US10158628B2 (en) | 2016-06-08 | 2018-12-18 | Bank Of America Corporation | Preventing unauthorized access to secured information systems based on contextual login information |
US10158629B2 (en) | 2016-06-20 | 2018-12-18 | Bank Of America Corporation | Preventing unauthorized access to secured information systems using multi-device authentication techniques |
GB201616664D0 (en) * | 2016-09-30 | 2016-11-16 | Wilson Arnold A | Authentication method for a telecommunications system |
CN112136103A (en) * | 2018-04-10 | 2020-12-25 | 维萨国际服务协会 | Method, system and computer program product for authenticating a device |
US10885176B2 (en) | 2018-06-11 | 2021-01-05 | International Business Machines Corporation | Image based passphrase for authentication |
Citations (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5060263A (en) * | 1988-03-09 | 1991-10-22 | Enigma Logic, Inc. | Computer access control system and method |
US5802176A (en) * | 1996-03-22 | 1998-09-01 | Activcard | System for controlling access to a function, using a plurality of dynamic encryption variables |
US6067621A (en) * | 1996-10-05 | 2000-05-23 | Samsung Electronics Co., Ltd. | User authentication system for authenticating an authorized user of an IC card |
US6694436B1 (en) * | 1998-05-22 | 2004-02-17 | Activcard | Terminal and system for performing secure electronic transactions |
US6895394B1 (en) * | 1997-11-04 | 2005-05-17 | Magic Axess | Method for transmitting data and implementing server |
US7032240B1 (en) * | 1999-12-07 | 2006-04-18 | Pace Anti-Piracy, Inc. | Portable authorization device for authorizing use of protected information and associated method |
US7363497B1 (en) * | 1999-07-20 | 2008-04-22 | Immediatek, Inc. | System for distribution of recorded content |
US8108903B2 (en) * | 2003-06-18 | 2012-01-31 | Telefonaktiebolaget Lm Ericsson (Publ) | Arrangement and a method relating to IP network access |
Family Cites Families (30)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
DE10045924A1 (en) * | 2000-09-14 | 2002-04-04 | Giesecke & Devrient Gmbh | Process for securing a transaction on a computer network |
EP1421509A4 (en) * | 2001-08-07 | 2009-12-02 | Tatara Systems Inc | Method and apparatus for integrating billing and authentication functions in local area and wide area wireless data networks |
US7548620B2 (en) * | 2004-02-23 | 2009-06-16 | Verisign, Inc. | Token provisioning |
US8296562B2 (en) * | 2004-07-15 | 2012-10-23 | Anakam, Inc. | Out of band system and method for authentication |
US20060069914A1 (en) * | 2004-09-30 | 2006-03-30 | Alcatel | Mobile authentication for network access |
KR20060069611A (en) * | 2004-12-17 | 2006-06-21 | 한국전자통신연구원 | User authentication method in other network using digital signature made by mobile terminal |
EP2259539B1 (en) * | 2005-02-04 | 2013-10-09 | QUALCOMM Incorporated | Secure bootstrapping for wireless communications |
KR100652125B1 (en) * | 2005-06-03 | 2006-12-01 | 삼성전자주식회사 | Mutual authentication method for managing and authenticating between service provider, terminal and user identify module at one time and terminal, and the system thereof |
WO2007026486A1 (en) * | 2005-08-30 | 2007-03-08 | Passlogy Co., Ltd. | Site determining method |
US8468361B2 (en) * | 2005-09-21 | 2013-06-18 | Broadcom Corporation | System and method for securely provisioning and generating one-time-passwords in a remote device |
JP2007102778A (en) * | 2005-10-04 | 2007-04-19 | Forval Technology Inc | User authentication system and method therefor |
CN1980124A (en) * | 2005-12-05 | 2007-06-13 | 刘任 | Key digital identification method using once variable quantity |
US20070168432A1 (en) * | 2006-01-17 | 2007-07-19 | Cibernet Corporation | Use of service identifiers to authenticate the originator of an electronic message |
WO2007089179A1 (en) * | 2006-02-03 | 2007-08-09 | Mideye Ab | A system, an arrangement and a method for end user authentication |
US20080046738A1 (en) * | 2006-08-04 | 2008-02-21 | Yahoo! Inc. | Anti-phishing agent |
US20080103984A1 (en) * | 2006-10-30 | 2008-05-01 | Mobilekash, Inc. | System, Method, and Computer-Readable Medium for Mobile Payment Authentication and Authorization |
US8582734B2 (en) * | 2007-03-20 | 2013-11-12 | Shooter Digital Co., Ltd. | Account administration system and method with security function |
US20090164785A1 (en) | 2007-12-20 | 2009-06-25 | Motorola, Inc. | Method for authentication in a communication network |
US8424057B2 (en) * | 2007-12-28 | 2013-04-16 | Ebay, Inc. | Mobile anti-phishing |
US8117648B2 (en) * | 2008-02-08 | 2012-02-14 | Intersections, Inc. | Secure information storage and delivery system and method |
US8081963B2 (en) * | 2008-02-12 | 2011-12-20 | Microsoft Corporation | Utilizing mobile device functionality from remote computers |
US7945774B2 (en) * | 2008-04-07 | 2011-05-17 | Safemashups Inc. | Efficient security for mashups |
JP2010015541A (en) * | 2008-06-04 | 2010-01-21 | Fujitsu Ltd | Authentication system, terminal device, password issuing apparatus, and authentication method |
JP5279379B2 (en) * | 2008-07-16 | 2013-09-04 | 株式会社セフティーアングル | Authentication system and authentication method |
CN101394284B (en) * | 2008-11-13 | 2011-01-19 | 四川长虹电器股份有限公司 | One-time password authentication method |
US8712453B2 (en) * | 2008-12-23 | 2014-04-29 | Telecommunication Systems, Inc. | Login security with short messaging |
US20100269162A1 (en) * | 2009-04-15 | 2010-10-21 | Jose Bravo | Website authentication |
US20100274653A1 (en) * | 2009-04-28 | 2010-10-28 | Ayman Hammad | Notification social networking |
US20100332832A1 (en) * | 2009-06-26 | 2010-12-30 | Institute For Information Industry | Two-factor authentication method and system for securing online transactions |
US20110185406A1 (en) * | 2010-01-26 | 2011-07-28 | Boku, Inc. | Systems and Methods to Authenticate Users |
-
2011
- 2011-03-31 US US13/637,998 patent/US9275379B2/en not_active Expired - Fee Related
- 2011-03-31 CN CN2011800175068A patent/CN102906776A/en active Pending
- 2011-03-31 WO PCT/IB2011/051382 patent/WO2011121566A1/en active Application Filing
-
2016
- 2016-02-04 US US15/016,205 patent/US9699183B2/en not_active Expired - Fee Related
-
2017
- 2017-06-23 US US15/631,598 patent/US20170286957A1/en not_active Abandoned
Patent Citations (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5060263A (en) * | 1988-03-09 | 1991-10-22 | Enigma Logic, Inc. | Computer access control system and method |
US5802176A (en) * | 1996-03-22 | 1998-09-01 | Activcard | System for controlling access to a function, using a plurality of dynamic encryption variables |
US6067621A (en) * | 1996-10-05 | 2000-05-23 | Samsung Electronics Co., Ltd. | User authentication system for authenticating an authorized user of an IC card |
US6895394B1 (en) * | 1997-11-04 | 2005-05-17 | Magic Axess | Method for transmitting data and implementing server |
US6694436B1 (en) * | 1998-05-22 | 2004-02-17 | Activcard | Terminal and system for performing secure electronic transactions |
US7363497B1 (en) * | 1999-07-20 | 2008-04-22 | Immediatek, Inc. | System for distribution of recorded content |
US7032240B1 (en) * | 1999-12-07 | 2006-04-18 | Pace Anti-Piracy, Inc. | Portable authorization device for authorizing use of protected information and associated method |
US8108903B2 (en) * | 2003-06-18 | 2012-01-31 | Telefonaktiebolaget Lm Ericsson (Publ) | Arrangement and a method relating to IP network access |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20170244565A1 (en) * | 2014-09-26 | 2017-08-24 | Intel Corporation | Securely exchanging vehicular sensor information |
US10103889B2 (en) * | 2014-09-26 | 2018-10-16 | Intel Corporation | Securely exchanging vehicular sensor information |
Also Published As
Publication number | Publication date |
---|---|
US20130024923A1 (en) | 2013-01-24 |
WO2011121566A1 (en) | 2011-10-06 |
US20160156627A1 (en) | 2016-06-02 |
US9275379B2 (en) | 2016-03-01 |
US9699183B2 (en) | 2017-07-04 |
CN102906776A (en) | 2013-01-30 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US9699183B2 (en) | Mutual authentication of a user and service provider | |
US11146561B2 (en) | Handling encoded information | |
CA2662033C (en) | Transaction authorisation system & method | |
US8407112B2 (en) | Transaction authorisation system and method | |
US10360561B2 (en) | System and method for secured communications between a mobile device and a server | |
US9596237B2 (en) | System and method for initiating transactions on a mobile device | |
EP2652688B1 (en) | Authenticating transactions using a mobile device identifier | |
US11601430B2 (en) | Method and system for verifying user identity | |
US20110047605A1 (en) | System And Method For Authenticating A User To A Computer System | |
US20090172402A1 (en) | Multi-factor authentication and certification system for electronic transactions | |
US20120150748A1 (en) | System and method for authenticating transactions through a mobile device | |
MX2011002067A (en) | System and method of secure payment transactions. | |
WO2012167941A1 (en) | Method to validate a transaction between a user and a service provider | |
WO2004049621A1 (en) | Authentication and identification system and transactions using such an authentication and identification system | |
WO2009048191A1 (en) | Security authentication method and system | |
WO2005022474A1 (en) | A method of, and a system for, inhibiting fraudulent online transactions | |
Garba | A new secured application based mobile banking model for Nigeria | |
KR100782012B1 (en) | A Phone-Banking Auto Calling System On the Internet Banking and Finance Dealing Method Using the Same |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
AS | Assignment |
Owner name: PAYTEL INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:WALLAJA, RESH;REEL/FRAME:044598/0819 Effective date: 20121221 |
|
AS | Assignment |
Owner name: KACHYNG, INC., CALIFORNIA Free format text: CHANGE OF NAME;ASSIGNOR:PAYTEL, INC.;REEL/FRAME:045067/0894 Effective date: 20130917 |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |