GB2372368A - System for credential authorisation - Google Patents

System for credential authorisation Download PDF

Info

Publication number
GB2372368A
GB2372368A GB0104137A GB0104137A GB2372368A GB 2372368 A GB2372368 A GB 2372368A GB 0104137 A GB0104137 A GB 0104137A GB 0104137 A GB0104137 A GB 0104137A GB 2372368 A GB2372368 A GB 2372368A
Authority
GB
United Kingdom
Prior art keywords
credential
computer
user interface
interface device
intervention
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Withdrawn
Application number
GB0104137A
Other versions
GB0104137D0 (en
Inventor
Keith Alexander Harrison
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
HP Inc
Original Assignee
Hewlett Packard Co
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hewlett Packard Co filed Critical Hewlett Packard Co
Priority to GB0104137A priority Critical patent/GB2372368A/en
Publication of GB0104137D0 publication Critical patent/GB0104137D0/en
Publication of GB2372368A publication Critical patent/GB2372368A/en
Withdrawn legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/04—Payment circuits
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/22—Payment schemes or models
    • G06Q20/229—Hierarchy of users of accounts
    • G06Q20/2295—Parent-child type, e.g. where parent has control on child rights
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/322—Aspects of commerce using mobile devices [M-devices]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/32—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices
    • G06Q20/325—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using wireless devices using wireless networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/403—Solvency checks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/403—Solvency checks
    • G06Q20/4037—Remote solvency checks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/42—Confirmation, e.g. check or permission by the legal debtor of payment
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/42—Confirmation, e.g. check or permission by the legal debtor of payment
    • G06Q20/425—Confirmation, e.g. check or permission by the legal debtor of payment using two different networks, one for transaction and one for security confirmation
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07C—TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
    • G07C9/00—Individual registration on entry or exit
    • G07C9/20—Individual registration on entry or exit involving the use of a pass
    • G07C9/22—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder
    • G07C9/23—Individual registration on entry or exit involving the use of a pass in combination with an identity check of the pass holder by means of a password
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07F—COIN-FREED OR LIKE APPARATUS
    • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means

Abstract

A system 1 for authorisation of use of a credential such as a credit card comprises a user interface device 3, such as a mobile phone, which is capable of communicating with a remote station 7, such as an electronic funds transfer point of sale unit 11 of a trader, the remote station 7 is operative to transmit information to the computer relating to the use of a credential so as to elicit a response from the computer such that in use an action is taken on the basis of the response from the computer, the response being dependent on the information transmitted to the computer so as to determine whether intervention by a person controlling provision of authorisation for use of the credential is required by way of the user interface device 3 and if intervention is required then what intervention is required. The computer may prompt the user to enter a predetermined input on the user interface device 3 which signifies whether the user wishes to authorise the use of the credential. The credential may be used for performing financial transactions, the course taken by the computer may be dependent at least in part on the monetary value of a pending transaction. The computer may be part of the user interface device 3. There is also disclosed a method of authorising the use of a credential.

Description

SYSTEM FOR CREDENTIAL AUTHORISATION
The present invention relates to a system for credential authorisation and in particular, but not exclusively, to mobile phones which are configured to provide confirmation or denial for the authorisation of use of a credential.
BACKGROUND OF THE INVENTION The present invention stems from the realisation of the fact that it would be desirable to configure a personal user interface, such as a mobile phone, to take action on the basis of information received regarding the use of a credential, such as a credit card, for the purpose of whether or not authorisation of that use of the credential should be permitted.
The term credential is used herein to denote any means which provides prima facie authority for entitlement to do something, for example a credit or debit card for paying for goods or a pass card or PIN for entering a particular region of a building.
SUMMARY OF THE INVENTION According to a first aspect of the invention there is provided a system comprising a user interface device which is capable of communicating with a remote station, and a computer which is associated with the user interface device, the remote station being operative to transmit information to the computer relating to the use of a credential so as to elicit a response from the computer such that in use an action is taken on the basis of the response from the computer, the response being dependent on the information transmitted to the computer so as to determine whether intervention by a person controlling provision of
authorisation for use of the credential is required to authorise the particular use of the credential by way of the user interface device and if intervention is required then what intervention is required.
The term'computer'is used herein to mean any device which accepts an input, processes that input in accordance with predefined rules and produces an output.
The action taken may be to allow a predetermined time in which the user may inform the device that he wishes to decline authorisation otherwise a signal is sent to authorise the use of the credential.
The action taken may be to prompt the user to enter a predetermined input on the user interface device which signifies whether he wishes to authorise the use of the credential.
The action taken may be to automatically transmit a signal to the remote station to authorise the use of the credential.
Where the credential is used for performing financial transactions, the action taken is preferably dependent at least in part on the monetary value of a pending transaction. Alternatively or in addition, the action taken could at least in part be dependent on the total value of a series of transactions over a specified period of time.
The computer is preferably part of the user interface device.
According to a second aspect of the invention there is provided a method of authorising use of a credential comprising transmitting data from a station to a computer, the computer being associated with a user interface device and the user interface device being remote from the station,
configuring the computer such that an action is taken on the basis of the response from the computer and the response being dependent on the information transmitted to the computer so as to determine whether intervention by a person controlling provision of authorisation for use of the credential by way of the user interface device is required and if intervention is required then what intervention is required.
BRIEF DESCRIPTION OF THE DRAWINGS The invention will now be further described, by way of example only, with reference to the accompanying drawings, in which: Figure 1 is a schematic representation of a system for providing authorisation for use of a credential; and Figure 2 is a flow diagram showing the basis on which the action taken by the user interface device of Figure 1 is determined.
DESCRIPTION OF PREFERRED EMBODIMENTS With reference to Figure 1 there is shown a system 1 comprising a mobile phone 3, a communications network 5 and a trader 7, the mobile phone 3 being capable of communicating with the trader 7 by way of the communications network 5.
The description of the system will make particular reference to the use of a credit card or debit card (not shown) to make a transaction at trader 7.
In use the system operates as follows. A person wishes to purchase goods at the trader 7 with a credit card. For the transaction to take place the card must be interfaced with suitable Electronic Funds Transfer at
Point of Sale (EFTPOS) unit 11 located at trader 7. When this is done a signal is sent from the EFTPOS unit 11 via a telecommunications network to a routing unit 9. The routing unit matches the details of the credential, ie the card number with the phone number of the phone 3 which is stored in a database of the routing unit 9. The phone 3 is carried by the person who controls provision of authorisation for use of the card, the controller. For example the credit card may belong to a parent who has lent it to a son or daughter. The information sent to the mobile phone 3 comprises the monetary value of the pending transaction with other descriptive material relating to the transaction. On receipt of this signal a processor (not shown) inside the phone 3 is programmed to take an action which is dependent on the monetary value of the pending transaction for which authorisation is solicited.
With reference to Figure 2, the actions which the programmed processor may initiate are as follows. If the transaction is less then f50 then a signal is automatically sent to the EFTPOS unit 11 via the routing unit 9 to authorise the pending transaction to proceed. If the value of the transaction is between f50 and f75 the processor will cause a suitable text message to appear on the screen of phone 3. The message would contain details of the value of the transaction and possibly details of the identity of the trader 7. If the controller wishes to deny authorisation he must do so within twenty seconds of the message appearing. To deny authorisation he must press a predetermined key and/or enter a pin number. Failure to respond within twenty seconds results in the processor causing a signal to be transmitted to the trader 7 authorising the transaction.
For transactions valuing more than f75 the processor is operative to cause a message to be presented on the screen of the phone providing details of the pending transaction and require the controller to enter authorisation of the transaction within twenty seconds otherwise a signal is sent by default to deny authorisation.
The phone 3 identifies itself to the routing unit 9 by way of a subscriber identity module (SIM) which carries encoded information which allows the routing unit 9 to authenticate a signal sent from the phone 3 to the EFTPOS unit 11. In addition, for transactions of a particularly high value, for example, the controller may be required to enter a PIN to authorise such transactions.
The processor may be programmed to the controller's personal preferences and requirements, for example a higher or lower monetary value for transactions for which his express authorisation is not required. The processor may be programmed to notify the owner of the phone 3 of a pending transaction which would mean that more than a predetermined amount would have been spent in a specified period and authorisation for that proposed transaction (no matter how small) is required.
There also exists the possibility that the processor could be programmed to initiate a particular action from a respective set of actions for a particular card where the owner of the phone is the controller for a plurality of cards.
The inventive system has the important advantage of being able to control the use of credentials, such as credit cards. In the case of a credit card or debit card which has been unwittingly lost or stolen, the owner of the card will advantageously be notified of pending fraudulent transactions and be able to deny authorisation for such.
It will be appreciated that the inventive apparatus also finds utility in security systems, for example, those in a building where access to certain rooms and areas requires use of a credential such as a pass card. Thus on use of the card a signal is sent to the mobile phone which would display a message requiring the user to enter a PIN in order for access to that room to be authorised. The processor could be programmed to require a PIN to be entered for some rooms only. Alternatively or in addition, the user may be prompted to simply press a key on the phone so that a signal is transmitted which comprises a digital signature to authenticate the request.
When the invention is applied to such security systems the important advantage of increased security results and in particular the requirement of an authenticated signal being received before access is granted reduces the risk of fraudulent use of a security credential.
The present invention also finds utility in the use of passwords for database access.
It will also be appreciated that although the programmed processor resides within the mobile phone, a processor having suitable associated communication means and performing the same function could be located remote from the phone.

Claims (10)

1. A system (1) comprising a user interface device (3) which is capable of communicating with a remote station (7,11), and a computer which is associated with the user interface device, the remote station (7,11) being operative to transmit information to the computer relating to the use of a credential so as to elicit a response from the computer such that in use an action is taken on the basis of the response from the computer, the response being dependent on the information transmitted to the computer so as to determine whether intervention by a person controlling provision of authorisation for use of the credential is required to authorise the particular use of the credential by way of the user interface device (3) and if intervention is required then what intervention is required.
2. A system (1) as claimed in claim 1 in which the action taken may be to prompt the user to enter a predetermined input on the user interface device (3) which signifies whether he wishes to authorise the use of the credential.
3. A system (1) as claimed in claim 1 or claim 2 in which the action taken may be to allow a predetermined time in which the user may inform the device (3) that he wishes to decline authorisation otherwise a signal is sent to authorise the use of the credential.
4. A system (1) as claimed in any preceding claim in which the action taken may be to automatically transmit a signal to the remote station (7. 11) to authorise the use of the credential.
5. A system (1) as claimed in any preceding claim in which where the credential is used for performing financial transactions, the action taken is dependent at least in part on the monetary value of a pending transaction.
6. A system (1) as claimed in claim 5 in which the action taken by the device (3) is at least in part dependent on the total monetary value of a series of transactions over a specified period of time.
7. A system (1) as claimed in any preceding claim in which the computer is part of the user interface device (3).
8. A system (1) as claimed in any preceding claim in which the user interface device (3) is comprised within a mobile telephone.
9. A method of authorising use of a credential comprising transmitting data from a station to a computer, the computer being associated with a user interface device (3) and the user interface device being remote from the station (7,11), configuring the computer such that an action is taken on the basis of the response from the computer and the response being dependent on the information transmitted to the computer so as to determine whether intervention by a person controlling provision of authorisation for use of the credential by way of the user interface device (3) is required and if intervention is required then what intervention is required.
10. A method of authorising use of a credential comprising the features of any one of claims 1 to 8.
GB0104137A 2001-02-20 2001-02-20 System for credential authorisation Withdrawn GB2372368A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
GB0104137A GB2372368A (en) 2001-02-20 2001-02-20 System for credential authorisation

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
GB0104137A GB2372368A (en) 2001-02-20 2001-02-20 System for credential authorisation

Publications (2)

Publication Number Publication Date
GB0104137D0 GB0104137D0 (en) 2001-04-11
GB2372368A true GB2372368A (en) 2002-08-21

Family

ID=9909109

Family Applications (1)

Application Number Title Priority Date Filing Date
GB0104137A Withdrawn GB2372368A (en) 2001-02-20 2001-02-20 System for credential authorisation

Country Status (1)

Country Link
GB (1) GB2372368A (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2398159A (en) * 2003-01-16 2004-08-11 David Glyn Williams Electronic payment authorisation using a mobile communications device
WO2006024080A1 (en) * 2004-08-31 2006-03-09 Markets-Alert Pty Ltd A security system
AU2005279689B2 (en) * 2004-08-31 2008-04-10 Markets-Alert Pty Ltd A security system

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5878337A (en) * 1996-08-08 1999-03-02 Joao; Raymond Anthony Transaction security apparatus and method

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5878337A (en) * 1996-08-08 1999-03-02 Joao; Raymond Anthony Transaction security apparatus and method

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2398159A (en) * 2003-01-16 2004-08-11 David Glyn Williams Electronic payment authorisation using a mobile communications device
WO2006024080A1 (en) * 2004-08-31 2006-03-09 Markets-Alert Pty Ltd A security system
AU2005279689B2 (en) * 2004-08-31 2008-04-10 Markets-Alert Pty Ltd A security system

Also Published As

Publication number Publication date
GB0104137D0 (en) 2001-04-11

Similar Documents

Publication Publication Date Title
KR101384608B1 (en) Method for providing card payment system using phnone number and system thereof
US10108939B1 (en) Payment transaction method and payment transaction system
US7478065B1 (en) Payment transaction method and payment transaction system
US6934689B1 (en) Payment transaction method and payment transaction system
US7264154B2 (en) System and method for securing a credit account
EP2212842B1 (en) System and method for secure management of transactions
US7353014B2 (en) Universal portable unit
US20030162565A1 (en) Method for processing transactions by means of wireless devices
EP1807966B1 (en) Authentication method
US20210056556A1 (en) A financial transaction control system, an application and a method of the same
US20050165684A1 (en) Electronic transaction verification system
KR20160015375A (en) Authorizing transactions using mobile device based rules
KR20030001334A (en) Mobile Terminal Authentication Method and Mobile Terminal
KR20090114585A (en) Method and System for Processing Cash Payment by Using USIM and Recording Medium
CN100456332C (en) Electronic clearing system and its operating method of mobile communication terminal
US20130232084A1 (en) Mobile Financial Transaction System and Method
US20180183805A1 (en) System and method of authorization of simple, sequential and parallel requests with means of authorization through previously defined parameters
GB2372368A (en) System for credential authorisation
US20030097333A1 (en) Electronic money processing method and program and recording medium
KR101547730B1 (en) Apparatus and method for managing financial account having two or more secret numbers in an account
EP3667591A1 (en) Method to control a transaction
JP2002324219A (en) Card authentication system
KR20140096016A (en) Method for providing card payment system using phnone number and system thereof
GB2372361A (en) Credential authorisation verification using a mobile communiation device
KR20130105264A (en) Method for providing card payment system using phnone number and system thereof

Legal Events

Date Code Title Description
WAP Application withdrawn, taken to be withdrawn or refused ** after publication under section 16(1)