GB2390211A

GB2390211A - Ticket and authentication data stored on portable handset

Info

Publication number: GB2390211A
Application number: GB0215113A
Authority: GB
Inventors: Christopher John Stanford
Original assignee: PREPAYMENT CARDS Ltd
Current assignee: PREPAYMENT CARDS Ltd
Priority date: 2002-06-29
Filing date: 2002-06-29
Publication date: 2003-12-31
Also published as: GB0215113D0

Abstract

A portable handset, such as a mobile phone 3, PDA or pager, is used to store both ticket information, representing a ticket purchased from a ticket provider, and authentication information so that authentication of the ticket at the point of use does not involve communication with the ticket provider. The ticket information can be stored on a SIM card together with authentication security software. Authentication may involve an authentication string or graphics displayed on a screen and recognised by the software held by a ticket inspector. The ticket may be bought from the Internet using WAP software and paid for by credit card or funds stored in an e-purse in the handset.

Description

1 239021 1

AUTHENTICATION METHOD

The present invention relates to method for authenticating tickets stored on a portable handset. The ubiquity of consumer electronics has affected very many aspects of everyday life.

In particular' the recent increase in the ownership of po?1ahle devices with telecommunications capability has transformed personal communications. Such devices include mobile telephones, personal digital assistants (PDAs), and pagers.

Mobile telephones are now used in a number of different ways, and are no longer limited to voice communications. Mobile telephones are used to send text messages between hand sets using the short message service (SMS) protocol, and are also connected to portable computers, either by wired or wireless connection to allow connection to computer networks such as the Internet.

It is known to use the SMS protocol to defer advertising and other promotional content to mobile telephones. Using market research, it Is possible to tailor the information to a particular target audience so as to increase the effectiveness of this advertising. It is also known to deliver coupons to a mobile telephone using the SMS service. Such a system is operated by Clikadeal Inc. As described on the Clickadcal webste (www.clickadeal.con/faq.shtml) hi February 2()()2, in that system a riser first registers and establishes a profile, by using web browser software to access an Internet web site. A server their periodically dispatches coupons to the user's mobile telephone hi conformity with the established profile. Such coupons will typically take the form of discounts applicable in shops, restaurants or similar outlets. Each coupon contains an identification number, which is quoted at the point at which the coupon is to be redeemed. Redemption is then effected by entering the identification number Into terminal at the point of redemption. While this system is functional in delivering

relatively low value special offer coupons, it is relatively insecure. This means that the system is not suitable for higher value applications.

Another known electronic coupon distribution system is described in WO 00/39657.

Here coupons are sent from a central database to a user s mobile telephone.

Redemption of a coupon is achieved either by manually reading an identification number from the screen of the mobile telephone, and inputting this number Into an appropriate terminal at the point of sale, or altematvely, by scanning a barcode appearing on the mobile telephone screen into the terminal using a suitable bar code reader. The terminal then transmits the coupon number to the remote database, and the coupon is marked as used in the database. The coupon is also marked as used in the mobile telephone. The Identification number transmitted to the remote database does not itself provide authentication, but merely provides a key by which the central database may be searched.

EPI 150228A1 discloses a further method of distributing coupons to mobile devices.

This system is similar to that described In WO/3'3657, but it is also disclosed that the coupon Is validated using the remote database, so as to ensure that fraudulent coupons are not redeemed. Again, the identification number is merely a key by which the central database may be searched. In each of these systems, the authentication of tokens is not of great concern, given the relatively low value of the coupons involved.

IJ8(()')464() (which is a continuation of US572452()) describes a system suitable for distributing airline lickers lo risers. Each user is aliocatei a card hearing a unique Identification number. When a booking is made, the reservation data is stored in a central database with a link to the user's unique Identifier. When the ticket is to he used, the user presents the card, allowing the reservation data to be accessed. Given the high value environment in which this system is employed, greater emphasis Is placed upon authentication, which is achieved by consulting information stored in the central database.

Each of the systems described above either has no secure authentication method due to the low value environment in which it is used, or alternatively, Is provided with authentication by means of remote database lookup. While the latter option does provide secure authentication, it requires high bandwidth connectivity to ensure that communication between the mobile telephones and the remote database can be successfully carried out. Such bandwidth is expensive to provide, and the system Is likely to be slow at times of high usage. Furthermore, such bandwidth must be provided securely so as to prevent interference from unauthonsed third parties who could potentially undermine the purpose of the authentication system.

It is an object of the first, second, third and fourth aspects of the present Invention to obviate or mitigate one or more the problems outlined above.

According to a first aspect of the present invention, there is provided a portable handset, comprising a memory for storing ticket data including ticket authentication data, input means for accepting an input representing a ticket authentication request, and means for producing an output which identifies a ticket represented by the ticket data and includes data derived from the stored authentication data.

The handset may further comprise means to produce the output in response to the authentication requests The input may comprise a first authentication string, and the output may comprise a second authentication string generated using the first authentication string and the stored authentication data.

The handset may further comprise a user readable display, and the means for producing the output may lie configured to display the output on to user readable display. The stored authentication data may comprise characters, and/or graphics, and/or animated graphics which can be generated only by an authorisec3 issuer of the ticket. The handset may comprise at least one communications channel, which may use infra red communication, or radio frequency communication. The means for producing the

output may be configured to direct the data derived from the stored authentication data to the communications channel.

The input means may be a keypad of the portable handset, or a communications channel of the portable handset. The handset may also function as a mobile telephone. According to a second aspect of the present invention, there is provided a method for authenticating ticket data including authentication data stored in a memory of a portable handset, the method comprising accepting an input to the portable handset representing a ticket authentication request, and producing an output from the portable handset which identifies a ticket represented by the ticket data and includes data derived from the stored authentication data.

The output may be displayed on a display screen of the device, allowing the ticket to be identified by visual inspection of the said display screen. The data derived from the stored authentication data may be displayed on a display screen of the device, allowing the ticket to be authenticated by visual inspection of the said display screen.

The stored authentication data may comprise characters, and/or graphics and/or animated graphics which can be generated only by an authorised issuer of the ticket data. The output may be transmitted from the handset using a communications channel of the portable handset. The data derived fiom the stored authe'iicalon 1ala may also he transmitted from the handset using the communications channel of the portable handset. Input may be effected using a keypad of the portable handset or a communications channel of the portable handset. The input may be generated by a separate electronic device, and communicated to the portable handset using the said communications channel. The input may be generated by a point of service terminal. The stored authentication data may be communicated to the point of service terminal.

s The invention also provides a computer program for carrying out the method set out above. According to a third aspect of the present invention, there is provided a carrier medium carrying computer program code means to cause a portable handset, having access to a memory for storing ticket data which includes authentication data, to execute procedure to: accept an input representing a ticket authentication request; and produce an output which identifies a ticket represented by the ticket data and includes data derived from the stored authentication data.

The memory may form part of the carrier medium. The carrier medium may be a smart card. The smart card may be a mobile telephone S1M card.

According to a fourth aspect of the present invention. there is provided a device for authenticating ticket data stored on a portable handset, the device comprising means to generate an output signal suitable for communication with the portable handset placed adjacent the device, means for receiving an authentication signal from the portable handset and means for authenticating the ticket data in response to the received authentication signal.

The means to generate the output signal may he a transmitter using radio frequency connunicaton, or ifra red cunununcation. Tile means nor receiving the authentication signal may be a receiver using radio frequency communication, or using infra red comnumcation. The device may further comprise a connection to a database server such that ticlcet authentication operations are communicated to the database server.

The increased use of mobile telephones also makes purchasing goods and services through a mobile telephone viable. Such a system Is particularly suitable for purchasing tickets which can be stored electronically, as set out above.

However, a user wanting to purchase a number of different tickets will need to navigate to a number of different ticket providers' web sites to obtain the tickets which they desire. Such a system is disadvantageous because the user will need to know an Intenet address for each provider. Furthermore, a user may be unhappy to disclose credit or debit card details to some ticket providers, for fear of unauthorized use of their credit or debit card details.

it is an object of the fifth, sixth and seventh aspects of the present invention to obviate or mitigate one or more of the problems outlined above.

According to a fifth aspect of the present invention, there is provided a computer system for allowing a user to obtain a ticl;et, the system comprising: a connection to a portable handset operated by a user; a connection to a ticket server operated by an authorised ticket provider; a connection to a payment server operable to authorise payment transactions; means to receive a ticket purchase request from the portable handset operated by the user; means to direct ticket purchase requests to the ticket server; means to receive payment details from the portable handset operated by the user; means to direct payment details to the payment server; means to receive ticket data representing the requested ticket from the ticket server, and means to transmit the said ticket data to the portable handset of the user.

The connection to at least one of the ticket server and the payment server may be a wired conocction. The wired concoction may he [)rOVitlCtl by the Intemet The connection to the portable handset Is preferably a wireless connection. The wireless connccton may use a mobile telephony network.

The computer system may further comprise means to receive data frond the portable handset indicating that the ticket has been used. The computer system may also comprise a connection to a terminal at a point of service, and means to receive data from the terminal indicating that the ticket has been used.

The computer system may comprise connections to a plurality of ticket servers, each ticket server being operated by a respective authonsed ticket provider, and may comprise selection means to select to which of the plurality of ticket servers a ticket purchase request should be directed According to a sixth aspect of the present invention, there is provided a method for allowing a user to obtain a ticket, the method comprising: rece,,ving a ticket purchase request from a portable handset operated by a user; directing the ticket purchase request to a ticket server; receiving payment details from the portable handset operated by the user; directing the payment details to the payment server; receiving ticket data representing the requested ticket from the ticket server, and transmitting the said ticket data to the portable handset of the user.

There is also provided a computer program for carrying, out a method In accordance with the sixth aspect of the present invention.

According to a seventh aspect of the present invention, there is provided a method for purchasing a ticket using a portable device, the method comprising sending a signal to a remote server representing a request for the ticket, sending data to the remote server, said data representing a means of payment for the requested ticket, receiving data representing the ticket from the server, and storing the saved ticket in a memory of the portable device.

Throughout this document, the tem1 "ticket" arid ',htIl" anti 'coupon'' art used Interchangeably, and are considered to be functionally Identical An embodiment of the present invention will now be described, by way of example, with reference to the accompanying drawings, n1 which: figure I is a schematic illustration showing a top-level view of a system operating in accordance with the present invention;

( Figure 2 is a flowchart showing the operation of the system of figure 1; Figure 3 Is a schematic illustration of a system Implementing the process illustrated in figure 2; Figure 4 Is a schematic Illustration of a business model showing how operation of the system of figure 3 may be distributed between a plurality of companies; and Figure 5 is a schematic illustration of an alternative business model to that shown in figure 4.

Refemng to figure I there is illustrated a process for issuing and redeeming tickets in accordance with the present invention. A user purchases a ticket from a ticket Issuer having a central database 1. The central database manages the distribution of tickets which are represented by ticket data stored therein. Such ticket data is distributed by a wireless communication network 2 to one of a number of portable devices 3 which could be for example mobile telephone handsets. Each wireless device ncludcs a non-

volatile storage device upon which ticket data received from the central database I can be stored. In one embodiment of the present invention, the ticket data is stored within memory cells provided by the SIM card of a mobile telephone.

A user of one of the devices 3 which holds ticket data presents the device 3 to a system 4 for authentication when the ticket is to be used. The a'thcnticaton tal;es place through communication between the device and the system 4 without intervention from any external system and in particular, without communication between the system 4 and the database I Operation of the system of figure I will he described with reference to figure 2. First a user selects a ticket which they wish to buy (STEP 1). This can be achieved by the user telephoning a call centre, where an operator advises of ticket availability, or alternatively by accessing an Internet web site through a personal computer and selecting the ticket using web browser software. Altematvely, the user may view a

( and select available tickets by accessing the Internet using their portable handset by means of Wireless Application Protocol (WAP) software.

Having selected a ticket which they wish to purchase, the user is required to pay the ticket issuer for the ticket (STEP 2). The form of payment will vary depending on the method used to select the ticket. If the ticket was selected using a call centre, the user will provide payment means in the form of credit or debit card details to the operator.

If the ticket was selected using web browser software running on a personal computer, the user will be prompted to enter the necessary credit or debit card details into fields

provided by an Internet web page' and the entered data will then be transmitted to the ticket issuer. It is desirable that the transfer of data over the interrupt is effected in a secure way so as to prevent unauthorized third parties accessing the credit or debit card data If the ticl;et was selected using a portable handset by means of the WAP system, the portable handset may contain payment means in the form card details stored in a storage device within the portable handset. Thcsc details can then be transmitted to the ticket issuer using the SMS protocol.

It will he appreciated that the storage device containing card details could conveniently take the form of a card containing a memory cell. Such a card could be inserted into an appropriate slot in the portable handset. One known card particularly suitable for this application is the EMV (Europay' Mastercard, Visa) Card which is available fiord Proton World of Rue du Planeur It), 1] 30 Brussels, Belgium.

Alternatively, subsolar technology allows implementation of what Is known as e-purse whereby users effectively store cash on a smart card, and the amount stored is decreased as tickets are purchased. The e-purse system will be particularly suitable for relatively low value ticket purchases, such as cinema and other leisure tckcts. A suitable e-purse system is again available from Proton World.

If the storage device Is to take the form of such a card, the card may also be inserted into a card reader connected to a personal computer, so as to allow payment by means of the EMV card when purchase is made via a web browser as described above.

Slaving selected and paid for the ticket, the ticket Is sent from the central database (I I in figure l) to the user's handset. This transmission can conveniently take the forte of I a suitably secured SMS message. (STEP 3). Standard SMS messaging is protected by i commercial security systems of medium strength, which usually provide adequate security for such applications. I When the ticket is to be redeemed the user presents the portable handset to an operator at the point of sale (STEP 4) and the ticket is authenticated (STEP 5). It may be sufficient that the token is visible on the screen of the portable handset, and that the operator visually inspects the ticket for authentication. Alternatively, the operator may have a device which communicates with the handset to effect validation, and also cancels the ticket. The process of authentication is described in further detail below.

It has already been described that ticket data transmitted to a portable handset can conveniently be stored on a smart card within the handset. Mobile telephone conventionally include a Subscriber Identity Module (SIM) card which includes some software, together with identification details to identify the particular telephone number. This SIM card can be replaced with a Prisma SIM card (available from Proton World). The specification of such cards is given in two documents published

by Proton World: "The Proton Prisma Guicle" and "A', introduction to Proton

Prisma." The detailed specification of the Prisma SlM card will therefore not be

described in further detail here. Hoevcr, it should be noted that the Pnsma StM card can Include the traditional SIM card functona]ty alongside storage capacity to hold ticket data, and EMV and E-purse modules as described above, and software to allow authentication of ticket data. The authentication software is described in further detail below. The software contained on the Prisma SIM can be programmed remotely, using a wireless communications network. However, considerable complexity can arise in such remote programming, which requires high bandwidth connectivity. It Is

therefore desirable that the system is designed so as to minimise the reprogramming necessary. A messaging system allowing the selection and downloading of ticket data to a mobile handset is illustrated in figure 3. To obtain a ticket, the portable handset 3 sends a message over the wireless communication network 2 to a proxy server 5. The mobile handset Is equipped with a Prisma SIM card containing WAP browser software, EMV functionality and the ability to store ticket data. The message Is denoted by an arrow 6 and Is in the form of an encoded Unique Resource Locator (URL) message from a WAP browser of the portable handset to the Hypertext Transfer Protocol (HTTP) proxy of the proxy server 3. The message 6 is received by the proxy server 5 and transferred to an apphcation server 7 in the fond of a further URI. message, denoted by an arrow 8. The operation ofthe proxy server 3 is such that it is completely transparent to both the portable handset and the application server 7.

On receiving the message 8, the application server 7 sends basic ticket data to the proxy server 5 by means of a message 9. The basic ticket data is then transmitted to the WAp browser of the portable handset 3 by means of an encoded message 10.

The basic information transmitted to the portable handset thus far is sufficient to inform the user of tickets that are available. The data transmitted may either be generated from a database stored within the application server 7, or alternatively, may be obtained from a ticket issuer, having a server 11. For example, in the case of air travel tickets, the server 11 is operated by an airline.

If the user wishes to proceed with the purchase of a ticket, the exact selection is made by means of the WAP browser, and suitable messages (denoted by the arrow h) are sent to the proxy server 5 for onward transmission (denoted by the arrow 8) to the Apphcation Server 7. The message received by the application server 7 /11 include payment details transmitted from the EMV module within the Pnsma SIM Card. The application server attempts to authorise payment with the card issuer, using the supphed payment details. The card Issuer has a payment authorsaton server 12, and the application server 7 sends an authorization request 13 to the payment authonsation

( server 12. The payrucnt authorization server responds with an accept or reject signal 14. If a reject signal is received by the application server, the transaction can not continue and an appropriate message is sent to the portable handset 3 via the proxy server 5. If an accept signal is received, the application server 7 informs the ticket issuer's server I l of the sale by means of a message 15. i, he ticket issuer responds with a message 16 containing detailed ticket information (such as a serial number for example) which can be transmitted to the portable handset 3 via the proxy server 5. Funds are then transferred from the payment authonsation server 12 to the ticket issuer 1 1.

It will be appreciated that a real world implementation of the ticket acquisition system described above will require co-operation by a number of different companies, each operating part of the system. For example, the provision of portable handsets is hkely to be best handled by a major manufacturer of mobile telephones, while provision of the Pnsma SIM cards is best handled by a major mobile telephone Silk card manufacturer. The payment authorization server is best operated by one of the mayor banks, which has the necessary communications links to the banking networks for cleanug payment. Similarly, a major bank is required to provide the necessary functionality within the EMV card described above. The mobile telephone network operators would be best placed to ensure that the necessary WAP functionality is supported by both the handsets and their network. The application server, which is central to the operation of the system, could be handled by a delicatcd application server operator. This spruce plays a pivotal role hi connecting the necessary components of the system together. The third party ticket servers would each be operated by a ticket issuer. in the case of r railway Relets withm the United Kingdom' it Is envisaged that the rail settlement plan (RSP) would operate a server 11 for the Issue of tickets, and that payment would be made to the RSP for distribution between the rail operating companies.

Each of the companies outlined above will need to derive revenue from the system. A suitable business model is illustrated in figure 4. Each of the arrows of figure 4 denotes a transfer of money from one party to another.

A user 17 pays a SMS charge 18 to the an operator 19 of the mobile network. This charge covers use of the SMS system for receiving ticket data. In turn the operator pays a telephone distribution company 20 a distribution charge 21 for including enhanced functionality within the SIM cards. A management fee 22 is paid to the operator 23 of the application server 7. A bank 24 providing the EMV functionality pays the operator 23 of the application 7 a rental charge 25 for use of the SIM within the mobile handsets.

The operator 23 of the application server 7 pays two charges 26 27 to the mobile network provider 19. A first charge 26 covers the use of the SMS system by the system of the invention and the second charge 27 is a subsidy for the increased functionality SIM cards used by the network s handsets.

A ticket Issuer 28 wishing to use the service must pay for SIM rental space to store ticket data within the portable handset and also pay a service fee for use of the system. These charges are denoted by two arrows 29 an respectively. The final relationships involve the payment authorisaton server 12. A banking organization 31 operating the server 12 pays the operator 23 for each transaction that is passed to it This payment Is denoted by an arrow 32 Payments authorised by the payment author;.sation server I are paid to the ticket issuer 28 (.lcotcd icy an arrow j and a conventional merchant fee 34 Is paid to the payment authorization server operator 31 by the ticket Issuer 28 to cover banking costs.

The system described above with reference to figures 3 and 4 assumes that payment for tickets is to be made using an EMV card or an e-purse system both of which are outlined above. However referring back to figure 2 it will be recalled that it was described that payment could be effected using a separate method than that used for ticket acquisition. A business model for a system without integrated payment

capability is shown in figure 5. It can be seen that the business relationships and payments made are as those illustrated in figure 4, excepting those Involved with the payment scheme. In the cases of figure 4 and 5, it can be seen that the position of the operator 23 of the application server is viable, as streams of income exist to cover costs incurred.

Having described the process of tickets selection and acquisition, methods of securing and authenticating tickets will now be descnhed. The first area of the system as described above which requires security is the provision of the EMV module within the Prisma SIM card. The existing Prisma World technology provides sufficient security features to satisfy this requirement. The second area requiring security is the transmission of tokens, and more importantly the provision of mechanisms to ensure that what appears on a portable handset as a token is a token issued by the appropriate ticket issuer' and not an SMS message from an unauthorised third party.

The system of the present invention incorporates a security application module as software on the Prisma SIM card. This module is called upon to authenticate tclicts as required. In essence, the security application module adds a security framework for the handling of tickets downloaded to the portable handset.

The security application module ensures that it is computationally difficult to fraudulently generate rickets. Furthermore, it ensures that tickets which are fraudulent or cloned are detected as SUCH. The securityapplication module verifies that all tokens received by the ticketing nodule of tle Pri.sna Slivf card are genuine and also provides functionahty to allow the authenticity of tickets to he validated at the point of Sac.

Tickets are transmitted to portable handsets by the application server (the transmission Is actually effected through the proxy server, but the proxy server is by definition transparent). The application server signs each ticket with a digital signature, generated with reference to the target portable handset's SIM card number.

Thus, the digital signature can be verified only by a portable handset having the

( appropriate SIM card number, so that the ticket will be rejected by all handsets other than that for which the ticket is explicitly intended.

It will be appreciated that the levels of security required by the system will depend upon the value and nature of tickets being distributed. For example, it is likely that business class airline tickets will require high levels of security as they are valuable and fraudulent tickets pose a security risk. Conversely, cinema tickets are of relatively low monetary value and pose no security risk, so that less stringent security standards can be applied.

Different means of authenticating a ticket will be described below. Each of these methods can be used in Isolation or in combination with the digital signature method described above.

A relatively simple and low cost authentication method involves displaying a token on the screen of the portable handset. When the ticket Is to be used, the handset is presented to an inspector for visual inspection at the point of scratch In order to ensure some security within such a system, the ticket may use bespoke graphics and characters which are not available as part of the standard SMS system, thereby making it more difficult for a third party to generate an SMS message which can be mstalcen for a ticket. Similarly, bespoke animations may be used, or an authentication character string may be displayed.

An auther,rication character stains, is der IVCL1 rising a hash frncuon which takes data from the token message and its source and includes some secret data. The function then produces a shorter string of characters whicl1 are cryptographically related to the message, its source and the secret data. This string is generated when the electronic token is Issued. This is similar to the string of characters found on a cardboard ticket which Is used to detect fraudulently changed tickets. An inspector needing to validate a ticket will know which authentication character strings are valid and will therefore be able to validate the ticket held on the portable handset by visual inspection.

( Further authentication may be provided by the inspector inputting an authonsation string into the portable handset by means of the keypad. This authorization string is authenticated by the security application module of the portable handset, and appropriate text is shown on the display to confirm that the ticket is genuine. The input of such an authorization string may also trigger cancellation of a single use token, or cancellation of one use of a token valid for multiple uses. Such a system is an extension of authentication string generation described above. Here, the inspector inputs an authentication character string, displayed on the handset; along, with some extra data known only to him. The security application module (SAM) in the phone then computes whether the, authentication character string matches the ticket being displayed (i.e. an automatic version of the fraud check mentioned above). The additional data input by the ticket inspector is used as an access code to allow this automatic verification process to take place. if the ticket is verified a simple acknowledgement is shown. The ticket may then be cancelled, fully or partially for nulti-use tickets.

This mechanism automatically detects any fraudulent changes to tickets and also any tickets that have not been received from the genuine service provider. This is because as part of the checking by the SAM it will have, authenticated the message as genuine before it accepting it and recorded its source, for use later when re-checking the validity as the result of an inspection. This allows the inspection process to prove the ticket is not a copy. This functionality is made possible by program code stored within the SAM of the portable handset.

For greater overall security the inspector may carry a simple electronic device, into which the authorisaton string is entered. Phis device then returns a different number which Is then entered into the phone to be checked by the security apphcaton module software Subsequently an acknowledgement recognizable by the Inspector as genuine Is returned Effectively the inspector's device produces an encrypted version of the authonsaton string that is then entered by the inspector on the phone keypad. This number then has

to be decrypted by the SAM in the phone to provide the real authorization string, which is then used as described above. In this case both the inspectors device and the SAM are mutually authenticating each other and the numbers entered by the Inspector Include a randomsing element such that successive cancelling of identical tickets would use different authorization strings. In this case a number displayed as part of the acknowledgement on the phone should be re-entered into the inspectors device whereby a trusted acknowledgement would be regenerated. Such a system prevents seemingly more sophisticated fraud whereby the portable handset is merely a display of ticket data and acknowledgements are sequenced by remote control.

Alternatively tickets may be logged and authenticated automatically, A point and log method is then employed using the phones Afro red (JR) or other communications channel for communication with an authentication device at the point of service.

Stolen authentication devices are of limited value as the devices themselves can be set up so as to be valid only for a single shift. In all cases case the ticket data held within the portable handset is altered to register the number of uses.

An SMS "transaction" is generated as a result of token verification. Of course this message may never be received but repeated non-reception may be considered suspicious. This transaction message sends a copy of the token to indicate that the ticket had been used. In some applications part of the ticket data being sufficient to allow identification of the token may be sent. This information is sent to the application server, which then has a record that the ticket has leech used. This message may be used for proof of use only, or may result ill charism lt) an account held by the user. In other cases the message may be automatically tied to the mobile client location substantially in real time, Diving further management information or marketing opportumtes dependent on the location of use. Applications of location detection are dcscrbed further below.

Methods for implementing an authentication scheme wherein the portable handset communicates directly with a point of service terminal (POST) are now described.

Suitable POST devices include the inspector's device outlined above, entrance

( barriers and turnstiles, or electronic point of sale (EPOS) systems. Such a direct authentication scheme is conveniently implemented using a secondary communications channel which is fitted to many telephones (egg JR), separate from the main communications channel operating on the GMS or PCN networks which is used as the main data transfer channel. These secondary channels can be used without charge and offer a means to exchange data automatically between the portable handset and the POST. There is, currently, no widely accepted standard for such communications. Therefore a choice must be made so as to determine a suitable system. Four possible systems are outlined below.

A first system uses a serial data connector on the portable handset. This form of communication can be applied reasonably easily as most mobile telephones are fitted with such a connector as standard. However, such communication requires a wired connection, and there is no common standard for the socket on the mobile telephone.

The great inconvenience of wired connections means that such a system, while functional, is likely to be very Inconvenient.

A second system uses an Infrared Data Association (IRDA) interface on the portable handset, and a suitable IRDA interface on the POST. Such a system has the advantage of using a recognised standard. However, this system is disadvantageous In that only more expensive mobile telephones are fitted with an IRDA interface, and the interface must be enabled by the phone's user. Therefore, while IRDA provides the functionality required to authenticate tickets, its lack of ubiquity across the range of mobile telephones means tl-at it cannot be widely applied l, existing handsets.

third system uses the BlucTooth protocol This is a standard wireless hanclsfree protocol for connectivity between mobile telephones, computers and the like. It uses a radio frequency interface, operating at a frequency of 2.45 GHz which is currently unused world-wide. Available data rates are relatively high, and the spatial range over which the system can operate Is more than adequate for the present invention. Data rates of IMega hits per second (Mbps) are possible (likely to Increase to 2Mbps) and the system can operate over a range of some 10 metres. BlueTooth is currently

available on a relatively small number of mobile telephones, hut, if this interface become ubiquitous, it is likely to be Ideally suited to the requirements of the present invention. The system is gaining in popularity for use in local area wireless networks.

However. it is technically very unlikely that BlueTooth could be offered as a retrofit to an existing phone, which means that only new han<lsets are likely to have the necessary functionality A fourth system Is the ISO/IECl4443 or 15693 standards (hereinafter the 'lSO standards"). This again is a standardsed interface. The ISO standards can be added to existing portable handsets by replacing the STM card, and the necessary technology can be added to a Prisma SiM card of the form described above.

['here are a number of issues to address in adding ISO standard capability to the Prisma SIM. Of primary concern is the size of aerial, which, being constrained to the dimensions of the SIM, is much smaller than that of a card aerial which would be conventionally used with the ISO standard technology. However. with careful engineering, a suitable aerial can he constructed The range of the system's operation will be affected by the phone's construction. The shielding effects of any metallic components and the parasitic absorption of signals all contribute to this effect.

Empirical testing has indicated that the shielding effect is not inswTnountable, making the lSO standard a viable option for the present invention.

Normally the use of a small aerial and parasitic absorption of signals would Impose severe restraints on the opcratior, of a card using the ISO standard. This is harass the card's power Is also drawn from the interface, through the aerial. However a battery In the portable handset can power the SIM so that the aerial Is ilO longer required to provide pointer. In this case the desig', can be optimised for data communications only and under these conditions the STM can send and receive data across a ISO standard Interface. Since the RF interface need only be used for signal transfer and not power, the system is approximately 8 times more efficient than when power is obtained using the SIM aerial.

An alternative implementation of the fourth system uses a smart battery interface known as SMBus. This is a serial data bus which is used to monitor the charging and discharging of the intelligent batteries now used in most mobile phones. This interface can also be used to connect with a separate circuit that emulates the functionality of the ISO standard interface. Thus avoiding the size restrictions of the SIM module and allowing a larger aenal to be used.

The use of the ISO standard technology is advantageous in having a low incremental cost. This is simply the cost of adding software to the Prisma SIM. The ISO standard technology can be applied to any current design of phone by inserting a suitable Prisma SIM card.

In conclusion, it Is considered that use of the ISO standard for communication

between portable handsets and POSTs is the most appropriate interface. However, it will be appreciated that the other three protocols described above, along with a number of other suitable communications protocols, can also be used.

The system of the present Invention may be further enhanced by the inclusion of further functionality, which will now be described. An enhancement to the application of the tickets described above can be made by using GSM technology in conjunction with ordnance survey information to determine the location of the portable handset.

The location technology required to add the functionality described alcove can he added using the known Mobile phone POSILIOning systen (MPS). This is sinlar lo satelhte-bascd Global Positioning Systems (GPS) but with the additional capability of determining the location of a handset even when Inside buildings, parking garages and other shielded areas that are Inaccessible to GPS systems such as inside a pocket or briefcase The world's three largest mobile phone manufacturers founded the Location Interoperability Forum (LIE) In October 2000, to achieve the goal of offering

location-based services world-wide on wireless networks and terminals. The accuracy I of MPS is rhythm approximately 125 metros.

For location In the United Kingdom, the ordnance survey (OS) has introduced a system of uniquely numbering features In the real world on to its digital MasterMap.

This number is known as a Topographical identifier (TOID) as described in the following quotation from the OS.

"Each OS MasterMap feature (point, line and area) is labelled with a unique 16-digit number, known as a TOID. The TOlD of a feature remains unchanged throughout the life of the feature. Area and point features have lifecycles that mirror those of the real-

world objects they represent. Every feature has a version number that is updated on any kind of change to the feature. Referring to a feature by TOID and version number means the exact version of the feature is specified."

What this means is that any feature (Bus depot, Railway station, Shopping mall...etc) has a code that refers to a space and position on a map ar, ywhcrc in the UK. A system operating in accordance with the present Invention can then construct a data base of features relevant to its business and associate with the TOID qualitative details such I as Description, address, function....(St Pancras, Euston road, London, Post code, Rail

Station). This database would form the heart of a system using the MPS system, as described above.

By adding real world tracl;ing of a portable handset to the system fulfiller services can be provided. These include the provision of booking infonnation to suit the location l from where the enquiry was made, for example a request such as "I need to gel from here to London", will query a rail database with a start station generated fiom the I current location, and an end station of"London". "I want a ticket see Gladiators at the nearest cinema" will query a cinema database, to determine which cinema Is geographically closest to the current location, and then query the cinema database to determine the times at which Gladiators is showing.

Further functionality may include road charging related to positional tracking information. For example, detection that a user is within Greater London, and in a car may prompt the display of a message "Confirm your payment of a road user charge" which the user may then select yes or no, and pay and receive a ticket using the system of the present invention An other feature that may be added is an Autoredeem capability. That is, vouchers can he inspected and redeemed remotely, on the hasps of location rather than inspection. For example, "Welcome to the Theme Parl. We will take 10% off your bill by redeeming your holiday club voucher." The user will then be given the option to confirm or cancel the redemption.

Similarly, vouchers may be automatically provided on the basis of location. That is, tokens are sent to portable handsets when in a predetermined area. For example "Welcome to the shopping centre - redeem this e-voucher in the Burger Bar and receive a free coffee...." The ticket can then be redeemed as described above.

Although the description as set out above relates to the Prisma SIM card and

functionality thereof, it will be appreciated that the invention may be suitably implemented using other commercially available smart technology such as smart cards capable of executing Java programs.

In many applications of the invention, the portable handsets described above will be mobile tclcphones. It Will be appreciated, however, teal ills invention is widely applicable to any suitable portable device having the necessary communications capabhtics.

Claims

1. A portable handset, comprising a memory for storing ticket data including ticket authentication data, input means for accepting an input representing a ticket authentication requests and means for producing an output whicl1 identifies a ticket represented by the ticket data and Includes data derived from the stored autnentcaton data.

2. A portable handset according to claim 1, further comprising means to produce the output in response to the authentication request.

3. A portable handset according to claim 1 or 2, wherein the input comprises a first authentication string, and the output comprises a second authentication string generated using the first authentication string and the stored authentication data.

4. A portable handset according to any preceding claim, further comprising a user readable display.

5. A portable handset according to claim 4, wherein the means for producing the output is configured to display the output on the user readable display.

6. A portable handset according to claim 5, wherein the stored authentication data comprises characters, and/or graphics, andlor animated graphics which can be generated only by an authorsed issuer of the tick:".

7. A portable handset according to any preceding claim' wherein the handset comprises at least one communications channel.

8. A portable handset according to claim 7, wherein the at least one communications channel uses infra red communication, or radio frequency communication.

9 A portable handset according to claim 7 or 8, wherein the means for producing the output is configured to direct the data derived from the stored authentication data to the communications channel.

10. A portable handset according to any preceding claim the input means is a keypad of the portable handset.

11. A portable handset according to any one of claims 1 to 9, wherein the input means is a communications channel of the portable handset.

12. A portable handset according to any preceding claim, wherein the handset also functions as a mobile telephone.

13. A method for authenticating ticket data including authentication data stored in a memory of a portable handset, the method comprising accepting an input to the portable handset representing a ticket authentication request, and producing an output from the portable handset which identifies a ticket represented by the ticket data and includes data derived from the stored authentication data.

14. A method according to any claim 13, wherein the output is displayed on a display screen of the devices allowing the ticket to be identified by visual inspection of the said display screen.

15. A Netted according to L:lair 1 or 14, wherein the data den ved from the stored authentication data is displayed on a display screen of the device, allowing the ticket to be authenticated by Visual inspeclio,, ofthe said display screen

16. A method according to claim 15, wherein the stored authentication data comprises characters, and/or graphics and/or animated graphics which can be generated only by an authorised issuer of the ticket data.

17. A method according to claim any one of claims 13 to 16, wherem the output is transmitted from the handset using a communications channel of the portable handset.

18. A method according to any one of claims 13 to 17, wherein the data derived from the stored authentication data is transmitted from the handset using the commumcations channel of the portable handset.

19. A method according to any one of claims 13 to la, wherein the input is effected using a keypad of the portable handset.

20. A method according to any one of claims 13 to 18, wherein the input is effected using a communications channel of the portable handset.

21. A method according to claim 20, wherein the input is generated by a separate electronic device, and communicated to the portable handset using the said communications channel.

22. A method according to claim 21, wherein the input is generated by a point of service terminal.

23. A method according to claim 22. wherein the stored authentication data is communicated to the point of service terminal.

2- A computer program for carrying out the netlod of tiny oils f cluing 1^ to 23.

25. A camer medium carrying computer program code means to cause a portable handset, having access to a memory for storing ticket data Which includes authentication data, to execute procedure to: accept an input representing a ticket authentication request; and produce an output which identifies a ticket represented by the ticket data and includes data derived from the stored authentication data.

(

26. A carrier medium according to claim 25, wherein the memory forms part of the carrier medium

27. A carrier medium according to claim 25 or 26, wherein the carrier medium is a smart card.

28. A carrier medium according to claim 27, wherein the smart card is a mobile telephone SIM card.

29. A device for authenticating ticket data stored on a portable handset, the device comprising means to generate an output signal suitable for communication with the portable handset placed adjacent the device, means for receiving an authentication signal from the portable handset and means for authenticating the ticket data in response to the received authentication signal.

30. A device according to claim 29, wherein the means to generate the output signal is a transmitter using radio frequency communication, or infra red communication.

31. A device according to clang 29 or 30, wherein the means for receiving the authentication signal is a receiver using radio frequency communication, or using infra red communication.

32. A device according to any one of claims 29 to 31, further comprising a connection to a database server such that ticket authentication operations are communicated to the database sew en

33. A computer system for allowing a user to obtain a ticket, the system composing: a connection to a portable handset operated by a user, a connection to a ticket server operated by an authorised ticket provider; a connection to a payment

( server operable to authorise payment transactions, means to receive a ticket purchase request from the portable handset operated by the user; means to direct ticket purchase requests to the ticket server; means to receive payment details from the portable handset operated by the user, means to direct payment details to the payment server; means to receive ticket data representing the requested ticket firom the ticket server, and means to transmit the said ticket data to the portable handset of the user.

34. A computer system according to claim 33, wherein the connection to at least one of the ticket server and the payment server is a wired connection

35. A computer system according to claim 34, wherein the wired connection is provided by the Internet.

36. A computer system according to any one of claims 33 to 35, wherein the connection to the portable handset is a wireless connection.

37. A computer system according, to claim 36, wherein the wireless connection uses a mobile telephony network.

38. A computer system according to any one of claims 33 to 37, further comprising means to receive data from the portable handset indicating that the ticket has been used.

39. A computer system according to a''> <c of claimers -3 ice ÀSi, further compnsmg a connection to a terminal at a point of service, and means to receive data fiom the terminal indicating that the ticket has been used.

40. A computer system according to any one of claims 33 to 39, comprising connections to a plurality of ticket servers, each ticket server being operated by a respective authorised ticket provider, and selection means to select to which of the plurality of ticket servers a ticket purchase request should be directed

(

41. A method for allowing a user to obtain a ticket, the method comprising: receiving a ticket purchase request from a portable handset operated by a user; directing the ticket purchase request to a ticket server; receiving payment details from the portable handset operated by the user; directing the payment details to the payment server; receiving ticket data representing the requested ticket from the ticket server, and transmitting the said ticket data to the portable handset of the user.

42. A method for allowing a user to obtain a ticket using a method according to claim 41, and for allowing authentication of that ticket using a method according to any one of claims 13 to 23.

43. A computer program for carrying out the method of claim 41.

44. A carrier medium carrying computer program code means to cause a computer to execute procedure according to the method of claim 41.

45. A method for purchasing a ticket using a portable dc,icc, the method comprising sending a signal to a remote server representing a request for the ticket, sending data to the remote server, said data representing a means of payment for the requested ticket, receiving data representing the ticket from the server, and storing the saved ticket in a memory of the portable device

46. A portahlc handset substantially as hercirlheforc clcscribed, with reference to the accompanying, drawings.

47 A,ncthoA for authenticating, ticket data stored ill a pcrlEhle handset, substantially has hereinbeforc dcscribed with reference to the accompanying drawings. 48. A computer system for allowing a user to obtain a ticket substantially as hereinbefore described, with reference to the accompanying drawings.