GB2391646A

GB2391646A - Secure web page authenication method using a telephone number or SMS message

Info

Publication number: GB2391646A
Application number: GB0218254A
Authority: GB
Inventors: James Andrew Groves
Original assignee: Individual
Current assignee: Individual
Priority date: 2002-08-06
Filing date: 2002-08-06
Publication date: 2004-02-11
Also published as: GB0218254D0

Abstract

The present invention provides a method of accessing a secure web page wherein, in response to a client attempt to access a secure web page, a client ID code and vendor ID code are exchanged using a communication medium separate to that used to access the we page (eg a telephone call). In particular, client and vendor ID codes may be their telephone numbers and the separate communication medium may be a telephone network. The exchange is initiated upon display of the vendor telephone number on a web page and is completed by the sending of the client telephone number, by a telephone call or SMS text message to the vendor telephone number. The client then uses the client telephone number to gain acces to the secure web page.

Description

1 1 Improved secure web page access method The present invention proposes

a system for allowing a client to access a secure web page. More particularly the system provides for the exchange of information between the client and the web page vendor using SMS technology. _ Background

Password access to web pages is provided by many web sites and for various reasons. A web page may be provided which contains confidential information which only authorised persons are allowed to access. Alternatively, a web page may charge a client for access to its content and hence allow access only to those clients who have paid the necessary subscription. Alternatively, a web page that sells products or tickets may need to know who is accessing the web page in order to send the product or ticket to the correct address and bill the right person.

Security is one of the issues, which must be considered by vendors, especially when the information contained on the web page is of a sensitive nature or if the transfer of money between the client and vendor is required in order for the access to be gained. Banks provide web pages for client to access their bank details and make transactions. These sites are secure because the client uses username/password combinations, which were agreed by both parties by secure means e.g. post, at a prior time. Web pages to which the client is anonymous when the client first accesses them do not have the benefit of prearranged username/password combinations. In some cases the provider of the web page generates a username and password and provides the client with this information directly so that the client may begin accessing the web page.

Alternatively, a form may be provided on the web site containing the web page to which access is required. The client fills out the form and enters their own

( choice of username and password and other details as required by the web page provider. The web page must take the client's word for the fact that the details they provide are correct. If details of credit cards are given to the web page by the client, the web page must again trust that the client is the owner of the credit card. This anonymity can lead to fraud and other security problems.

Another problem with subscription web pages is that there is currently no provision for clients who wish to access a subscription web page for a short period of time e.g. a few minutes or hours. The client may be forced to take out a month or more in subscription fees for a web page that they may only wish to access once.

The present invention proposes a method for allowing a client to access a subscription web page using a secure means of identification and payment.

The secure means may take the form of the users telephone. Generally a telephone, and its corresponding number are unique to the client. When a client wishes to access a secure web page the vendor of the web page provides the user with a at least one vendor ID code and the client provides the vendor with at least one client ID code. These ID codes are transferred between the vendor and the client with the client using the their telephone as the medium for the transfer. At least one of a vendor ID code or a client ID code or a combination of a vendor ID code and a client ID code are stored by the vendor as usernames or username/password combinations. The client then uses an appropriate username or username/password combination to access the secure web page. The client may be charged for access to the secure web page by use of the client telephone during the exchange of ID codes. The telephone operator may then pass the revenue from the use of the telephone onto the vendor.

The system prevents fraudulent access to the vendor web page by linking the payment for access directly to the client. Possibly the telephone operator, be it mobile or landline, provides the name of the telephone owner so the payment can be linked with the client's name.

Brief description of the drawings

( In order that the present invention be more readily understood embodiments thereof will now be described by way of example only and with reference to the accompanying drawings in which: Figure l.l shows the request by a client for access to a secure vendor web page in the preferred embodiment of the present invention Figure 1.2 shows the supply of a vendor code to the client by the vendor in the preferred embodiment of the present invention Figure 1.3 shows the supply of the vendor code to the vendor by SMS message from the client in the preferred embodiment of the present invention Figure 1.4 shows the supply of the vendor code and client telephone number as a username password combination to the vendor from the client in order that the client might access the secure web page.

Detailed description of the preferred embodiment of the present invention

When a client attempts to access information on a secure vendor web page the client may be informed that the web page is secure and that the web page can only be accessed using a username or username/password combination that is to be generated according to a method that is the subject of the present invention.

The secure web page to which access is desired informs the client that in order to access the web page at least a vendor ID code and a client ID code must be exchanged between the vendor and the client. Preferably the first vendor ID code is a telephone number of the vendor, which may be individual to the page concerned or type of access required or a combination of both.

Preferably the first client ID code is the telephone number of the client's telephone. Preferably the vendor provides the client with the vendor telephone number by displaying the vendor telephone number on the relevant web page.

The client then provides the vendor with the client telephone number using the client telephone.

( In one embodiment the client provides the vendor with the client telephone number by making a telephone call to the vendor telephone number using the client telephone. In this case,preferably the vendor obtains the client telephone number from the telephone call using a system such as Caller Line Identification (CL1).

Alternatively the client telephone may be a mobile telephone. In this case, the client provides the vendor with the client telephone number by sending a text message to the vendor telephone number using the client telephone. Preferably the vendor obtains the client telephone number from the text message, within which the client telephone number is stored.

In either case the vendor stores the client telephone number. Preferably the client telephone number is stored with information regarding which vendor telephone number the client used in the case where there is more than one vendor telephone number. The vendor also has information regarding which vendor telephone numbers relate to which web pages and what types of access pre-stored. The vendor therefore knows which web pages the client is able to access and for how long, with the client telephone number.

The client telephone number is then the username for access to the relevant web page. The client can go to the web page and enter their telephone number as their username and gain access to the web page.

Preferably the second vendor ID code is a vendor access code. The vendor access code is displayed on the web page with the first vendor ID code, the vendor telephone number, when the client first tries to access a secure vendor web page. In this case the vendor access code may be fixed, randomly generated, individual to the page concerned or type of access required or specific to the client. There may be only one vendor telephone number, or a plurality of numbers may be provided relating to different levels of access, eg different areas of the site or different call rates.

Preferably the client provides the vendor with the client telephone number and the vendor access code by making a telephone call to the vendor telephone number using the client telephone. The client telephone number is

provided to the vendor in the same manor as described hereinbefore. Preferably the vendor access number is obtained by the vendor using an automatic telephone system. Such a system may answer the telephone call and request that the client inputs the vendor access code.

Alternatively if no CLI or the like exists the automated system may also request that the user inputs the client telephone number as well as the vendor access code.

Alternatively in the case when the client sends a text message to the vendor, the text message contains the vendor access code as the text. Therefore the vendor is able to obtain the vendor access code form the text message as well as the client telephone number.

Preferably the vendor stores the vendor access code and the client telephone number as a username/password combination. In the case where there is more than one web page the vendor stores information regarding which access codes relate to which web pages and what types of access. The vendor therefore knows which web pages the client is allowed access to and the nature of that access.

The client can then go to the relevant web page and enter the username/password combination and gain access to the web page.

In an alternative embodiment of the present invention, the client first provides the vendor with the first client ID code, the client telephone number.

Preferably this is achieved by the client entering the client telephone number into the vendor web page to which access is required.

Preferably the vendor then provides the client with the second vendor ID code, the vendor access code, by sending the code to the client telephone number. Preferably the client telephone is a mobile telephone and the vendor sends the vendor access code to the client mobile telephone as the text in a text message. The vendor access code is then the username for access to the relevant web page. The client can then go to the relevant web page and enter the vendor access code as a username and gain access to the web page.

Alternatively the vendor stores the client telephone number with the vendor access code as a username/password combination. When the user wishes to access the relevant web page, they must enter the client telephone number and vendor access code as a username/password combination.

The type of access that a client is permitted to have may vary as suggested hereinbefore. For instance, a time limit on the amount of time for which the client may access the secure vendor web page may be provided. The time limit may begin when the client first logs onto the web page using the username or username/password combination. Alternatively the client may only be allowed to access the secure web page once and once logged out the client may not log in again. Alternatively the client may be allowed to access the web page more than once with no time limit up to a predefined number of loggers. The client is charged for access to the web page through the client's telephone operator. In the case of the telephone being a mobile phone and the access code being sent by text message, the mobile phone operator charges the client for sending the text message to the vendor. The vendor then receives payment from the mobile phone operator. In the case where the access code is provided to the vendor by telephone, the number of the vendor could be a premium rate number from which the vendor receives payment from the telephone operator for each call that is made. In the case where the vendor sends the client a text message the client may be charged using reverse charge text messaging. The invention therefore enables simple chargeable access to secure web pages using communication means separate from the Internet to identify and charge users. This can be achieved as set out above, and other variations are possible without departing from the scope of the invention. For instance, the client ID code need not be the client telephone number, if a separate identification is created during the telephone communication with the vendor.

Claims

e:ll>s 1. A method of accessing a secure web page, comprising the steps

of: exchanging, in response to a client attempt to access a secure web page, a client ID code and a vendor ID code between the vendor and the client using a communication medium separate to that used to access the web page; receiving at least one of said ID codes from said client, at said secure web page using the communication medium used to access the secure web page; permitting access to said secure web page if said received ID code matches at least one of said ID codes;
2. The method as claimed in claim I wherein said communication medium separate to that used to access the web page is the telephone network.
3. The method as claimed in claim 2 wherein a first vendor ID code is a vendor telephone number.
4. The method as claimed in claims 2 or 3, wherein a first client ID code is a client telephone number.
5. The method as claimed in claims 3 or 4, wherein said step of exchanging includes a sub-step of displaying the vendor telephone number on the secure web page.
6. The method as claimed in claims 4 or 5, wherein said step of exchanging includes and a sub-step of receiving the client telephone number, using the client telephone to communicate with the vendor using the vendor telephone number so as to send the client telephone number to the vendor.

/
7. The method as claimed in claim 6 wherein said client telephone number is received from a telephone call from the client telephone to the vendor telephone number.
8. The method as claimed in claim 7 wherein said client telephone number is received from the telephone using Caller Line Identification.
9. The method as claimed in claim 7 wherein said client telephone number is received from the telephone call using an automated system which requires the user to enter into the client telephone keypad the client telephone number during the telephone call the vendor.
10. The method as claimed in claim 6 wherein said client telephone is a mobile telephone.
11. The method as claimed in claim 10 wherein said client telephone number is received from a text message sent from said client mobile phone to said vendor telephone number; wherein said vendor is able to obtain from said text message the client telephone number.
12. The method as claimed in claims 4 to 11 further comprising the step of storing said client telephone number as a username for access to the secure web page.
13. The method as claimed in claim 12 wherein said communication medium used to access the secure web page is the luternet.

(
14. The method as claimed in claim 13 wherein said step of receiving, at least one ID code is a step of receiving the client telephone number.
15. The method as claimed in claim 14 wherein the client is permitted access if the received client telephone number matches the stored client telephone number.