GB2482184A

GB2482184A - A card holder ID and security code are used to access cardholder information held in a database

Info

Publication number: GB2482184A
Application number: GB201012367A
Authority: GB
Inventors: Gerry Duce
Original assignee: RESET TRAINING Ltd
Current assignee: RESET TRAINING Ltd
Priority date: 2010-07-23
Filing date: 2010-07-23
Publication date: 2012-01-25
Also published as: GB201012367D0

Abstract

A database access control system comprises: a server 12 having an access control unit 16; a first database 18 adapted to store at least one cardholder ID number that has been allocated to a cardholder and at least one corresponding card security code; at least one further database 22 adapted to store information associated with the at least one cardholder; a database interface for the at least one further database; at least one card 26 with the cardholder ID number of the associated cardholder displayed on the front; and at least one user interface device 30 adapted to enable the input of the cardholder ID number and card security code to access the access control unit. The access control unit receives the cardholder ID number and the card security code from the user interface device, compares them with stored cardholder ID numbers and card security codes, and if valid provides access to the cardholder information.

Description

A System for Controlling Access to a Database and a Method Relating Thereto

Field of the Invention

The present invention relates to a system for controlling access to a database, and a method for accessing cardholder information stored in the database.

Background to the Invention

When an individual, for example an electrical technician, is required to perform a job, that individual is often required to provide the client with proof of his/her qualifications and competencies before commencing work. This often requires sending copies of the certificates to the client in advance, and then taking the originals along when commencing the job so that the client has proof that the certificates are authentic.

This means a lot of paperwork is required for each job. This is particularly onerous for the client and the individuals when a job lasts for a short period of time, for example, a couple of hours.

Also a client may require details of a company that it is employing, for example company accreditation details, competency details, insurance details. Again, this often requires sending company information including copies of the certificate to the client in advance, and then taking the originals along when commencing the job so that the client has proof that the certificates are authentic. This means a lot of paperwork is required for each job and can be onerous for both the client and the company being employed.

Accordingly it is an aim of the invention to provide a system that reduces the need for the handling of paperwork in situations as described above.

Accordingly it is also an aim of the present invention is to address at least one disadvantage associated with the prior art whether described herein or elsewhere.

Summary of the Invention

According to the present invention there is provided a system for controlling access to at least one database, and a method for accessing cardholder information stored in the at least one database as set forth in the appended claims. Other features of the invention will be apparent from the dependent claims, and the description which follows.

According to one aspect of the invention there is provided a system for controlling access to at least one database, comprising: a server having an access control unit, a first database adapted to store at least one cardholder ID number and at least one card security code, each said cardholder ID number being allocated to a cardholder and having a corresponding said card security code, at least one further database adapted to store information associated with the at least one cardholder, and a database interface for the at least one further databases; at least one card, each card having a said cardholder ID number of the associated cardholder displayed on the front thereof; and at least one user interface device adapted to enable the input of the said cardholder ID number and a corresponding said card security code to access the control unit; wherein the access control unit is adapted to receive the cardholder ID number and the corresponding card security code from the user interface device, compare the cardholder ID number and card security code with the stored cardholder ID numbers and card security codes, and if the cardholder ID number and card security code are valid, then provide access to the cardholder information.

Preferably the server further comprises an identity interface for display on the user interface device. The identity interface may be adapted to enable keyed input of the cardholder ID number and the card security code. The identity interface may be adapted to enable keyed input of a user ID number and a password.

Preferably each card has the card security code displayed on the back thereof in the form of a card verification code.

Preferably each card comprises a barcode containing the cardholder ID number and the corresponding card verification code and the system comprises at least one card reader connected to or contained within a said user interface device, each card reader being adapted to scan the barcode and send the cardholder ID number and the card verification code to the access control unit via the user interface device.

Preferably each card comprises a chip containing the card identification number and card validation code, and the system comprises at least one card reader connected to a said user interface device, each card reader being adapted to read the chip and to send the cardholder ID number and the card validation code to the access control unit via the user interface.

Preferably the server further comprises a user login interface for display on the user interface to enable keyed input of a verifier ID number and password.

Preferably at least one of the at least one card reader is a desktop reader.

Preferably at least one of the at least one card reader is contained in the user interface device.

The at least one of the said at least one user interface device may be a mobile telephone. The mobile telephone may be adapted to be the card reader. The at least one of the said at least one user interface device may be a personal computer.

Preferably the database interface is adapted to display a list of qualifications and competencies corresponding to the cardholder whose cardholder ID number and card validation code have been validly input. Preferably a green light is displayed next to each qualification that is valid and has longer than a predetermined time left to run, an amber or yellow light next to each qualification that is valid but has less than a predetermined time left to run, and a red light next to each qualification that has expired.

According to a further aspect of the invention there is provided a card adapted for use in the system as hereinbefore described.

Preferably the card includes a barcode or a chip for storing the cardholder ID number and card security code. The card may be a contactless card.

According to a further aspect of the invention there is provided method of accessing cardholder information stored in at least one database, comprising the steps of: inputting a cardholder ID number and a card security code to a user interface device; verifying the cardholder ID number and the card security code by comparing them with stored cardholder ID numbers and corresponding card security codes; allowing access to stored cardholder information if the cardholder ID number is valid and the card security code is correct.

Preferably the step of inputting a cardholder ID number and a card security code comprises scanning the barcode of a card.

Alternatively the step of inputting a cardholder ID number and a card security code comprises reading the chip on a card.

Alternatively the step of inputting a cardholder ID number and a card security code may comprise keying in the cardholder ID number and the card security code.

Preferably, before the step of allowing access to stored cardholder information, the method further comprises the steps of: inputting a user ID number and password to the user interface device; verifying the user ID number and the password by comparing them with stored user ID numbers and passwords; and allowing access to stored cardholder information further includes allowing access only if the user ID number is valid and the password is correct.

The present invention includes any combination of the herein referred to features or limitations.

Brief Description of the Drawings

For a better understanding of the invention, and to show how embodiments of the same may be carried into effect, reference will now be made, by way of example, to the accompanying diagrammatic drawings in which: Figure 1 shows a block diagram of a system for controlling access to at least one database according to a first embodiment of the invention; Figure 2 is a flowchart showing the steps in accessing directly the system of Figure 1; and Figure 3 is a flowchart showing the steps in accessing the system of Figure 1 by a verifier provided with a card reader.

Description of the Preferred Embodiments

Figure 1 shows a system 10 for controlling access to at least one database according to a first embodiment of the invention. The system 10 is a retrieval system run by a service provider that allows users, including cardholders or verifiers, to access information relating to the cardholder. The cardholder may be an individual, such as a tradesperson, or a company. The stored information for an individual may be certificate data which includes certificates and information relating thereto. The certificates may be those showing that individuals professional qualifications.

However, the system is not limited to holding certificates and related information, and may alternatively or additionally hold other cardholder information. The stored information for a company may include company accreditation details, competency details, insurance details and banking details. The company may employ one or more individual cardholders. The verifier is an individual or company who needs to check the information relating to a cardholder and is therefore likely to be someone employing the services of the cardholder.

The system 10 comprises a server 12 having an identity interface 14, an access control unit 16, a first cardholder database 18, an individual cardholder interface 20, a second group of databases 20a-d, a company interface 22, a third group of databases 22a-d, and a fourth verifiers database 24. The access control unit 16 controls access to the databases 18, 20a-d, 22a-d and 24.

The first database 18 stores cardholder ID numbers and corresponding card verification codes of at least one cardholder.

The second group of databases 20a-d stores cardholder information for individuals.

Database 20a stores controlled personal details that are editable only by the service provider. Database 20b stores editable personal details that can be edited by the cardholder. Database 20c stores details of the qualifications and competencies of the cardholder, including details such as the awarding body and the expiry date where relevant. Database 20d stores verified certificate images associated with the cardholder.

The third group of databases 22a-d stores cardholder information for companies.

Database 22a stores controlled company details that are editable only by the service provider. Database 20b stores editable company details that can be edited by the relevant company. Database 20c stores details of the accreditation competencies and insurance details of the company. Database 20d stores verified certificate and document images associated with the company.

The fourth database 24 stores information relating to verifiers using the system.

The databases 18, 20a-d, 22a-d and 24 are maintained by the service provider who controls the details held in databases 20a, 20c, 22a and 22c and verifies that the certificate images held in databases 20 d and 22d are true copies of the originals.

The identity interface 14 enables the input of user identification details, which comprise a user ID number and a password. The user ID number and corresponding password are checked against a database containing valid user ID numbers and corresponding password. If the user is validly logged on then the identity interface 14 enables the input of cardholder identification details. The cardholder ID number and corresponding card security code are checked against a database containing valid cardholder ID numbers and corresponding card security codes. Only if the user is logged on and a valid cardholder ID number and card verification code are input will the user be able to view the cardholder information. The cardholder information is viewed either via the individual cardholder interface 20 which provides an interface to the second group of databases 20a-d or via the company interface 22 which provides an interface to the third group of databases 22a-d.

The system further comprises at least one card 26, at least one card reader 28 (optional), and at least one user interface device 30, such as a personal computer, a mobile telephone or an iphone. Each user interface device 30 communicates with the server across a network 32, for example the Internet.

The card 26 has the cardholder ID number on the front, for example a 16 digit number, which is different for every cardholder. The first 8 digits of the 16 digit number may relate to information in connection with the service provider and the second eight digits may relate to the cardholder. However, the format of the number can take any form that identifies the cardholder and preferably the service provider.

The card 26 may have a card verification code printed on the back, which may comprise 3 digits. The card verification code may be part of a longer number such as an eight digit number, where the first 5 digits contain data relating to card itself, such as the issue number and model of the card, and the last three digits are the card verification code.

A user (the cardholder or a verifier) may access the server 12 directly by means of the user interface device 30. The identity interface 14 is displayed on the user interface device 30 and enables the input of a said cardholder ID number and the corresponding card verification code. The cardholder ID number and the card verification code can be read directly by the cardholder or other authorised person from the card 26.

The access control unit 16 receives the input cardholder ID number and card verification code from the user interface device 30, compares the input cardholder ID number and card verification code with the stored cardholder ID numbers and card verification codes, and if the input cardholder ID number and card verification code are valid, then provides access to the certificate data via the database interface 18.

The card 26 is also provided with a barcode on the back. The barcode contains the cardholder and company ID number and the card verification code. The barcode is read by a barcode reader 28. The barcode reader 28 may be provided in the form of a desktop barcode reader which plugs into a communication port of, or has a wireless communication with, a user interface device 30, such as a personal computer or the like. The desktop barcode reader is a plug and play device which, when plugged in a user interface device 30 for the first time, downloads the necessary software to enable direct access to the database interface 18 for the relevant cardholder if the scanned cardholder ID number and card verification code are valid. This avoids the need for use of the identity interface 14. The use of a barcode reader 28 is particularly suitable for a client who often needs to verify the qualifications and competencies of individuals or companies.

If the client needs to verify a cardholders qualifications and competencies, but the cardholder cannot be present, then the cardholder may give his card ID number and card verification code to the client over the telephone, so that the client may access the website and obtain details of the cardholders qualifications and competencies remotely.

The card 26 may be further provided with a list of qualifications and competencies on the back and expiry dates, where relevant. A new card 26 will be issued each time the cardholder adds a new qualification to the first and second database 18 and 20.

When the new card 26 is issued, only the currently valid qualifications and competencies are printed on the back.

The card may also be provided with a hologram and a photograph of the cardholder as additional security features.

The individual cardholder interface 18 to the second group of databases 20a-d displays details of the certificate including, for example, the name of the qualification, the name of the awarding body, the completion date of the qualification, any expiry date of the certificate and a so called "traffic light" arrangement. The "traffic light" arrangement provides the viewer with a quick indication of whether the certificates are currently valid. When a certificate is valid and has longer than a predetermined time (for example 28 days) left to run, then a green light is displayed next to the qualification. When a certificate is valid but has less than a predetermined time (for example 28 days) left to run, then an amber or yellow light is displayed next to the qualification. When a certificate has expired, then a red light is displayed next to the qualification. The individual cardholder interface 18 may display qualification information from the database 20c and contain links to each of the cardholders verified certificate images in the database 20d.

The server 12 may also be provided with a reminder system which sends out reminders to the cardholder via the internet when a certificate expiry date is less than a predetermined time away (for example 90 days).

Although the invention has been described with reference to a card 26 comprising a barcode, the card 26 may alternatively, or additionally, be provided with other means for storing the cardholder ID and the card verification code, such as a readable chip to provide the required security measures. The card may be a contactless card.

Suitable card readers may be provided in each case.

Figure 2 is a flowchart showing the steps in accessing directly via a web interface the controlled database system of Figure 1. Firstly the user (the verifier or the cardholder) accesses the website of the service provider at step 110 via a said user interface device 30. The website will display the identity interface 14. The user interface 14 will first display a user login screen. The user then logs in at step 112 by inputting a user ID number and a password. The input user ID number and password are verified at step 116. If the input user ID number or the password are incorrect then the user is prompted to re-enter these details. A password reminder may be issued at step 114 if required.

The user interface 14 will then display a cardholder identification screen. The user inputs a cardholder card ID number and card verification code, which can be read from the card, into the identity interface 14 at step 118. The input cardholder ID number is verified against cardholder ID numbers held in the first database 18 at step 120. If the cardholder ID number is not valid, then an input error count is initiated at step 122 and the user is prompted to re-enter the cardholder ID number and the card verification number. Each time an invalid cardholder ID number is input the input error count is incremented by one. If the number of attempts to input a valid cardholder ID number, i.e. the input error count, exceeds three, then a "stop and call" message appears at step 124 which informs the user that the session has been terminated and that the user should call the service provider for assistance. If the cardholder ID number is valid, then the input card security code is checked at step 126. If the input card security code does not correspond to the security code held in the first database 18, then an input error count is initiated and the user is prompted to re-enter the card security code. Each time an invalid card security code is input the input error count is incremented by one. If the number of attempts to input a valid card security code, i.e. the input error count, exceeds three, then a "stop and call" message appears at step which informs the user that the session has been terminated and that the user should call the service provider for assistance. If the input card security code corresponds to the card security code held in the first database 18, then the cardholder can access his certificate data at step 132.

Figure 3 is a flowchart showing the steps in accessing the controlled database system by a verifier provided with a card reader 28. The verifier starts to access the system at step 210. At step 212 the verifier is required to login as described with respect to step 112 of Figure 2. Once the verifier has logged in then the verifier can either input the cardholder ID number and card verification code manually at steps 214 and 216 or use a card reader at one of steps 218, 220 or 222.

When the card has a barcode, then the user will scan the barcode at step 218. When the card has a chip, then the chip is read at step 220. When the card includes contactless technology, then the card will be read at step 222. If the card reader cannot read the relevant card using the card reader, then the verifier can input the cardholder ID number and card verification code manually at steps 214 and 216.

Manual input of the cardholder ID number and card verification code may be required if the cardholder is not present in person, but gives the verifier his cardholder ID number and card verification code over the telephone. Also, manual input of the cardholder ID number and card verification code may be required if the card reader is unable to read the card, for example if the card is damaged.

Whatever method of inputting the cardholder ID number and the card verification code is used, the cardholder ID number and the card verification code are verified at step 226.

Figure 3 will be further described assuming that the verifier is given a card having a barcode, although the procedure will apply to all other types of card. The verifier scans the barcode on the card 26 using the barcode reader 28 at step 218. The cardholder ID number and card verification code are extracted from the barcode by the barcode reader at step 218 and sent directly to the access control unit 16 in the server at step 224. The scanned cardholder ID number and card security code are checked against data held in the first database 16 at step 226. If the scanned cardholder ID number and card security code are invalid, then an error count is initiated at step 228 and the verifier is prompted to rescan the card or enter the cardholder ID number and card security code manually. Each time an invalid card security code is input the input error count is incremented by one. If the number of attempts to input a valid cardholder ID number and card security code, i.e. the input error count, exceeds three, then a "stop and call" message appears at step 232 which informs the verfier that the session has been terminated and that the verifier should call the service provider for assistance. If the scanned cardholder ID number and card security code are valid, then the verifier can view the cardholder data at step 232.

It is not essential for the verifier to log on before the barcode of a card is scanned. If the user has not logged on before scanning the card 26 they will be prompted to this after the barcode has been scanned but before the cardholder ID number and card verification code have been verified.

If the card is lost or stolen, the service provider is able to disallow access to the system for that card. The service provider is also able to allow temporary access by a blocked card.

Although a few preferred embodiments have been shown and described, it will be appreciated by those skilled in the art that various changes and modifications might be made without departing from the scope of the invention, as defined in the appended claims.

Attention is directed to all papers and documents which are filed concurrently with or previous to this specification in connection with this application and which are open to public inspection with this specification, and the contents of all such papers and documents are incorporated herein by reference.

All of the features disclosed in this specification (including any accompanying claims, abstract and drawings), and/or all of the steps of any method or process so disclosed, may be combined in any combination, except combinations where at least some of such features and/or steps are mutually exclusive.

Each feature disclosed in this specification (including any accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise. Thus, unless expressly stated otherwise, each feature disclosed is one example only of a generic series of equivalent or similar features.

The invention is not restricted to the details of the foregoing embodiment(s). The invention extends to any novel one, or any novel combination, of the features disclosed in this specification (including any accompanying claims, abstract and drawings), or to any novel one, or any novel combination, of the steps of any method or process so disclosed.

Claims

Claims 1. A system for controlling access to at least one database, comprising: a server having an access control unit, a first database adapted to store at least one cardholder ID number and at least one card security code, each said cardholder ID number being allocated to a cardholder and having a corresponding said card security code, at least one further database adapted to store information associated with the at least one cardholder, and a database interface for the at least one further databases; at least one card, each card having a said cardholder ID number of the associated cardholder displayed on the front thereof; and at least one user interface device adapted to enable the input of the said cardholder ID number and a corresponding said card security code to access the control unit; wherein the access control unit is adapted to receive the cardholder ID number and the corresponding card security code from the user interface device, compare the cardholder ID number and card security code with the stored cardholder ID numbers and card security codes, and if the cardholder ID number and card security code are valid, then provide access to the cardholder information.
2. The system of claim 1, wherein the server further comprises an identity interface for display on the user interface device.
3. The system of claim 2, wherein the identity interface is adapted to enable keyed input of the cardholder ID number and the card security code.
4. The system of claim 2 or 3, wherein the identity interface is adapted to enable keyed input of a user ID number and password.
5. The system of any preceding claim, wherein each card has the card security code displayed on the back thereof in the form of a card verification code.
6. The system of any preceding claim, wherein each card comprises a barcode containing the cardholder ID number and the corresponding card verification code and the system comprises at least one card reader connected to or contained within a said user interface device, each card reader being adapted to scan the barcode and send the cardholder ID number and the card verification code to the access control unit via the user interface device.
7. The system of any of claims 1 to 6, wherein each card comprises a chip containing the card identification number and card validation code, and the system comprises at least one card reader connected to a said user interface device, each card reader being adapted to read the chip and to send the cardholder ID number and the card validation code to the access control unit via the user interface.
8. The system of claim 6 or 7, wherein at least one of the at least one card reader is a desktop reader.
9. The system of any of claims 5 to 7, wherein at least one of the at least one card reader is contained in the user interface device.
10. The system of any preceding claim, wherein at least one of the said at least one user interface device is a mobile telephone.
11. The system of claim 10 when dependent on claim 6, wherein the mobile telephone is adapted to be the card reader.
12. The system of any of claims 1 to 9, wherein at least one of the said at least one user interface device is a personal computer.
13. The system of any preceding claim, wherein the database interface is adapted to display a list of qualifications and competencies corresponding to the cardholder whose cardholder ID number and card validation code have been validly input, a green light being displayed next to each qualification that is valid and has longer than a predetermined time left to run, an amber or yellow light next to each qualification that is valid but has less than a predetermined time left to run, and a red light next to each qualification that has expired.
14. A card adapted for use in a system according to any preceding claim.
15. A method of accessing cardholder information stored in at least one database, comprising the steps of: inputting a cardholder ID number and a card security code to a user interface device; verifying the cardholder ID number and the card security code by comparing them with stored cardholder ID numbers and corresponding card security codes; allowing access to stored cardholder information if the cardholder ID number is valid and the card security code is correct.
16. The method of claim 15, wherein the step of inputting a cardholder ID number and a card security code comprises scanning the barcode of a card.
17. The method of claim 15, wherein the step of inputting a cardholder ID number and a card security code comprises reading the chip on a card.
18. The method of any of claims 15-17, wherein before the step of allowing access to stored cardholder information, the method further comprises the steps of: inputting a user ID number and password to the user interface device; and verifying the user ID number and the password by comparing them with stored user ID numbers and passwords; and the step of allowing access to stored cardholder information further includes allowing access only if the user ID number is valid and the password is correct.
19. A system substantially as hereinbefore described with reference to any of Figures.
20. A method substantially as hereinbefore described with reference to any of Figures.
21. Any novel subject matter or combination including novel subject matter disclosed herein, whether or not within the scope of or relating to the same invention as any of the preceding claims.