TR201516941A2

TR201516941A2 - A SECURE AUTHENTICATION SYSTEM FOR INTERNET APPLICATIONS

Info

Publication number: TR201516941A2
Application number: TR2015/16941A
Authority: TR
Inventors: Yalçinsoy Murat
Original assignee: Turkcell Teknoloji Arastirma Ve Gelistirme Anonim Sirketi
Priority date: 2015-12-25
Filing date: 2015-12-25
Publication date: 2017-04-21

Abstract

Bu buluş özellikle finans kurumlarının internet üzerinden müşterilerine sundukları finansal uygulamalar başta olmak üzere tüm internet uygulamaları için uygulanabilen bir güvenli doğrulama sistemi (1) ile ilgidir.This invention is related to a secure verification system (1) that can be applied to all internet applications, especially the financial applications offered by financial institutions to their customers over the internet.

Description

TARIFNAME INTERNET UYGULAMALARI IÇIN BIR GÜVENLI DOGRULAMA Teknik Alan Bu bulus özellikle finans kurumlarinin internet üzerinden müsterilerine sunduklari finansal uygulamalar basta olmak üzere tüm internet uygulamalari için uygulanabilen bir güvenli dogrulama sistemi ile ilgidir. Önceki Teknik Günümüzde teknolojinin hizla gelismesiyle birlikte internete baglanabilen bilgisayarlar, akilli telefonlar gibi elektronik cihazlar vasitasiyla alis veris, bankacilik islemleri basta olmak üzere her türlü islemlerin kisilerin bulunduklari ortamlardan kolay bir sekilde gerçeklestirilebilmesi mümkündür. Bu tür islemlerin gerçeklestirilmesi sirasinda kisiye özel hassas bilgilerin korunmasi amaciyla internet uygulamalarina giriste kullanici adi ve sifre girilmektedir. Ancak sadece kullanici adi ve sifre girilmesi yeterli güvenligi saglayamamaktadir. Bu sebepten dolayi günümüzde internet uygulainalarina giriste güvenligin tam olarak saglanabilmesi sifre girildikten sonra genellikle ikinci bir dogrulama araci kullanilmasi özellikle bir çok finans uygulamasinda standart hale gelmistir. Söz konusu güvenlik yöntemleri için “biri bildigin biri sahip oldugun” seklinde iki dogrulama yönteminin kullanilmasi devlet kurumlarinca özellikle finans uygulamalari için zorunlu tutulmaktadir. DESCRIPTION A SECURE AUTHENTICATION FOR INTERNET APPLICATIONS Technical Area This invention is especially important for financial institutions to offer their customers over the internet. for all internet applications, especially financial applications It is about a secure authentication system that can be implemented. Prior Art Today, with the rapid development of technology, shopping via electronic devices such as computers, smart phones, All kinds of transactions, especially banking transactions, are in which persons environments can be easily implemented. These types of in order to protect sensitive personal information during the realization of Username and password are entered when logging into internet applications. However, only Entering the username and password does not provide sufficient security. Because of that Therefore, today, when you enter internet applications, you can not fully secure your security. A second verification tool is usually required after the password is entered. Its use has become a standard in many finance applications. Promise For the security methods in question, there are two types of “one you know and one you have”. The use of the verification method is used by government institutions, especially in finance. mandatory for applications.

Bahsedilen ikinci dogrulama yöntemi için günümüzde agirlikli olarak kisa mesaj (SMS_Short Messaging Service) teknolojisi kullanilmaktadir. Finans kurumlari dogrulama kodu ve sifresi üreten metin mesajlarini mobil iletisim hizmeti sunan mobil operatörler üzerinden müsterilerine göndermekte ve müsterilerin cep telefonu, akilli telefon gibi elektronik cihazlarina gelen metindeki sifreyi ekrandaki dogrulama koduyla eslestirerek ya da kontrol ederek internet uygulainasina girmeleri istenmektedir. Basarili bir kod, sifre eslesmesi ile kullanicinin dogrulanmis oldugu kabul edilerek kullanicinin uygulamaya girisine, uygulama içerisinde islem yapabilmesine izin verilmektedir. For the aforementioned second authentication method, nowadays mainly short message (SMS_Short Messaging Service) technology is used. financial institutions A mobile communication service offering text messages that generates verification codes and passwords. send it to its customers via mobile operators and the password in the text that comes to electronic devices such as phone, smart phone. internet by matching or checking the verification code on the screen. are required to enter the practice. With a successful code, password match assuming that the user has been verified, the user's entry into the application, It is allowed to operate within the application.

Son yillarda kisa mesaj ile dogrulama yapilmasi özellikle internet üzerinden gerçeklestirilen bankacilik uygulamalarinda genel geçer standart haline gelmistir.In recent years, verification by text message has been made, especially over the internet. It has become the generally accepted standard in banking applications.

Söz konusu sistemin kullanilabilirligi çok yüksek olup müsteri açisindan algilanabilirligi ve adaptasyonu da oldukça kolaydir. Tüm bunlara ragmen bahsedilen sistemin birkaç açik noktasi bulunmaktadir. Kisa mesaj gönderiminde yasanabilecek sikintilar ve kisa mesajin geç iletilmesi müsteriler açisindan kabul edilebilir durumlar degildir. The usability of the system in question is very high and It is also very easy to detect and adapt. Despite all this The mentioned system has several open points. When sending a short message Problems that may be experienced and the late delivery of the short message are not accepted by the customers. conditions are not possible.

Tüm bunlara ek olarak kötü niyetli kisiler ya da bilgisayar korsanlari tarafindan kisa mesaj yönlendirme teknikleri gelistirilmistir. Akilli telefonlarin kullaniminin yayginlasmasiyla bu tür Virüs/trojan yazilimlarin cep telefonlarina yüklenmesi kolaylasmis ve bu tür yazilimlar yüklenen cep telefonu kullanicilarinin tehlikeli durumlarla karsilasma ihtimalleri çok basitlesmistir. Cep telefonlarina yerlestirilen bu tarz zararli yazilimlarla müsterilere gelen kisa mesaj içerisindeki sifreler söz konusu kisa mesajlarin müsterilerin haberi olmadan baska bir cep telefonuna yönlendirilmesiyle çalinabilmektedirler. Bahsedilen yöntem ile müsterilerin ciddi kayiplari ve hak talepleri mevzu bahis olmaktadir. In addition to all this, by malicious people or hackers Short message forwarding techniques have been developed. The use of smart phones With the spread of this type of Virus / Trojan software on mobile phones facilitated and dangerous for mobile phone users with such software installed. The possibilities of encountering situations are greatly simplified. embedded in mobile phones The passwords in the short message sent to the customers with such malicious software are mentioned. the subject text messages are sent to another mobile phone without the knowledge of the customers. can be played by directing. With the mentioned method, customers are seriously losses and claims are in question.

Günümüzde ikinci yöntemi için kisa mesaj teknolojisinin yani sira güvenlik araci üreten cihazlar, yine güvenlik araci üretmek için cep telefonlari için gelistirilen uygulamalar, sertifika dogrulamasi yapan USB cihazlar ve mobil imza teknolojileri gibi daha farkli yöntemler de kullanilmaktadir. Ancak; bahsedilen tüm yöntemlerin en az bir açik noktalari bulunmaktadir.Today, for the second method, besides the short message technology, the security tool devices, which are developed for mobile phones to produce security tools. applications, certificate validating USB devices and mobile signature Other methods such as technologies are also used. However; said All methods have at least one open point.

USZOO7/0174080 sayili Birlesik Devletler patent dokümaninda telefonun güvenlik belirteci olarak kullanildigi gelistirilmis bir islem güvenligi için yöntem ve aparattan bahsedilmektedir. Söz konusu bulusta örnegin banka gibi bir kurum müsterisi bir ya da daha çok sayida sabit ya da mobil telefonunu kayit ettirebilmekte ve söz konusu telefon numaralarini hesabi ile iliskilendirmektedir.United States patent document USZOO7/0174080 provides security for the phone. method for an improved transaction security where it is used as a token and apparatus is mentioned. In the invention in question, an institution such as a bank customer registers one or more fixed or mobile phones and associates the said phone numbers with his account.

Daha sonra herhangi bir uzaktan islemle birlikte kullanici ya banka sistemini arayarak ya da banka sistemi tarafindan aranarak kayit ettirmis oldugu telefonu dogrulama amaciyla kullanmaktadir. Bu durum da kayitli telefonun güvenlik belirteci olarak kullanilmasini ve böylece islem güvenliginin gelistirilmesini saglamaktadir. Then, with any remote transaction, the user can use either the bank system. the phone that he has registered by calling or being called by the bank system. used for validation. In this case, the security of the registered phone token, thereby improving transaction security. it provides.

Bulusun Kisa Açiklamasi Bu bulusun amaci, özellikle finans kurumlarinin internet üzerinden müsterilerine sunduklari finansal uygulamalar basta olmak üzere tüm internet uygulamalari için uygulanabilen bir güvenli dogrulama sistemi gerçeklestirmektir. Brief Description of the Invention The aim of this invention is to provide financial institutions especially to their customers over the internet. for all internet applications, especially the financial applications they offer to implement a viable secure verification system.

Bu bulusun baska bir amaci internet uygulamalarinin kullanimi esnasinda kullanicilarin hesaplarina üçüncü kisilerce izinsiz girilmesinin önüne geçilmesini saglayan internet uygulamalari için bir güvenli dogrulama sistemi gerçeklestirmektir. Another object of this invention is to use internet applications while To prevent unauthorized access to users' accounts by third parties A secure authentication system for internet applications that provides is to perform.

Bu bulusun baska bir amaci internet uygulamalarinin kullanimi esnasinda sahteciligin ve dolandiriciligin önüne geçilmesini saglayan internet uygulamalari için bir güvenli dogrulama sistemi gerçeklestirmektir. Another object of this invention is to use internet applications while Internet applications that prevent fraud and fraud To implement a secure authentication system for

Bulusun Ayrintili Açiklamasi Bu bulusun amacina ulasmak için gerçeklestirilen “Intemet Uygulamalari Için Bir Güvenli Dogrulama Sistemi” ekli sekilde gösterilmis olup, bu sekil; Sekil-1; Bulus konusu sistemin sematik bir görünüsüdür. Detailed Description of the Invention In order to achieve the purpose of this invention, “A for Internet Applications “Secure Verification System” is shown as an appendix, and this figure is; Figure 1; The subject of the invention is a schematic view of the system.

Sekillerde yer alan parçalar tek tek numaralandirilmis olup, bu numaralarin karsiliklari asagida verilmistir. 1. Sistem Uygulama Elektronik cihaz Uygulaina suiiucusu Çagri kurma ve onay alma modülü Iletisim cihazi Bulus konusu sistem (1); internete baglanabilen ve üzerinde internet uygulamasi (2) çalistirabilen en az bir elektronik cihaz (3), elektronik cihaz (3) üzerinde çalisan uygulamanin (2) internet üzerinden uzaktan iletisim halinde oldugu ve kullanicinin uygulama (2) vasitasiyla talep ettigi islemlerin yerine getirilmesini saglayan en az bir uygulama sunucusu (4), uygulama sunucusu (4) ile iletisim halinde olan ve uygulama sunucusundan (4) islem yapan kullanicinin uygulama (2) vasitasiyla gerçeklestirmek istedigi islemlerin onayinin alinmasi amaciyla söz konusu kullaniciya çagri kurulmasi için kullaniciya iliskin çagri kurma iletisim bilgisi ve kullanicinin onaylamasi gereken islem bilgisini alan ve alinan çagri kurma iletisim bilgisini kullanarak kullaniciya çagri kurarak alinan islem bilgisi ile kullanicidan onay talep eden ve çagri yoluyla talep edilen onay dogrultusunda kullanicinin cevabini uygulama sunucusuna (4) geri dönen en az bir çagri kurma ve onay alma modülü (5) ve internet uygulamasi (2) vasitasiyla islem gerçeklestirmek isteyen kullanici tarafindan kullanilan ve en temel halinde çagri kurma ve onay alma modülü (5) tarafindan kurulan çagrinin alinmasini ve kullanici tarafindan çagri kurma ve onay alma modülüne (5) gerçeklestirilmck istenilen isleme iliskin onay verilmesini ya da isleme onay verilmemesini saglayan en az bir iletisim cihazi (6) içermektedir.The parts in the figures are numbered one by one. the responses are given below. 1. System Application electronic device application perpetrator Call setup and approval module communicator The system of the invention (1); at least one that can connect to the internet and run an internet application (2) on it. electronic device (3), the application (2) running on the electronic device (3) remotely over the internet. is in contact and the user requests via the application (2). At least one application server (4) that ensures the execution of transactions, in communication with the application server (4) and from the application server (4) What the operating user wants to do through the application (2) To make a call to the user in question in order to obtain the approval of the transactions. contact information about the user and what the user has to confirm Receiving the transaction information and using the received call setup contact information to the user Requesting confirmation from the user with the transaction information obtained by calling and calling In accordance with the requested approval, the user's response is sent to the application server (4). at least one returning call and acknowledgment module (5) and The user who wants to perform a transaction via the internet application (2) In its most basic form, calling and getting approval module used by (5) Receiving the call set up by the user and setting up and approval of the call by the user. to give approval to the receiving module (5) regarding the desired operation to be performed, or and at least one communication device (6) that ensures that the process is not approved.

Bulus konusu sistemde (1) yer alan elektronik cihaz (3) en temel halinde internete baglanabilen ve üzerinde en az bir internet uygulamasi (2) çalistirabilen bilgisayar, tablet bilgisayar, akilli telefon gibi bir elektronik cihazdir. Elektronik cihaz (3) üzerinde çalistirilan internet uygulamasi (2) bulusun tercih edilen uygulamasinda kullanicinin gerçeklestirmek istedigi islemlerin en yüksek güvenlikle gerçeklestirilmesini saglayan bankacilik uygulamasi gibi bir finansal uygulamadir. Bulusun tercih edilen uygulamasinda elektronik cihaz (3) üzerinde çalisan internet uygulamasi (2) uzak bir sunucudan elektronik cihaza (3) yüklenebilen bir uygulamadir. Bulusun alternatif bir uygulamasinda internet uygulamasi (2) uygulama sunucusu (4) ile etkilesimli olarak çalisan ve kullanicinin elektronik cihaz (3) üzerinden ulastigi bir uygulamadir. The electronic device (3) in the system (1), which is the subject of the invention, is connected to the Internet in its most basic form. can connect and run at least one internet application (2) on it. It is an electronic device such as a computer, tablet computer, smart phone. Electronic the internet application (2) running on the device (3) is the preferred choice of the invention. The highest number of transactions that the user wants to perform in the application a financial application, such as a banking application that ensures is the application. In the preferred embodiment of the invention, on the electronic device (3) running internet application (2) from a remote server to an electronic device (3) It is a downloadable application. Internet in an alternative embodiment of the invention application (2) interacting with the application server (4) and It is an application that the user accesses via the electronic device (3).

Bulus konusu sistemde (1) yer alan uygulama sunucusu (4), elektronik cihaz (3) üzerinde çalisan uygulama (2) ile internet üzerinden uzak iletisim halinde olup uygulamanin (2) uzaktan yapilandirilmasini saglamakta ve uygulamanin (2) çalismasini kontrol etmektedir. Uygulama sunucusu (4) tercihen internet üzerinden uygulamadan (2) kullanicinin gerçeklestirmek istedigi islem bilgisini ve kullanicinin onay için kullanmak istedigi iletisim cihazina (6) iliskin çagri kurma iletisim bilgisini almaktadir. Bulusun alternatif bir uygulamasinda kullanicinin onay için kullanmak istedigi iletisim cihazina (6) iliskin çagri kurma iletisim bilgisi uygulama sunucusunda (4) kayitli halde bulunmaktadir. Uygulama sunucusu (4) daha sonra uygulamadan (2) alinan kullanicinin gerçeklestirmek istedigi islem bilgisini ve kullanicinin onay için kullanmak istedigi iletisim cihazina (6) iliskin çagri kurma iletisim bilgisini kullaniciyla çagri kurulmasi ve islem iliskin onay talep edilmesi için çagri kurma ve onay alma modülüne (5) göndemiektedir. Uygulama sunucusu (4) çagri kurma ve onay alma modülünden (5) gelen cevap neticesinde kullanicinin isleme onay ve vermemesine bagli olarak kullanicinin gerçeklestirmek istedigi islemi gerçeklestirmekte ya da gerçeklestirmemektedir.Application server (4), electronic device (3) in the inventive system (1) It is in remote communication over the internet with the application (2) running on it. It provides remote configuration of the application (2) and the application (2) controls its operation. Application server (4) preferably internet from the application (2), the transaction information that the user wants to perform, and Making a call for the communication device (6) that the user wants to use for confirmation receives contact information. In an alternative embodiment of the invention, the user call setup communication regarding the communication device (6) that he/she wants to use for confirmation. information is stored in the application server (4). Application server (4) then perform user retrieved from application (2) the transaction information requested by the user and the communication that the user wants to use for approval. the call establishment contact information of the device (6) with the user, and To request approval for the transaction, call and get approval module (5) is sending. From the application server (4) call setup and approval module (5) depending on the user's approval or disapproval of the transaction as a result of the reply received. performs the action the user wants to perform, or does not perform.

Bulus konusu sistemde (1) yer alan çagri kurma ve onay alma modülü (5) uygulama sunucusu (4) ve iletisim cihazi (6) ile iletisim halindedir. Uygulama sunucusu (4) uygulama (2) üzerinden kendisine gelen kullanici islem talebine iliskin bilgiyi ve kullanicinin islem onayi için kullanmak istedigi iletisim cihazina (6) iliskin çagri kurma iletisim bilgisini çagri kurma ve onay modülüne (5) göndermektedir. Çagri kurma ve onay modülü (5) de uygulama sunucusundan (4) gelen bilgilerden çagri kurma iletisim bilgisini kullanarak kullanici iletisim cihazi (6) ile çagri kurmaktadir. Çagri kurma ve onay modülü (5) kullanici iletisim cihazi (6) ile çagri kurulduktan sonra uygulama sunucusundan (4) gelen kullanici islem talebine iliskin bilgiyi kullaniciya bildirmekte ve kullanicinin islemin gerçeklestirilmesi için onayini talep etmektedir. Bulusun tercih edilen uygulamasinda çagri kurma ve onay modülü (5) kullanicinin islemin gerçeklestirilmesi için onayini sesli olarak talep etmektedir. Bulusun tercih edilen uygulamasinda çagri kurma ve onay modülü (5) kullanicinin islemi onaylamasini sesli olarak gerçeklestirmesini istemektedir. Bulusun alternatif bir uygulamasinda çagri kurma ve onay modülü (5) kullanicinin islemi onaylamasini iletisim cihazinin (6) daha önceden belirlenen en az bir tusunu kullanarak gerçeklestirrnesini istemektedir. Kullanici iletisim cihazi (6) vasitasiyla isleme onay verirse çagri kurma ve onay modülü (5) çagriyi sonlandirarak kullanicinin islemin gerçeklestirilmesi için onay verdigi bilgisini uygulama sunucusuna (4) dönmektedir. Kullanici iletisim Cihazi (6) vasitasiyla isleme onay vermezse çagri kurma ve onay modülü (5) çagriyi sonlandirarak kullanicinin islemin gerçeklestirilmesi için onay vermedigi bilgisini uygulama sunucusuna (4) dönmektedir. Calling and getting approval module (5) in the system (1) which is the subject of the invention it is in communication with the application server (4) and the communication device (6). Application server (4) to the user process request coming to it via the application (2). information about the transaction and the communication device that the user wants to use for transaction confirmation. (6) to the call setup and confirmation module (5) is sending. The call setup and confirmation module (5) is also from the application server (4). user communicator using the calling contact from incoming information Makes a call with (6). Call setup and confirmation module (5) user communication The user coming from the application server (4) after the call is established with the device (6) It informs the user about the transaction request and informs the user of the transaction. requests your approval for its implementation. Invention preferred call setup and confirmation module (5) in the application of the user's requests its approval by voice for its implementation. Invention preferred The call setup and approval module (5) allows the user to approve the transaction. He wants it to be done aloud. In an alternative embodiment of the invention call setup and confirmation module (5) to communicate the user's confirmation of the transaction by using at least one predetermined key of the device (6). wants it to happen. Processing via user communicator (6) if the call setup and confirmation module (5) ends the call, the user's To the application server (4), the information that he has given his approval for the execution of the operation is returning. If the user does not approve the operation via the communicator (6), the call the setup and confirmation module (5) terminates the call, allowing the user to to the application server (4) that it has not given approval for its implementation. is returning.

Bulus konusu sistemde (1) yer alan iletisim cihazi (6), internet uygulamasi (2) vasitasiyla islem gerçeklestirmek isteyen kullanici tarafindan kullanilan ve en temel halinde çagri kurma ve onay alma modülü (5) tarafindan kurulan çagrinin alinmasini ve kullanici tarafindan çagri kurma ve onay alma modülüne (5) gerçeklestirilmek istenilen isleme iliskin onay verilmesini ya da isleme onay verilmemesini saglayan en az bir çagri kurma iletisim bilgisine sahip olan sabit hatli telefon, cep telefonu, akilli telefon gibi bir cihazidir. Bulusun tercih edilen uygulamasinda iletisim cihazina (6) ait çagri kurma iletisim bilgisi iletisim cihazinin iletisim hizmeti aldigi operatör tarafindan atanan telefon numarasidir.The communication device (6) in the inventive system (1), the internet application (2) used by the user who wants to perform a transaction through basically the call set up by the call setting and acknowledgment module (5) to be received by the user and to the module for calling and obtaining approval (5) Approval or approval of the transaction desired to be performed. fixed that has at least one paging contact that ensures that It is a device such as a line phone, mobile phone, smart phone. Invention preferred In the application, the call contact contact information of the communication device (6) It is the phone number assigned by the operator from which the device receives communication service.

Kullanici çagri kurma ve onay alma modülü (5) tarafindan kurulan çagriyi iletisim cihazi (6) vasitasiyla almakta ve uygulama (2) vasitasiyla talep ettigi islemin gerçeklestirilmesi için çagri kurma ve onay alma modülüne (5) onay vermekte ya da vermemektedir. Bulusun bir uygulamasinda kullanici iletisim cihazi (6) üzerinden talep ettigi islemin gerçeklestirilmesi için çagri kurma ve onay alma modülüne (5) sesli olarak onay vermekte ya da vermemektedir. Bulusun alternatif bir uygulamasinda kullanici iletisim cihazi (6) üzerinden talep ettigi islemin gerçeklestirilmesi için çagri kurma ve onay alma modülüne (5) iletisim cihazinda (6) yer alan ve daha önceden belirlenen en az bir tusu kullanarak onay vermekte ya da vermemektedir. Contacting the call set up by the user call setup and approval module (5) receives the device (6) through the application (2) and performs the requested transaction. gives approval to the calling and approval module (5) for the execution of nor does it. User communicator (6) in an embodiment of the invention Making a call and obtaining approval for the execution of the requested transaction module (5) audibly or not. find alternative In an application, the user requests the transaction via the communication device (6). in the communication device to the calling and receiving module (5) for the realization of (6) gives approval by using at least one previously determined key. or does not.

Bulus konusu sistemde (1); internete baglanabilme özelligine sahip olan bir elektronik cihaz (3) üzerinde çalisabilen bir uygulama (2) vasitasiyla islem yapmak isteyen kullanici gerçeklestirmek istedigi isleme iliskin talebi uygulamaya (2) girmektedir. Uygulama (2) kullanici tarafindan girilen islem talebini tercihen intemet üzerinden uygulama sunucusuna (4) göndermektedir. Uygulama sunucusu (4) kendisine gelen islem talebini gerçeklestirmeden önce güvenlik amaciyla kullanicinin söz konusu talebi onaylamasi için söz konusu islem talebine iliskin bilgileri ve kullanicinin onay için kullanmak istedigi iletisim cihazina (6) iliskin çagri kurma iletisim bilgisini çagri kurma ve onay alma modülüne (5) göndermektedir. Bulusun bir uygulamasinda kullanicinin onay için kullaninak istedigi iletisim cihazina (6) iliskin çagri kurma iletisim bilgisi uygulama sunucusu (4) içerisinde kayitli bulunmaktadir. Bulusun baska bir uygulamasinda kullanicinin onay için kullanmak istedigi iletisim cihazina (6) iliskin çagri kurma iletisim bilgisi uygulama sunucusunun (4) uygulamayi (2) tetik1einesi üzerine kullanicinin her yeni islem talebi için uygulama (2) tarafindan kullanicidan istenmekte ve uygulama (2) tarafindan uygulama sunucusuna (4) gönderilmektedir. Çagri kurma ve onay modülü (5) de uygulama sunucusundan (4) gelen bilgilerden çagri kurma iletisim bilgisini kullanarak kullanici iletisim cihazina (6) çagri kurmaktadir. Çagri kurma ve onay modülü (5) kullanici iletisim cihazi (6) ile çagri kurulduktan sonra uygulama sunucusundan (4) gelen kullanici islem talebine iliskin bilgiyi kullaniciya bildirmekte ve kullanicinin islemin gerçeklestirilmesi için onayini talep etmektedir. Bulusun tercih edilen uygulamasinda çagri kurma ve onay modülü (5) kullanicinin islemin gerçeklestirilmesi için onayini sesli olarak talep etmektedir. Bulusun tercih edilen uygulamasinda çagri kurma ve onay modülü (5) kullanicinin islemi onaylamasini sesli olarak gerçeklestirmesini istemektedir. Bulusun alternatif bir uygulamasinda çagri kurma ve onay modülü (5) kullanicinin islemi onaylamasini iletisim cihazinin (6) daha önceden belirlenen en az bir tusunu kullanarak gerçeklestirmesini istemektedir. Kullanici iletisim cihazi (6) vasitasiyla isleme onay verirse çagri kurma ve onay modülü (5) çagriyi sonlandirarak kullanicinin islemin gerçeklestirilmesi için onay verdigi bilgisini uygulama sunucusuna (4) dönmektedir. Kullanici iletisim cihazi (6) vasitasiyla isleme onay vermezse verirse çagri kurma ve onay modülü (5) çagriyi sonlandirarak kullanicinin islemin gerçeklestirilmesi için onay vermedigi bilgisini uygulama sunucusuna (4) dönmektedir. Uygulama sunucusu (4) çagri kurma ve onay modülünden (5) gelen bilgi dogrultusunda kullanici isleme onay vermisse islemi gerçeklestirmekte uygulama (2) üzerinden islemin gerçeklestirildigi konusunda kullanicinin bilgilendirilmesini saglamaktadir. Uygulama sunucusu (4) çagri kurma ve onay modülünden (5) gelen bilgi dogrultusunda kullanici isleme onay vermemisse islemi gerçeklestirmeyerek uygulama (2) üzerinden islemin gerçeklestirilmedigi konusunda kullanicinin bilgilendirilmesini saglamaktadir. In the inventive system (1); an internet-enabled process via an application (2) that can run on the electronic device (3) The user who wants to do it can apply the request for the operation he wants to perform. (2) is entered. The application (2) prefers the transaction request entered by the user. It sends it to the application server (4) over the internet. application server (4) for security purposes before executing the incoming transaction request. regarding the transaction request in order for the user to approve the request. information and the communication device (6) that the user wants to use for approval. the call setup contact information to the call setup and approval module (5) is sending. In an application of the invention, the user's use for consent apply call making contact information about the desired communication device (6) It is registered in the server (4). In another embodiment of the invention Making a call for the communication device (6) that the user wants to use for confirmation upon the contact application server (4) triggering the application (2) from the user by the application (2) for each new transaction request of the user. is requested and sent by the application (2) to the application server (4). is sent. The call setup and confirmation module (5) is also from the application server. (4) user communication using the call contact information from the incoming information makes a call to the device (6). Call setup and confirmation module (5) user communication The user coming from the application server (4) after the call is established with the device (6) It informs the user about the transaction request and informs the user of the transaction. requests your approval for its implementation. Invention preferred call setup and confirmation module (5) in the application of the user's requests its approval by voice for its implementation. Invention preferred The call setup and approval module (5) allows the user to approve the transaction. He wants it to be done aloud. In an alternative embodiment of the invention call setup and confirmation module (5) to communicate the user's confirmation of the transaction by using at least one predetermined key of the device (6). wants it to happen. Processing via user communicator (6) if the call setup and confirmation module (5) ends the call, the user's To the application server (4), the information that he has given his approval for the execution of the operation is returning. If the user does not approve the operation via the communicator (6) If the call setup and confirmation module (5) terminates the call, the user's transaction to the application server (4) that it has not given approval for its implementation. is returning. From the application server (4) call setup and confirmation module (5) If the user has given consent to the operation in line with the information, the operation is performed. informing the user that the transaction is carried out through the application (2). provides information. Application server (4) call setup and confirmation If the user does not approve the operation in accordance with the information received from the module (5) that the transaction is not carried out through the application (2) by not performing the transaction. It ensures that the user is informed about it.

Bulusun tercih edilen uygulamasinda bulus konusu sistem (1) internet uygulamalarinda (2) ikinci bir dogrulama için kullanilmaktadir. Böylece, kullanici tarafindan elektronik cihaz (3) vasitasiyla internet üzerinden gerçeklestirilen özellikle bankacilik islemleri gibi islemlerin kullanicinin gerçeklestirmek istedigi isleme sesli olarak onay vermesi sayesinde daha güvenilir bir sekilde gerçeklestirilmektedir.In the preferred embodiment of the invention, the subject of the invention is the system (1) internet. In applications (2) it is used for a second verification. Thus, the user carried out over the internet by means of an electronic device (3). In particular, transactions such as banking transactions that the user wants to perform more reliably, thanks to the voice confirmation of the operation. is carried out.

Bu temel kavramlar etrafinda, bulus konusu “Intemet Uygulamalari Için Bir Güvenli Dogrulama Sistemi (1)” ile ilgili çok çesitli uygulamalarin gelistirilmesi mümkün olup, bulus burada açiklanan örneklerle smirlandirilamaz, esas olarak istemlercle belirtildigi gibidir.Around these basic concepts, the subject of the invention is “A for Internet Applications Development of various applications related to “Secure Verification System (1)” possible and the invention cannot be limited to the examples described herein, mainly as indicated by the claims.

Claims

REQUESTS

Provides secure authentication for Internet applications; At least one electronic device (3) that can connect to the Internet and run an Internet application (2) on it, is the most efficient device (3), where the application (2) running on the electronic device (3) is in remote communication over the Internet and that enables the fulfillment of the transactions requested by the user through the application (2). Calling contact information for the user, which includes at least one application server (4) and is in communication with the application server (4) and is in contact with the application server (4), in order to obtain the approval of the operations that the user wants to perform through the application (2), in order to make a call to the user in question. and at least one call setting and approval module that receives the transaction information that the user has to approve and calls the user using the received call setup contact information and requests confirmation from the user with the received transaction information and returns the user's response to the application server (4) in line with the confirmation requested by the call (5) and internet application (2) va At least a minimum number that ensures that the call used by the user who wants to perform a transaction with the site and is established by the call setting and approval module (5) in its most basic form, is received and that the user's call and approval module (5) is approved or not approved for the operation desired to be performed. a system (1) characterized by a communication device (6).

A system (1) as in Claim 1, characterized by an electronic device (3), which in its most basic form is an electronic device such as a computer, tablet computer, smart phone, which can connect to the Internet and run at least one Internet application (2) on it.

. A system as in Claim 1 or 2 (1), characterized by an internet application (2), which is a financial application such as a banking application, which ensures that the transactions that the user wants to perform are carried out with the highest security.

. Any one of claims 1 to 3, characterized by an internet application (2), which is an application that can be downloaded from a remote server to an electronic device (3).

. A system (1) as in any one of Claims 1 to 3, which is characterized by an internet application (2), which is an application that the user accesses via the electronic device (3), which interacts with the application server (4).

. An application as in any one of the above claims, characterized by an application server (4) that is in remote communication with the application (2) running on the electronic device (3) over the internet, which enables the remote configuration of the application (2) and controls the operation of the application (2).

. An application as in any of the above claims, characterized by the application server (4) that receives the transaction information the user wants to perform from the application (2) over the Internet and the contact information of the communication device (6) that the user wants to use for approval.

. Any of the above claims, characterized by the application server (4), in which the call setup contact information regarding the communication device (6) that the user wants to use for approval is recorded.

Application server (4) which sends the transaction information the user wants to perform from the application (2) and the call setup contact information regarding the communication device (6) that the user wants to use for approval to the calling and obtaining module (5) for making a call with the user and requesting approval for the transaction. A system (1) as in any one of the above claims, characterized by ).

10. A system (1) as in any one of the above claims, characterized by the calling and receiving module (5) communicating with the application server (4) and the communication device (6).

A system (1) as in any one of the above claims, characterized by a call setting and approval module (5) that makes a call with the user communication device (6) by using the calling contact information from the information coming from the application server (4).

12. As in any of the above claims, characterized by the calling and receiving approval module (5), which notifies the user about the user process request coming from the application server (4) after the call is made with the user communication device (6) and requests the user's approval for the execution of the transaction. a system (1).

13. A system as in Claim 12 (1), characterized by a call setting and receiving approval module (5) that audibly requests the user's approval for the execution of the transaction.

14. A system as in Claim 13, characterized by a call setting and receiving module (5) that prompts the user to confirm the operation by voice (1).

15. A system (1) as in Claim 13, characterized by a call setting and receiving module (5) that asks the user to confirm the operation by using at least one predetermined key of the communication device (6).

16. If the user approves the operation via the communication device (6), a system as in any of the claims 12 to 15, characterized by the call setting and receiving module (5), which terminates the call and returns to the application server (4) the information that the user has given consent for the operation to be performed. (one).

17. A system as in Request 16 (1), characterized by an application server (4) that performs the operation and informs the user that the operation is performed through the application (2), if the user has given consent to the operation in accordance with the information received from the call setup and approval module (5).

18. If the user does not approve the operation via the communication device (6), a system as in any of the claims 12 to 15, characterized by the call setting and receiving module (5), which returns to the application server (4) the information that the user has not given consent for the operation to be executed by terminating the call. (one ).

19. A system (1) as in Claim 18, characterized by an application server (4), which does not perform the operation if the user does not give consent for the operation in accordance with the information received from the call setup and approval module (5), and informs the user that the operation has not been carried out via the application (2).

20. Receiving the call used by the user who wants to perform the transaction via the Internet application (2) and established by the call setting and approval module (5) in its most basic form, and giving approval for the desired operation to be performed by the user to the calling and obtaining module (5), or A system (1) as in any one of the above claims, characterized by a communication device (6), which is a device such as a landline phone, mobile phone, smart phone, which has at least one call setting contact information that ensures that the operation is not approved. A system (1) as in Claim 20, characterized by a communication device (6) whose caller contact information is the telephone number assigned by the operator from which the service is received. Any of the above requests used as a second verification tool in the transactions desired to be carried out over Internet applications (2).