WO2005043435A1

WO2005043435A1 - A method for purchasing of one or more offered items and/or services on an e-commerce site

Info

Publication number: WO2005043435A1
Application number: PCT/NO2003/000370
Authority: WO
Inventors: Juan Carlos Lopez Calvet
Original assignee: Telenor Asa
Priority date: 2003-11-04
Filing date: 2003-11-04
Publication date: 2005-05-12
Also published as: AU2003278621A1

Abstract

A method providing secure transactions in connection with e-commerce is disclosed. The method is based on the one click ordering of items and services, which is common on many e-commerce sites. Different from conventional one click ordering, the browser terminal, normally a PC, fetches the telephone number of the user by establishing a communication link to the user's cellular phone when the ordering button/link is pressed on the e-commerce site. The telephone number is then transmitted as the only identification of the user that is being transmitted across the Internet in connection with the purchase together with other ordering information to a transaction server executing the purchase. Preferably, the purchase is thereafter confirmed in that the user signs for the purchase by a PKI signing. The transaction server provides necessary information, e.g. for billing the user from a subscriber database. Consequently, the method takes advantage of the fact that any personal information regarding the user is already stored as subscription data at the user's mobile telephone operator.

Description

A METHOD FOR PURCHASING OF ONE OR MORE OFFERED ITEMS AND/OR SERVICES ON AN E-COMMERCE SITE

Field of the invention

The present invention is related to e-commerce, in particu- lar to a method providing secure transactions in connection with e-commerce.

Background of the invention

According to a report by Gartner, Inc's GartnerG2, approximately 60 percent of the Internet users say security and privacy concerns stop them from doing business on the Web. In addition, more than 50 percent of those who buy on the Web say they'll enter the required personal information, but admit they are not comfortable about it.

Each time a user wishes to buy a service or product on the web, personal information (credit card number, address, telephone, name, etc.) is normally required. Giving such kind of information must be repeated for every new visited web site that offers online sale, e.g. in connection with registration. Once this information is provided, a user name and/or a password is normally assigned to the user, said user name and/or password being unique for each web site.

In order to avoid the problem of giving personal information each time a purchase is made, the companies often store the customer's information and the user has to use a login and a password to be authenticated the next time the site is visited.

The company Amazon has implemented a solution called "One Click" . Once the costumer has placed his first order at Amazon.com, his personal information is stored at Amazon's server and "One Click" is turned on provided that the order was paid with a credit card. After the first order is accomplished, the user can place an order at that web site at any time only by clicking one button, and the system will automatically refer the costumer' s account for billing and shipping information.

The problem with the user name and password solutions is that the costumers have to enter their personal information at least once via Internet, which makes the majority of the customers uncomfortable because of security and privacy concerns. The user must also remember a login and a password for each web site he uses for purchasing purposes.

This is also a problem with Amazon's solution as it depends on the Internet for gathering costumer information, and a user name and password are also required.

Further, there are PKI infrastructures like Telenor Mobil's "Mobilhandel" , which enables the user to purchase products or services by use of a mobile phone containing a SIM card, using networks like GSM and the WAP protocol.

The problem with solutions like "Mobilhandel" is that the user has to browse with a telephone; the screen is normally very small and it takes too many clicks to get to the desired product. Because the mobile phones use WAP, the variety of products that can be viewed by the customer is limited compared to using a standard Web browser. Further, WAP compares to Internet concerning security risks.

An E-commerce solution is marketed on the Internet site www.paybox.co.uk. This solution describes purchasing of goods from an Internet terminal. The customer has to type in his mobile phone number manually together with his/hers order. To verify the payment, Paybox will call the customer at the point of purchase. The solution is laborious in that the customer has to type in his/hers phone number, further it is desirable not to have to call the customer. A solution for E-commerce is given in US patent 6,175,922 to Wang. The solution describes a transaction between a web shop and a customer communicated over the Internet. For signing of a transaction the user has to use a unique ID. This ID is not personal, and hence in the wrong hands anybody can approve a transaction by entering the unique ID.

Summary of the invention

It is an object of the present invention to provide a method for e-commerce that eliminates the drawbacks de- scribed above. The scope of the invention is as described in the appended patent claims.

In particular, the present invention provides a method for purchasing of one or more offered items and/or services on an e-commerce site whereby clicking on a certain but- ton/link causes a browser terminal, from which an order of the purchase is initiated and communicated over a first communication link, to transfer the order to a transaction server executing the purchase, the transaction server returning a signing/confirmation challenge to the browser terminal or a cellular phone of the user originating the purchase, the method further comprising: creating a second communication link between the browser terminal and the cellular phone at the time of clicking, fetching the telephone number or another identification of the cellular telephone or an associated subscription through the second communication link, attaching the telephone number or the other identification of the cellular telephone or the associated subscription with the order to be transferred as the only identification of the user, and in the transaction server, using the telephone number or the other identification of the cellular telephone or the associated subscription for providing necessary personal information about the user to execute the purchase after receiving a correct response communicated over a third communication link to the signing/confirmation challenge.

Brief description of the drawings

The invention will now be described in detail in reference to the appended drawings, in which:

Fig. 1 is an image of a web page at an e-commerce site,

Fig. 2 is an overview of the components involved in one embodiment of the present invention,

Fig. 3 is a close view at the communication between a cel- lular phone and a web browser terminal according to one embodiment of the present invention.

Description of preferred embodiments

The present invention takes advantage of the fact that personal information already is stored for most of the poten- tial customers of an e-commerce web site in mobile telephone subscriptions, making it redundant to send any personal information via Internet regardless of which web site being accessed.

In the following, a user scenario will be described for the purpose of explaining the invention.

A costumer enters an e-commerce web site with his PC for the first time. The items offered are displayed, e.g. like in figure 1. After choosing the desired items, the purchase is initiated by clicking a certain purchase button, in fig. 1 labelled by "One Click Buy" . The "One Click Buy" button is actually a small program residing in the computer. This program or component is downloaded automatically the first time the user accesses this page. To this point, the purchasing process follows the process in the "One click" solution described above.

Now, when the button is pressed, the program automatically initiates communication with the customer' s cellular phone by means of a local communication component residing in the PC using, e.g. the Bluetooth^® technology, in order to obtain the telephone number of the owner of the phone.

Once the component has fetched the phone number of the costumer, it is forwarded together with purchase information from the PC to a transaction server through the Internet.

The transaction server receives this information, confirms that the information received is valid, and sends a challenge for the costumer to sign the transaction either via a mobile communication network or the Internet. The transac- tion server is given access to all necessary information about the client through the subscriber information stored by the mobile communication operator at which the customer is subscribed. The personal information about the user can be provided by a lookup in the mobile network operator' s subscription database.

The costumer receives the challenge, which holds information about the desired purchase, and in case of approval, he signs the challenge with his PIN number and returns it to the transaction server. The approval is preferably sup- ported by PKI for achieving a higher level of security in the transaction.

When the signed challenge is received, the transaction server checks if everything is correct (e.g. identification and authentication by means of the PKI) , and sends the shipping information and a confirmation of the purchase to the company offering the product or service on the web site accessed by the customer. The mobile communication operator charges the user for the amount of the purchase or (depending on policy) uses the customer's credit card to pay the transaction.

The key feature of the present invention is the process of fetching the telephone number from the user's mobile phone and transferring it to the transaction server for retrieving the information needed for billing the user for a purchase. Thus, this process will be described in detail in the following.

As illustrated in figure 3, to retrieve the phone number of the client, i.e. the cellular phone, the program accesses the phone via Bluetooth, preferably by using AT commands. The AT Command set is a series of machine instructions used to activate features on an intelligent modem (or in this case a phone) . The AT (ATtention) Command Set is developed by Hayes Microcomputer Products and officially known as the Hayes Standard AT Command Set. It is used entirely or partially by most of the modem manufacturers. The AT Commands Set is a set of commands comprising all commandos for acti- vating all available modem functions. For example, at call set up from a computer, it is necessary for either the software or the user to issue an ATDT or ATDP command from the AT command set followed by the dialled number. The AT part of the command tells the modem that it is about to re- ceive a command. DT tells it to dial by tone, while DP tells it to pulse dial. Finally, the modem dials the number given to it after the command. Different modems do have slightly different command sets, but generally, most modems follow the standard set by Hayes.

In the case of the present invention, some of the AT commands supported by, e.g. the Sony-Ericsson T68 cellular phone can be used to:

• Connect the browser terminal to the phone via infrared port, Bluetooth^® or the system bus. • Request information about the current configuration or operational status of the phone.

• Test availability in the phone and, when applicable, request the range of valid parameters for an AT com- mand.

Since the AT commands are almost entirely supported by most manufacturers, it provides the best way to access information from the phone, but in order to use this set of commands, a link must be established between the two devices willing to communicate.

This means that the commands are totally independent from the technology used to establish the link between the two devices .

In the case of the Bluetooth^® technology, a profile named "Serial Port Profile" , specified in http://www.bluetooth.org/docs/Bluetooth_Vll_Profiles_22Feb0 l.pdf, is used to create such a link where the scenario covered by this profile is the following:

• Setting up virtual serial ports (or equivalent) on two devices (e.g. PCs) and connect these with Bluetooth, to emulate a serial cable between the two devices. Any legacy application may be run on either device, using the virtual serial port as if there were a real serial cable connecting the two devices (with RS232 control signalling) .

The bottom line is that as long as the AT Commands Set is used to retrieve information from the phone, the technology used to create the link between the two devices doesn't have an important role, because infrared, Bluetooth^® or even a serial cable will behave exactly in the same way. In the case of Bluetooth^®, when the browser terminal tries to send an AT command to a specified port, Bluetooth^® automatically creates a link, and when the other end receives the command, it answers to the same port where the link was created.

In this case, the command used to retrieve the phone number stored on the SIM card is:

"AT + CNUM" and when the phone receives this command it answers with "+CNUM: 'Mobile', *+47 123456768'"

As already mentioned, when the browser terminal, e.g. a PC, receives this number, it is forwarded together with purchase information to a transaction server through the internet. An e-commerce transaction may then be executed without transferring personal information like credit card number, home address, e-mail address, personal identification node, etc. over the Internet, being exposed for capturing and abuse.

As an alternative to the AT commands described above, Bluetooth^® specifies some messages for communicating with SIM cards. These messages could advantageously be used in the present invention for fetching the telephone number from a cellular phone. Details concerning these messages are described in http://www.bluetooth.org/docs/SIM_Access_0_95c.pdf

Any telephone operator using the GSM network and supporting a PKI infrastructure can use the present invention. The operators can create a network of trust and extend the accessibility of the concept, which will enable users to purchase goods outside their home country.

The present invention is not limited to using Bluetooth^® in the communication between the browser terminal and the eel- lular phone, but also other technologies like infrared or serial port communication may be utilized.

A new range of devices that combine mobile phone, PDA and PC characteristics, will make it easier to access the SIM card information without the need of establishing a communication link and the use of two different devices like a PC and a phone.

The main advantage of the present invention is that the user doesn't send any personal information through the net- work because the mobile operator has already stored said information in a subscriber database, and thereby reduces security risks .

The present invention allows signing of purchases with a PIN number by use of PKI on the customer's cellular phone, which improves the authentication process and gives the user a feeling of security.

The same process applies to any web site that supports the "One Click Buy" , which means that the user can visit any of the supporting web sites without having to give his per- sonal information.

The user doesn't have to remember any user name or password, because all the processes of purchase are made automatically by the click of a button.

Instead of using a small screen on a cellular phone, the user can use his personal computer that is better adapted for this purpose. Abbreviations

GSM Global System for Mobile Communications

PIN Personal Identification Number

PKI Public Key Infrastructure

SIM Subscriber Identity Module

WAP Wireless Application Protocol

Claims

P a t e n t c l a i m s

1. A method for purchasing of one or more offered items and/or services on an e-commerce site whereby clicking on a certain button/link causes a browser terminal, from which

5 an order of the purchase is initiated and communicated over a first communication link, to transfer the order to a transaction server executing the purchase, the transaction server returning a signing/confirmation challenge to the browser terminal or a cellular phone of the user originat-o ing the purchase, c ha r a c t e r i z e d i n creating a second communication link between the browser terminal and the cellular phone at the time of clicking, s fetching the telephone number or another identification of the cellular telephone or an associated subscription through the second communication link, attaching the telephone number or the other identification of the cellular telephone or the associated0 subscription with the order to be transferred as the only identification of the user, in the transaction server, using the telephone number or the other identification of the cellular telephone or the associated subscription for providing necessary5 personal information about the user to execute the purchase after receiving a correct response communicated over a third communication link to the signing/confirmation challenge.

2. A method as claimed in claim 1,o c ha ra c t e r i z e d i n that said first communication link is on the Internet and said third communication link is on a GSM network.

3. A method as claimed in claim 1 or 2, c h a r a c t e r i z e d i n that said second communication link is a communication link for short distance wireless connections.

5 4. A method as claimed in claim 3, c h a ra c t e r i z e d i n that the second communication link is a Bluetooth^®, Infra Red or serial cable link.

5. A method as claimed in claim 3 or ,o c h a ra c t e r i z e d i n that the fetching of the telephone number or the other identification of the cellular telephone or the associated subscription is implemented by the use of AT commands .

6. A method as claimed in claim 1,s c h a r a c t e r i z e d i n that the browser terminal and the cellular phone are integrated in one unit, and said second communication link is an internal communication link.

7. A method as claimed in claim 6,o c h a ra c t e r i z e d i n that the integrated unit is a Personal Digital Assistant.

8. A method as claimed in claim 1, 3 , 4, 5 or 6, c h a r a c t e r i z e d i n that the browser terminal is a Personal Computer connected to the Internet. 5

9. A method as claimed in claim 1, c h a r a c t e r i z e d i n that executing the purchase includes billing the user and providing the ordered one or more items and/or services to the user.

10. A method as claimed in claim 1,0 c ha ra c t e r i z e d i n that the necessary personal information about the user is provided by a lookup in a subscription database associated with a mobile network operator to which the user is subscribed.

11. A method as claimed in claim 1, c h a r a c t e r i z e d i n that the user responds correctly to the signing/confirmation challenge by executing a Public Key infrastructure signing.