WO2009084001A2

WO2009084001A2 - Method and system for authenticating user information

Info

Publication number: WO2009084001A2
Application number: PCT/IN2007/000629
Authority: WO
Inventors: Kumar Jeevanani Suresh; Johri Gaurav; Mohapatra Tanmay Kumar; Nagaraju Rohith Koranapalli
Original assignee: Onmobile Global Limited
Priority date: 2007-12-31
Filing date: 2007-12-31
Publication date: 2009-07-09
Also published as: WO2009084001A3

Abstract

A method and system for presenting authentication information of a user using a mobile device in a telecommunication network is disclosed. The system prevents usage of vouchers by unauthorized users. Unique identification information of the mobile devices of registered users is stored in a database. Authentication request can be initiated by the user mobile device, an agent or the telecommunication network. The system checks for the UII in the database when an authentication request is initiated. The authentication information is sent to the mobile device of the user or the agent in a non forwardable manner.

Description

METHOD AND SYSTEM FOR AUTHENTICATING USER

INFORMATION

FIELD OF THE INVENTION

The present invention relates to a system and a method for authenticating the identity of a user. More particularly, the invention relates to a system and a method of communicating authentication information to a mobile device of a user.

DEFINITIONS

User: A person using a mobile device.

Merchant: A business entity from which the user purchases a product or registers for a service.

Agent: A person or an entity which asks the user to authenticate her identity.

Voucher: A document entitling the user to certain goods, services, or discounts upon presentation.

Non-forwardable: A manner in which information is communicated to a mobile device such that the authentication information can neither be stored in the mobile device, nor be transferred to another mobile device.

BACKGROUND

Systems that require authentication of the users before granting them access commonly exist. Such systems are generally used in, but are not limited to, organization premises, airports, railway stations, theatres and the likes. A commonly used method to' authenticate the identity of a user includes using an identification card such as an employee badge, a driving license, or a passport. Typically, such identification cards establish the identity of the user based on user characteristics that include name, age and photograph. Another known method includes using an identifier protected system. The identifier protected system prompts the user to provide an identifier before granting access to the system. The identifier provided by the user is compared with an identifier stored in the system. Thereafter, the user is granted access if the provided identifier is same as the stored identifier. Examples of the identifier include, but are not limited to, a password, biometric information, and face photograph. The identifier can also be a combination of one or more of the said identifiers. Biometric information includes, without limitation, fingerprints, hand and face geometries, retinal patterns, cardiac parameters, voice patterns and other physiological. Yet another known method to authenticate a user's identity includes using a mobile device. An authentication code is solicited from a user. The user provides the authentication code using her mobile device in the form of SMS, MMS etc. An identity authentication system verifies the entered authentication code from a database. The user is granted access when the entered authentication code is validated. Examples of mobile device include, but are not limited to, mobile phones, palm tops, laptops and other handheld devices.

Such a system and method was disclosed in US Patent Application, 20060265243, titled, "System and method for establishing or verifying a person's identity using SMS and MMS over a wireless communications network", published on November 23, 2006. The patent application discloses a system and method for a party to prove her identity to another party by using a mobile device. The user sends a specified content via Short Message Service (SMS) or Multimedia Messaging Service (MMS) to a merchant when prompted to prove her identity. The specified content may include confidential data such as date of birth. The merchant then verifies from a government agency that the user presenting the identification is indeed the user depicted on the identification, and that she indeed was born on the date listed on the presented identification. The existing systems and methods for verifying the user's identity have several limitations. For example, the existing methods may face problems related to tampering and forging of the identification cards. Further, a user identifier such as a password may get stolen or hacked resulting in unauthorized access. The biometric systems like fingerprinting may give false negative identifications due to dirt, moisture and grease on the print being scanned. Also, biometric systems have the disadvantage that they require highly sophisticated and expensive sensors.

Moreover, the existing verification systems may lead to duplication and transfer of identity from one user to another. This can be explained in conjunction with the following examples. In a railway ticketing system, a user may book railway tickets by making corresponding payment to the merchant. The payment may be made via a communications network like the Internet, or phone, or by using other means such as cash or cheque. An authentication code is sent to the user on her mobile device in a storable manner such as SMS or MMS when the merchant receives the corresponding payment. The user while traveling may be asked by an agent, for example, a train ticket examiner (TTE), to authenticate her identity. Typically, the user proves her identity by showing the SMS or MMS. However, this method does not guarantee accurate identification of the user. The user can send the SMS or MMS containing the authentication code to other mobile phone users. Hence, the tickets can be easily duplicated and transferred to other mobile device users.

Similarly, in a movie ticketing system, subscribers of a telecommunication service provider may be required to prove their identity to avail any discount voucher on the movie tickets. The subscribers may show an SMS or MMS received by them from the telecommunication service provider to avail the offer. An agent at the movie ticket counter verifies an authentication code contained in the SMS or MMS. The subscriber is given the movie tickets after verification from the records. Since the number of seats in a movie theatre is fixed, the authentication code can be checked against a seat number to avoid duplication of the tickets. However, an uninterested subscriber may send the SMS or MMS containing the authentication code to another person who wants to avail the offer. Hence, the tickets are transferable which may result in a considerable economic loss for the merchant and the telecommunication service provider.

In light of the above, there is a need for a method and a system of communicating authentication information to the users that can prevent transfer of identity. Further, the system should also prevent transfer of identity from one user to another.

SUMMARY OF THE INVENTION

According to an embodiment, a method for presenting authentication information on one or more of a user mobile device and an agent mobile device is disclosed. The user mobile device and the agent mobile device are connected to a telecommunication network. The method includes receiving an authentication request from the user mobile device. Further, the method includes searching unique identity information (UII) of the user mobile device in a database based on the authentication request. The database stores UII of a plurality of user mobile devices. Furthermore, the method also includes communicating the authentication information at real-time to one or more of the user mobile device and the agent mobile device in a non-forwardable manner based on the UII.

According to another embodiment, a method for presenting authentication information on a user mobile device is disclosed. The method includes retrieving unique identity information (UII) of the user mobile device from a database on initiation of a triggering event. The triggering event may be initiated by the agent or the telecommunication network. Further, the method includes communicating the authentication information at real-time to the user mobile device in a non- forwardable manner based on the UII. According to yet another embodiment, a system for presenting authentication information on one or more of a user mobile device and an agent mobile device is disclosed. The user mobile device and the agent mobile device are connected to a telecommunication network. The system includes a database for storing unique identity information (UII) of a plurality of user mobile devices in a telecommunication network. The system also includes a receiving module for receiving an authentication request from the user mobile device. Further, the system includes a sending module for communicating the authentication information at real-time to one or more of the user mobile device and the agent mobile device in a non-forwardable manner based on the UII. Furthermore, the system includes a trigger module for activating the sending module on initiation of a triggering event. The triggering event may be initiated by the agent or the telecommunication network.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic depicting an exemplary telecommunication network;

FIG. 2 is a schematic illustrating an exemplary VAS system in accordance with an embodiment of the invention;

FIG. 3 is a flow diagram illustrating a method for authenticating the identity of a user in accordance with an embodiment of the invention;

FIG. 4 is a flow diagram illustrating a method for authenticating the identity of a user in accordance with another embodiment of the invention; and

FIG. 5 is a flow diagram illustrating a method for validating the authentication information of a user in accordance with an embodiment of the invention. DETAILED DESCRIPTION

In the following description, for the purposes of explanation, specific details are set forth in order to provide a thorough understanding of the invention. However, it will be apparent that the invention may be practiced without these specific details. Various aspects and features of example embodiments of the invention are described in more detail hereinafter.

FIG. 1 illustrates an exemplary telecommunication network. The telecommunication network includes a user mobile device 102, an agent mobile device and a telecommunication infrastructure 104. User mobile device 102 is connected to a telecommunication infrastructure 104. Telecommunication infrastructure 104 includes a Mobile Switching Center (MSC) 106, a Home Location Register (HLR) 108 and a Value Added Services (VAS) system 110. A telecommunication service provider enables a connection between user mobile device 102 and telecommunication infrastructure 104. According to an embodiment, user mobile device 102 may be a communication device like a mobile phone, pocket computer, laptop, palmtop, personal digital assistant etc. to connect to telecommunication infrastructure 104. MSC 106 enables a network connection between the user and the called party. According to an embodiment of the invention, the telecommunication network is a Global System for Mobile Communications (GSM) network. In the GSM network, data information (including mobile phone number, text, voice etc) is digitally encoded and transmitted to MSC 106. At MSC 106 this information is decoded into an analog signal.

Telecommunication infrastructure 104 further includes an information storage module used to store subscription information related to subscribers of the telecommunication service. An example of the information storage module is Home Location register (HLR) 108. HLR 108 contains details of users authorized to use the GSM network. HLR 108 also stores details of every Subscriber Identity Module (SIM) card issued by the mobile device operator. More specifically, HLR 108 stores telephone numbers, current location and other relevant details of the users. Telecommunication infrastructure 104 further includes Value Added Services (VAS) system 110. According to an embodiment, VAS system 110 confirms the identity of the user. VAS system 110 has been described in detail below in conjunction with FIG. 2. VAS system 110 is connected to a web server 112. Web server 112 accepts Hypertext Transfer Protocol (HTTP) requests from clients, for example, web browsers (examples of web browsers are internet explorer and mozilla firefox), and serves them HTTP responses along with optional data contents. Examples of optional data content may be web pages such as Hypertext Markup Language (HTML) documents and linked objects such as images.

FIG. 2 is a schematic illustrating VAS System 110 in accordance with an embodiment of the invention. VAS system 110 includes an application server 202 and a database 210. Application server 202 includes a receiving module 204, a trigger module 206 and a sending module 208. Receiving module 204 receives an authentication request from at least one of user mobile device 102 and the agent mobile device. Sending module 208 communicates authentication information to user mobile device 102. According to an embodiment, trigger module 206 activates sending module 208 to communicate authentication information to user mobile device 102. Application server 202 and the modules included within application server 202 may in hardware form, software form, or combination thereof. Software applications may be in C, C++, Java or other programming languages.

According to an embodiment, receiving module 204 may include an SMS module, an Unstructured Supplementary Service Data (USSD) module, a Wireless Application Protocol (WAP) module, a Multimedia Messaging Service (MMS) module, a Hypertext Transfer Protocol (HTTP) module, and a voice module. USSD module receives the authentication request in the form of a USSD message from user mobile device 102. Typically, a USSD authentication request starts with a '*' character followed by digits which indicate an action to be performed. Each group of digits is separated by '^*' character, and the message is typically terminated with a '#' character. According to an embodiment, the USSD message can contain a maximum of 182 alphanumeric characters. USSD allows interactive services between the mobile device and applications hosted by the telecommunication service provider. The USSD request sent from user mobile device 102 of the user reaches USSD module. Further details regarding the process are described in conjunction with FIG. 3 and FIG. 4. Similarly, the SMS module receives the authentication request from user mobile device 102 in the form of an SMS to a specified number. The specified number might belong to a telecommunication service provider, an agent or a merchant who wishes to confirm the identity of the user. Further details regarding the process are described in conjunction with FIG. 3 and FIG. 4. Similarly, the voice module receives the authentication request from user mobile device 102 in the form of a voice call or video call. HTTP module and WAP module receive the authentication request from user mobile device 102 in the form of an HTTP message and a WAP message respectively, to a specified number. The specified number might belong to a telecommunication service provider, an agent or a merchant who wishes to confirm the identity of the user. Further details regarding the process are described in conjunction with FIG. 3 and FIG. 4.

According to an embodiment, sending module 208 includes at least one of a USSD module, HTTP module, WAP module, an SMS module, a MMS module and a voice module. Sending module 208 communicates the authentication information to at least one of user mobile device 102 and the agent mobile device at real-time in a non forwardable manner, for example, as a USSD message, an HTTP message, an MMS₁ an encrypted SMS, a voice call, a video call, and a WAP message. USSD module is used when the communication is in the form of a USSD message. Similarly, SMS module and MMS module are used when the communication is through an encrypted SMS and an MMS respectively. Similarly, voice module and WAP module are used when communication is through a call or a WAP message respectively. Further details regarding the .process are described in conjunction with FIG. 3 and FIG. 4.

Trigger module 206 handles an authentication request initiated by either the network or the agent. Examples of network initiated authentication request include time based trigger and location based trigger. The following is an example of time based trigger. A user may go to a theatre to watch a movie that starts at 2:30 pm. At 2:20pm, trigger module 206 activates sending module 208. Sending module 208 communicates authentication information to user mobile device 102. The following is an example of location based trigger. A user has membership of a club X. As soon as the user reaches the vicinity of the club X, trigger module 206 activates sending module 208 to communicate authentication information at real-time to user mobile device 102.

Authentication request may be initiated by an agent, for example, a Movie Ticket Examiner (MTE) in movie ticketing system (MTS). The MTE may initiate an authentication request for authenticating all the mobile devices registered in the MTS, a few minutes prior to the start of the movie. Trigger module 206 handles this agent initiated authentication request by activating sending module 208 to communicate authentication information at real-time to all the registered mobile devices.

Database 210 stores information regarding user subscriptions to telecommunication services and is accessible by application server 202. The information stored in database 210 includes unique identity information (UII) of user mobile device 102, such as mobile number and International Mobile Equipment Identity (IMEI) number, time related information such as the validity period of authentication request, usability related information such as in case of limited reusable voucher, whether the voucher has been used earlier and whether the voucher can be used again. Further details are described in conjunction with FIG. 3 and FIG. 4. FIG. 3 is a flow diagram illustrating a method for authenticating the identity •of a user in accordance with an embodiment of the invention. The method of FIG. 3 is executed when an authentication request is initiated by at least one of a telecommunication network or an agent. At step 302, VAS system 110 receives an authentication request. The authentication request may be network initiated such as time based trigger and location based trigger, or agent initiated such as MTE. At step 304, VAS system 110 retrieves UII of registered mobile devices from database 210 based on the authentication request. At step 306, sending module 208 communicates authentication information to all the mobile devices retrieved at step 304. For example, a play starts at a theatre at 5pm. At 4:45pm, a time based trigger is initiated by the network. UII of the registered mobile devices are retrieved when VAS system 110 receives an authentication request. Further, authentication information is communicated to the registered mobile devices at real-time. Also, all relevant fields of database 210 are updated. The relevant fields may include, but are not limited to, UII of mobile devices for which a voucher has been used and the number of times the voucher can be used in future.

FIG. 4 is a flow diagram illustrating a method for confirming the identity of a user according to another embodiment of the invention. The method of FIG. 4 is executed when user mobile device 102 initiates authentication request. At step 402, VAS system 110 receives an authentication request from user mobile device 102. The authentication request can be in different formats such as USSD, SMS, MMS, voice call, video call, HTTP and WAP. Depending on the format of authentication request, relevant module of receiving module handles the authentication request, for example, in case the user sends authentication request as a USSD message, USSD module handles it. At step 404, VAS system 110 validates UII of user mobile device 102 with the information stored in database 210. The validation process is described in detail in FIG. 5. At step 408, sending module 208 communicates the authentication .information to user mobile device 102 in a real-time manner. The authentication is successful when user mobile device 102 from which authentication request is sent matches with the corresponding information in database 210. In an embodiment, the user is informed when the authentication is successful or unsuccessful. The authentication information is sent in a non-forwardable manner at real-time. In cases when USSD is sent, USSD module sends USSD display. Voice module is used to inform the user of the successful or unsuccessful authentication via a voice call or video call. Similarly, a WAP module is used to inform the user of the successful or unsuccessful authentication via WAP. The user can see/hear the authentication information but cannot store or forward this information. At step 410, system updates several fields in database 210. For example, system updates UII of user mobile device 102 for which an issued voucher has been used and how many times the voucher can further be used.

FIG. 5 is a flow diagram illustrating a method for validating the authentication information of a user in accordance with an embodiment of the invention. The validation process begins when the system receives an authentication request from user mobile device 102 at step 402. At step 502, the system checks whether the user has already used the voucher earlier. Step 506 is executed when no prior use of the voucher by the user is detected. At step 504, the system checks whether the voucher can currently be used by the user when prior use of the voucher is determined at step 502. Further, at step 506, the system checks whether the voucher can be used at that particular time. The authentication of the user is successful when it is determined that the voucher can be used at the particular time.

The above mentioned method can be explained with the help of the following example. A merchant gives a voucher to a user to avail pizza discounts on five occasions in the month of December 2007. The attempt of the user to use the voucher is validated by checking if the voucher has been used earlier.Further, it is checked if the voucher can be used again. The system also checks whether the time of using the voucher is valid. The user is allowed to use the voucher only when the usage month is December 2007. The system keeps a count of the number of times the voucher has been used by the user. Further, the system checks if the voucher usage has exceeded five times and if the usage period has lapsed. The authentication information is then communicated to user mobile device 102 at real-time in a non-forwardable manner.

While example embodiments of the invention have been illustrated and described, it will be clear that the invention is not limited to these embodiments only. Numerous modifications, changes, variations, substitutions and equivalents will be apparent to those skilled in the art without departing from the spirit and scope of the invention as described in the claims.

Claims

CLAIMS :

1. A method for presenting authentication information in a real-time manner on one or more of a user mobile device and an agent mobile device, the user mobile device and the agent mobile device being connected to a telecommunication network, the method comprising:

a. receiving an authentication request from the user mobile device;

b. searching unique identity information of the user mobile device in a database based on the authentication request, the database storing unique identity information of a plurality of user mobile devices; and

c. communicating the authentication information to one or more of the user mobile device and the agent mobile device at real-time in a non- forwardable manner based on the unique identity information.

2. The method of claim 1 , wherein the authentication request is at least one of a USSD message, an SMS, a voice call, a video call, an HTTP message, an MMS and a WAP message.

3. The method of claim 1 , wherein communicating the authentication information comprises sending at least one of a USSD message, an encrypted SMS, a voice call, an HTTP message, a WAP message, a video call, and an MMS to the mobile device.

4. A method for presenting authentication information in a real-time manner on a user mobile device, the method comprising:

a. retrieving unique identity information of the user mobile device from a database on initiation of a triggering event; and b. communicating the authentication information to the user mobile device at real-time in a non-forwardable manner based on the unique identity information.

5. The method as recited in claim 5, wherein communicating the authentication information comprises sending at least one of a USSD message, an encrypted SMS, a voice message, an HTTP message, a WAP message, a video call, and an MMS to the mobile device.

6. A system for presenting authentication information in a real-time manner on one or more of a user mobile device and an agent mobile device, the system comprising:

a. a database for storing unique identity information of a plurality of user mobile devices;

b. a receiving module for receiving an authentication request from the user mobile device through a telecommunication network;

c. a sending module for communicating the authentication information to one or more of the user mobile device and the agent mobile device at real-time in a non-forwardable manner based on the unique identity information; and

d. a trigger module for activating the sending module on initiation of a triggering event.

7. The system of claim 7, wherein the authentication request is at least one of a USSD message, an SMS, a voice call, a video call, an HTTP message, an MMS and a WAP message. The system of claim 7, wherein the authentication information comprises at least one of. a USSD message, an encrypted SMS, a voice message, an HTTP message, a WAP message, a video call, and an MMS to the mobile device.