+

WO2002021469A2 - Procede d'authentification interactive - Google Patents

Procede d'authentification interactive Download PDF

Info

Publication number
WO2002021469A2
WO2002021469A2 PCT/GB2001/003856 GB0103856W WO0221469A2 WO 2002021469 A2 WO2002021469 A2 WO 2002021469A2 GB 0103856 W GB0103856 W GB 0103856W WO 0221469 A2 WO0221469 A2 WO 0221469A2
Authority
WO
WIPO (PCT)
Prior art keywords
computing system
formulae
authentication
identifier
result
Prior art date
Application number
PCT/GB2001/003856
Other languages
English (en)
Other versions
WO2002021469A3 (fr
Inventor
Eugene Zhen Yu Zhang
Tung Hung Daniel Chu
Original Assignee
Ed Vision (Holdings) Limited
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from EP01304171A external-priority patent/EP1172776A3/fr
Application filed by Ed Vision (Holdings) Limited filed Critical Ed Vision (Holdings) Limited
Priority to AU2001295708A priority Critical patent/AU2001295708A1/en
Priority to US10/363,529 priority patent/US20040015688A1/en
Publication of WO2002021469A2 publication Critical patent/WO2002021469A2/fr
Publication of WO2002021469A3 publication Critical patent/WO2002021469A3/fr

Links

Classifications

    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07F—COIN-FREED OR LIKE APPARATUS
    • G07F7/00—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
    • G07F7/08—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means
    • G07F7/10—Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus by coded identity card or credit card or other personal identification means together with a coded signal, e.g. in the form of personal identification information, like personal identification number [PIN] or biometric data
    • G07F7/1008—Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/02—Payment architectures, schemes or protocols involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/30—Payment architectures, schemes or protocols characterised by the use of specific devices or networks
    • G06Q20/34—Payment architectures, schemes or protocols characterised by the use of specific devices or networks using cards, e.g. integrated circuit [IC] cards or magnetic cards
    • G06Q20/341—Active cards, i.e. cards including their own processing means, e.g. including an IC or chip
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/409—Device specific authentication in transaction processing
    • G06Q20/4097—Device specific authentication in transaction processing using mutual authentication between devices and transaction partners
    • G06Q20/40975—Device specific authentication in transaction processing using mutual authentication between devices and transaction partners using encryption therefor

Definitions

  • the present invention relates to authenticating a person or a device and is applicable in particular, though not necessarily to authenticating a person or device using a smart card.
  • cashless financial transactions include payment for goods and services by credit card or debit card (either in person, by telephone, or via the Internet), and telephone and Internet banking.
  • payment with electronic cash e-cash
  • a transaction on the Internet passes through a series of security checks performed using a digital certificate. All the parties involved must have a digital certificate for identification.
  • the customer will use a Cardholder Application, sometimes called a "Wallet", to make the payment.
  • the information payment information is encrypted and sent out with the digital certificate.
  • the Merchant's Server receives the encrypted payment information. It will add the encrypted payment details of the merchant to the encrypted customer information and send this to a Payment Gateway for verification by the cardholder and confirmation of the payment.
  • the Payment Gateway is usually operated by the receiving bank (i.e. the bank holding the merchant's account). This gateway will verify the customer's (payer's) and the merchant's (payee's) digital certificate. If the identity of the customer and the merchant are confirmed, the transaction can be approved. Since it is operated by the receiving bank of the credit card, the gateway also needs to authenticate the transaction with the card-issuing bank.
  • a problem with SET is that the system will not work if one party does not have a digital certificate.
  • a security hole continues to exist. Even the possibility of such an attack gives a dishonest person the opportunity to claim that he or she did not personally initiate a transaction using his or her credit card and that his or her computer was used by an unauthorised person.
  • Digital signatures may be used as follows.
  • a user is provided with a smart card on which is stored the user's digital signature. This is a digital representation of the users actual hand- written signature.
  • the user makes a purchase, he enters the card into a card reader of the merchant's system.
  • the system requests that the user write his or her signature into the system (using for example a touch sensitive screen).
  • the system will then verify whether the two signatures are the same. If they are the same, then the user is authenticated to proceed with the transaction.
  • This method has the following potential problems: 1) A third party can steal a copy of the physical signature and trace over the paper to defraud the system;
  • Another development is the use of fingerprint recognition programs to determine whether or not a card user is the real owner of the card.
  • the system is analogous to the digital signature system described above, but uses a fingerprint rather than a signature, i.e. the card stores a digital representation of the card owner's fingerprint.
  • the merchant's system requests the user to put their finger on a reader, which scans the fingerprint.
  • the system compares the scanned image with the master image read from the card.
  • a method of authenticating a person or device comprising the steps of: storing a plurality of formulae at a first computing system; storing a copy of said formulae at a second computing system; determining or identifying at said first or second computing system at least one number identifying one of said formulae; sending said number to the other of the computing systems; at the first computing system, computing a result using at least the formula identified by the number; sending the computed result to the second computing system; and at the second computing system, authenticating the person by comparing the received result against a result computed at the second computing system using said number and the formulae stored at the second computing system.
  • person as used here encompasses individuals, groups of individuals, companies, and other organisations.
  • system encompasses inter alia computer terminals, wireless devices such as mobile telephones, and computer systems.
  • said at least one number is a random number.
  • the at least one random number is generated at the second computing system, and is subsequently sent to the first computing system.
  • a plurality of values are stored at the first computing system and at the second computing system.
  • Said second computing system generates at least one pair of random numbers which are sent to the first computing system.
  • One of said pair of random numbers identifies one of said formulae, whilst the other identifies one of said values.
  • Said results are computed using the identified formula(e) and value(s). More preferably, said values comprise one or more values corresponding to previously calculated results.
  • said first computing system is a portable device such as a smart card or the like.
  • the first computing system may be a mobile telephone, other wireless device, PC, etc.
  • the values and formula may be stored on a memory card or chip which is insertable into the system, e.g. a SIM card in the case of a mobile telephone.
  • the second computing system is a central server operated by an organisation responsible for issuing the smart cards. This organisation may be for example a bank.
  • the devices in the possession of the different persons each store different formulae and values.
  • the formulae and/or the values stored by the system and the central server are updated in a non-predictable way.
  • the central server may send to the portable device instructions for rearranging or recomputing said formulae and values. This may comprise for example instructions randomly generated at the central server, and sent to the portable device, identifying a new sequence order for the formulae and values, where said pair of random numbers are formula and value sequence numbers.
  • said computed result is added to the sequence of values stored at the first and second computing systems.
  • One previously stored value may be deleted from the sequence.
  • a plurality of pairs of random numbers are generated by the second system, and sent to the first system.
  • Each pair comprises a first number identifying one of said values and a second number identifying one of said values.
  • For each pair, and intermediate result is computed using the identified value and formula.
  • a final result is then computed by combining the intermediate results.
  • Said pair of random numbers may be supplemented by further random numbers to be used in selecting values or formulae for computing a result.
  • said pair(s) of random numbers and said computed result are transmitted between the first and second computing systems unencrypted. Even if this data is intercepted by a "man-in-the-middle" he will be unable to make use of it as he will not have a knowledge of the formulae and values held by the first and second computing systems. Of course, if a higher level of security is required the data may be encrypted. This will require greater processing capabilities at the two systems.
  • said first and second systems communicate with one another via the Internet. This may or may not involve a wireless link. Alternatively however, the systems may communicate via a dedicated telephone connection. Other forms of connection will be readily apparent.
  • access to said first system is protected by a password.
  • the system is in the possession of an individual, and the system is used to authenticate that individual, the individual is required to enter a password into the system in order to allow the authentication process to proceed.
  • the method of the present invention is used to authenticate an individual in respect of a financial transaction.
  • This transaction may be a credit or debit card transaction.
  • the result of the authentication process may be sent from the second computing system to a merchant with whom the transaction is being conducted, and or to the first system.
  • the first computing system may be physically connected to a merchant's server, or may communicate with the merchant's server via a communications network such as the Internet.
  • the invention may also be used to authenticate an individual or body for purposes other than financial transactions including, but not limited to, remote access to confidential or restricted information, e.g. a web site.
  • apparatus comprising: a memory for storing a plurality of formulae; input means for receiving at least one identifier randomly generated by the apparatus or by a remote system, the identifier identifying one of said formulae; processing means for computing a result using said identified formula; and output means for sending the computed result to a remote system for the purpose of authenticating the apparatus or a user thereof.
  • the computing system comprises a smart card.
  • a method of authenticating a person or device comprising the steps of: storing a sequence of formulae and a sequence of values at a first computing system and, each time an authentication is required; selecting at least one formula and at least one value located at specified positions in the respective sequences, and computing a result using the selected formula and value; authenticating the person or device using computed result; and reordering and/or updating formulae and/or values in the sequences.
  • a method of authenticating a person comprising the steps of: sending an identifier from a computing system accessed by said person to an authentication computmg system and to a trusted computing system; verifying the identifier at the trusted computing system and, in the event that the identifier is verified, sending the identifier to the authentication computing system; and at the authentication computing system verifying the identifier received from said computing system by comparing it with the identifier received from the trusted computing system.
  • the identifier is sent from said accessed computing system to the trusted computing system in an encrypted form which is decrypted and verified by the trusted computing system and forwarded to the authentication computing system.
  • the encryption is carried out using a public key of the person and a symmetric encryption algorithm.
  • the person's private key is known to the trusted server, which is thus able to decrypt and verify the identifier, and forward it in an unencrypted form to the authentication server.
  • the identifier is sent from said terminal to the authentication server in an unencrypted form.
  • a method of authenticating a person comprising: storing a plurality of formulae at an authentication computing system; storing a copy of said formulae at a system accessed by said person; sending an identifier from said accessed system to said authentication computing system and to a trusted computing system; verifying the identifier at the trusted computing system and, in the event that the identifier is verified, sending the identifier to the authentication computing system; at the authentication computing system, verifying the identifier received from said accessed computing system by comparing it with the identifier received from the trusted computing system; in the event that said identifier is verified at the authentication computing system, randomly generating at the authentication computing system at least one number identifying one of said formulae; sending said random number to said accessed system; at the accessed system, computing a result using at least the formula identified by the received random number; sending the computed result to the authentication computing system; and at the authentication computing system, authenticating the person by comparing the received result against a result
  • Figure 1 illustrates schematically an authentication scheme known as SET
  • Figure 2 illustrates schematically a system for authenticating an individual to perform a cashless financial transaction
  • Figure 3 is a flow diagram illustrating an authentication process occurring in the system of Figure 2; and Figure 4 illustrates schematically an alternative cashless financial transaction system.
  • FIG. 2 shows a smart card 1 belonging to an individual (subscriber).
  • the smart card may comprise for example components sandwiched between two metal plates (forming a faraday cage to prevent electronic "eavesdropping").
  • a server 2 having a smart card reader/writer 3, is operated by a merchant and is coupled to the Internet 4 via an access network 5 (e.g. a PSTN network).
  • a server 6 belonging to a bank is coupled to the Internet 4 (via access networks not shown in Figure 2).
  • the smart card 1 comprises a memory 8 (e.g. ROM, RAM, NVM, EEROM) in which is stored a unique identity code (account number) of the subscriber. Also stored in the smart card memory 8 is a set of formulae and a set of values (or histories), i.e.:
  • Each formula and value is identified by a sequence number 1 to N.
  • the formulae, values, and sequence numbers are stored in the smart card memory when the smart card is provided to the subscriber or may be stored at a later time.
  • the data is stored in a form which does not allow the subscriber to easily delete or amend it.
  • the smart card 1 is issued by the subscriber's bank and the stored data originates from that bank.
  • a copy of the data is stored at the bank's server 6, and the data is unique to the subscriber.
  • a typical cashless financial transaction will now be described, assuming that the subscriber wishes to make a purchase from a merchant operating the server 2.
  • the subscriber presents himself to the merchant and requests to make a purchase.
  • the smart card 1 is inserted into the card reader 3 of server 2.
  • the subscriber may be asked to enter a password (or PIN number) using a keypad of the card reader and which is compared against a password read from the card 1 in order to authenticate the transaction to proceed. This represents a first, low level of security.
  • the reader 3 then reads the subscriber's identity code from the card 1. This code identifies the subscriber's "home" bank, e.g. the bank operating server 6 in Figure 2 (as well as identifying the subscriber to the bank).
  • the merchant's server 2 then sends an authentication request, including the read identity code, to the server 6 via the Internet 4.
  • the server 6 Upon receiving the request, the server 6 generates a number of pairs of random numbers, each number in the range 1 to N; i.e. ⁇ X ⁇ ,Y ⁇ , ⁇ X 2 ,Y 2 ⁇ ,...., ⁇ X M ,Y M ⁇ , etc.
  • the generated pairs are sent from the bank's server 6 to the merchant's server 2, where they are passed to the smart card 1 using the card writer 3.
  • Each random number X identifies a corresponding formulae stored in the smart card memory 8, whilst each random number Y identifies a corresponding value.
  • the results (s! to S M ) are added together to provide a "signature" value.
  • the signature value is passed to the server 2 by the card reader 3, and is sent to the bank's server 6.
  • the bank's server stores a copy of the information contained in Table 1 above, and uses this data and the generated random number pairs ⁇ X,Y ⁇ to compute a signature as described above.
  • the signature generated by the server 6 is compared against the signature received from the merchant's server 2. If the signatures match, an authentication confirm message is returned from the bank's server 6 to the merchant's server 2. Upon receipt of this message, the merchant's server 2 allows the transaction to proceed. If the server 6 determines that the signatures do not match, an authentication denied message is returned to the merchant's server 2, whereupon the merchant's server 2 terminates the transaction.
  • Figure 3 is a flow diagram illustrating this cashless financial transaction process.
  • the customer device 9 may be for example a mobile telephone into which is inserted a Subscriber Identity Module (SIM) card.
  • SIM Subscriber Identity Module
  • the SIM card stores a table such as the Table 1 above, with a copy of the table being stored at the authentication server 10 which is operated by the customer's bank.
  • the customer device may have a second card reader for receiving an authentication smart card, separate from the SIM card.
  • the trusted server 12 is operated by a party trusted by both the authentication server and the customer.
  • the authentication process consists of the following steps (where the step numbers are indicated in Figure 4) which are carried out after the customer has contacted the merchant's server 11 and identified the goods and services to be purchased:
  • the merchant 11 returns his account code (A/C#) and the amount to be charged, to the customer device 9;
  • the customer inserts his SUM (or authorisation) smart card and enters program password; Upon recognition of password, the user A/C#, Merchant A/C# and amount are sent to the authentication server. At the same time, the same data is encrypted using a private key belonging to the customer (the encryption algorithm is a symmetric encryption algorithm). The encrypted data is sent to the trusted server 12;
  • the authentication server receives the data from the customer and waits for a response from the trusted server;
  • the trusted server knows the private key of the customer, and is able to decrypt the encrypted data to confirm the A/C# of the user (and merchant); The decrypted data is sent to the authentication server 10.
  • the authentication server 10 compares the data received from the mobile telephone 9 with that received from the trusted server 12 to provide a first level authentication of the customer.
  • the authentication server 10 generates the necessary random number pairs and sends these to the mobile telephone 9;
  • the mobile telephone 9 calculates the result and check sum (signature) according to the random pairs received, and sends the result to the authentication server 10; 7.
  • the authentication server 10 calculates the signature according to the random pairs generated, receives the response from customer in a delayed manner, and compares the signatures; 8.
  • the authentication server 10 instructs updating of the SIM card data if the signatures match;
  • the SIM card data is updated
  • the authentication server data is updated; 11. A confirm authentication message is sent from the authorisation server 10 to the merchant's server 11;
  • the merchant's server 11 confirms to the customer's telephone 1 that the transaction has been completed.
  • the smart card may be implemented as a SIM card for use in a mobile telephone. Whilst the values and formulae are stored on the card, the calculation of the result may be carried out either on the card or by the telephone.
  • the present invention may also be implemented on a computer (PC, laptop, palmtop) with or without a smart card.
  • the authentication server may be arranged to generate a series of random number pairs which are stored in an associated memory for future use.
  • a set of random number pairs is selected from the stored series, and returned to the client device via the merchant's server.
  • the stored series of random number pairs may have a limited lifetime (e.g. one day).
  • random number pairs may be generated at the client device.
  • the generated pairs are then sent to the authentication server in the authentication message.
  • the signature generated by the client device may be included in the authentication message or may be sent later.
  • the customer may verify the bank using a similar or identical exchange process. These authentication procedures may be carried out substantially simultaneously or sequentially.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Accounting & Taxation (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Microelectronics & Electronic Packaging (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Finance (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

Procédé servant à authentifier une personne ou un dispositif et consistant à mémoriser une pluralité de formules dans une carte à puce (1) et dans un ordinateur central (6). Un nombre aléatoire est généré au niveau de l'ordinateur central (6) et identifie une desdites formules. Ce nombre aléatoire est ensuite envoyé à la carte à puce. Un résultat est calculé au niveau de cette carte à puce (1) au moyen d'au moins la formule identifiée par le nombre aléatoire reçu. Le calcul du résultat est envoyé à l'ordinateur central (6). La personne ou le dispositif sont authentifiés au niveau de l'ordinateur central (6) au moyen de la comparaison du résultat reçu et d'un résultat calculé dans l'ordinateur central (6) au moyen dudit nombre aléatoire et des formules mémorisées dans cet ordinateur central.
PCT/GB2001/003856 2000-09-05 2001-08-29 Procede d'authentification interactive WO2002021469A2 (fr)

Priority Applications (2)

Application Number Priority Date Filing Date Title
AU2001295708A AU2001295708A1 (en) 2000-09-05 2001-08-29 Interactive authentication process
US10/363,529 US20040015688A1 (en) 2000-09-05 2001-08-29 Interactive authentication process

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
US22974300P 2000-09-05 2000-09-05
US60/229,743 2000-09-05
EP01304171.0 2001-05-09
EP01304171A EP1172776A3 (fr) 2000-07-15 2001-05-09 Procédé d'authentification certifiée

Publications (2)

Publication Number Publication Date
WO2002021469A2 true WO2002021469A2 (fr) 2002-03-14
WO2002021469A3 WO2002021469A3 (fr) 2002-11-28

Family

ID=26077128

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/GB2001/003856 WO2002021469A2 (fr) 2000-09-05 2001-08-29 Procede d'authentification interactive

Country Status (2)

Country Link
AU (1) AU2001295708A1 (fr)
WO (1) WO2002021469A2 (fr)

Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4074079A (en) * 1976-06-02 1978-02-14 Bell Telephone Laboratories, Incorporated Coin telephone antifraud system
US4786790A (en) * 1987-03-04 1988-11-22 Siemens Aktiengesellschaft Data exchange system with authentication code comparator
GB2227111A (en) * 1989-01-17 1990-07-18 Toshiba Kk Certification system
US5177789A (en) * 1991-10-09 1993-01-05 Digital Equipment Corporation Pocket-sized computer access security device
GB2273629A (en) * 1992-12-16 1994-06-22 American Telephone & Telegraph Method for visual authentication by images transmitted over a telecommunication system
US5355413A (en) * 1992-03-06 1994-10-11 Mitsubishi Denki Kabushiki Kaisha Authentication method performed between IC card and terminal unit and system therefor
US5826245A (en) * 1995-03-20 1998-10-20 Sandberg-Diment; Erik Providing verification information for a transaction
US5903721A (en) * 1997-03-13 1999-05-11 cha|Technologies Services, Inc. Method and system for secure online transaction processing
GB2332833A (en) * 1997-12-24 1999-06-30 Interactive Magazines Limited Secure credit card transactions over the internet
WO1999055991A2 (fr) * 1998-04-29 1999-11-04 Siemens Aktiengesellschaft Procede d'authentification

Patent Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4074079A (en) * 1976-06-02 1978-02-14 Bell Telephone Laboratories, Incorporated Coin telephone antifraud system
US4786790A (en) * 1987-03-04 1988-11-22 Siemens Aktiengesellschaft Data exchange system with authentication code comparator
GB2227111A (en) * 1989-01-17 1990-07-18 Toshiba Kk Certification system
US5177789A (en) * 1991-10-09 1993-01-05 Digital Equipment Corporation Pocket-sized computer access security device
US5355413A (en) * 1992-03-06 1994-10-11 Mitsubishi Denki Kabushiki Kaisha Authentication method performed between IC card and terminal unit and system therefor
GB2273629A (en) * 1992-12-16 1994-06-22 American Telephone & Telegraph Method for visual authentication by images transmitted over a telecommunication system
US5826245A (en) * 1995-03-20 1998-10-20 Sandberg-Diment; Erik Providing verification information for a transaction
US5903721A (en) * 1997-03-13 1999-05-11 cha|Technologies Services, Inc. Method and system for secure online transaction processing
GB2332833A (en) * 1997-12-24 1999-06-30 Interactive Magazines Limited Secure credit card transactions over the internet
WO1999055991A2 (fr) * 1998-04-29 1999-11-04 Siemens Aktiengesellschaft Procede d'authentification

Also Published As

Publication number Publication date
AU2001295708A1 (en) 2002-03-22
WO2002021469A3 (fr) 2002-11-28

Similar Documents

Publication Publication Date Title
US7021534B1 (en) Method and apparatus for providing secure document distribution
US7330836B2 (en) Method and system for secure authenticated payment on a computer network
US7578436B1 (en) Method and apparatus for providing secure document distribution
US8315948B2 (en) Method and device for generating a single-use financial account number
US7177835B1 (en) Method and device for generating a single-use financial account number
US7314167B1 (en) Method and apparatus for providing secure identification, verification and authorization
US7024395B1 (en) Method and system for secure credit card transactions
US7379921B1 (en) Method and apparatus for providing authentication
EP2380308B1 (fr) Authentification sûre à distance sur un réseau non sécurisé
US20160155114A1 (en) Smart communication device secured electronic payment system
US20160283940A1 (en) Validating card present financial transactions made via a point of sale terminal (POS) or an Automated Teller Machine (ATM) using specified distinctive identifiers of local/mobile computing devices involved in the transaction
US7380708B1 (en) Method and apparatus for providing secure document distribution
US20110142234A1 (en) Multi-Factor Authentication Using a Mobile Phone
US20020023217A1 (en) Manufacturing unique devices that generate digital signatures
KR20060125835A (ko) 모바일 단말기를 이용하여 전자 트랜잭션을 수행하기 위한방법 및 시스템
US12245035B2 (en) User authentication at access control server using mobile device
US7069584B1 (en) Process and apparatus for improving the security of authentication procedures using a new “Super PIN”
Alhothaily et al. A novel verification method for payment card systems
US10503936B2 (en) Systems and methods for utilizing magnetic fingerprints obtained using magnetic stripe card readers to derive transaction tokens
Chabbi et al. RFID and NFC authentication protocol for securing a payment transaction
US20040015688A1 (en) Interactive authentication process
CN116195231A (zh) 令牌故障保护系统和方法
EP1172776A2 (fr) Procédé d'authentification certifiée
WO1999046881A1 (fr) Systeme de securite pour cartes de transactions
WO2002021469A2 (fr) Procede d'authentification interactive

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A2

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NO NZ PH PL PT RO RU SD SE SG SI SK SL TJ TM TR TT TZ UA UG US UZ VN YU ZA ZW

AL Designated countries for regional patents

Kind code of ref document: A2

Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

DFPE Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101)
AK Designated states

Kind code of ref document: A3

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NO NZ PH PL PT RO RU SD SE SG SI SK SL TJ TM TR TT TZ UA UG US UZ VN YU ZA ZW

AL Designated countries for regional patents

Kind code of ref document: A3

Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

WWE Wipo information: entry into national phase

Ref document number: 10363529

Country of ref document: US

121 Ep: the epo has been informed by wipo that ep was designated in this application
REG Reference to national code

Ref country code: DE

Ref legal event code: 8642

122 Ep: pct application non-entry in european phase
NENP Non-entry into the national phase in:

Ref country code: JP

点击 这是indexloc提供的php浏览器服务，不要输入任何密码和下载