`(12) Patent Application Publication (10) Pub. No.: US 2002/0032874 A1
`Hagen
`(43) Pub. Date:
`Mar. 14, 2002
`
`US 20020032874A1
`
`(54)
`
`(76)
`
`SYSTEM AND METHOD FOR IDENTITY
`VERIFICATION
`
`(52) Us. 01. .......................................... .. 713/202; 713/183
`
`Inventor:
`
`Atle Hagen, Skien (NO)
`
`(57)
`
`ABSTRACT
`
`Correspondence Address:
`YOUNG & THOMPSON
`745 SOUTH 23RD STREET 2ND FLOOR
`ARLINGTON, VA 22202
`
`(21)
`(22)
`
`Appl. No.:
`
`09/949,887
`
`Filed:
`
`Sep. 12, 2001
`
`Related US. Application Data
`
`(63)
`
`Non-provisional of provisional application No.
`60/231,879, ?led on Sep. 12, 2000.
`
`Publication Classi?cation
`
`(51)
`
`Int. Cl.7 ..................................................... .. H04L 9/32
`
`A ?rst party can verify his identity with a second party by
`using a computer via an electronic connection to register
`with the second party, and the second party registers the ?rst
`party’s telephone number in his database. When the ?rst
`party later logs on to the second party’s website, the ?rst
`party identi?es himself by giving his telephone number via
`the electronic connection. The processor veri?es that the
`telephone number given matches the telephone number
`registered in the database, whereupon the processor sends a
`computer-generated, unique password to the ?rst party’s
`telephone. The ?rst party enters the password on his com
`puter, whereupon it is sent to the second party’s processor
`where the password is veri?ed against the message recently
`sent over the telecommunication network. If the ?rst party’s
`identity is thus veri?ed, the parties establish contact for an
`exchange of information over the electronic connection.
`
`User ID
`known ?
`
`NO
`
`User ID
`Command‘
`i
`
`Message
`from
`System A
`
`1
`
`‘
`
`Log off
`
`Check command
`Against prede?ned
`Parameters
`
`__________-_'—-—
`
`Yes
`
`Generate password
`set transaction ID
`and set duration
`
`NO
`
`System B is a system
`Connected to a known
`ID/person/system
`
`‘
`
`Send ?rm/50rd
`0n 5Y8
`
`No 1‘.
`
`0
`Yes
`
`Duration over ?
`
`Reicept
`_
`received?
`
`‘
`
`I
`
`Execute
`transaction
`
`TWILIO, INC. EX. 1016
`Page 1
`
`
`
`Patent Application Publication
`
`mM
`
`US 2002/0032874 A1
`
`mco_w_m.>m:or_n_m_950>4:_mwmq_ogEmEw_._......1_.n.__
`
`
`
`
`
`
`
`8.:2:0com3
`
`.:a5:3mac:
`
`_m.m>mm9520
`
` como.mama..m._n_
`
`:mmm_Eo>>m.mma.
`
`
`
`xx_oz._9.c_mo._
`
`SNww
`
`SN
`
`
`
`9>_m«m_Um.EE_
`
`
`
`2WW.2...n._o>>_
`
`M..ma.oomXOZhoE:E_xmEm0ucmcozommcfitma
`
`oo—v_OZ.6ME_.:.C_xmEm5.3EEmoncmo%b_v__m>bcmE_..oE<
`
`
`.._E:ooom.._%..w:_m.mmum.mn__m>5253:553/7/r
`
`
`
`
`
`cmmammmvmmfico
`9&3mEmEoo
`
`
`
`Em:mr:Eumémmnmm£coE
`
`
`mmu6>c_ucmcos.a_._omn:mm.co_(E
`-299:2_892o2=59:
`
`
`
`m:o;n_m_mH&mE9.m>m._mEsoco_E:om.a_:mEmrimq
`
`
`
`
`
`
`
`nm;w__nEwm>umm:m..a:9£
`
`2:
`
`inlllv
`
`TWILIO, INC. EX. 1016
`Page 2
`
`TWILIO, INC. EX. 1016
`Page 2
`
`
`
`
`
`
`
`
`
`Patent Application Publication Mar. 14, 2002 Sheet 2 of 2
`
`US 2002/0032874 A1
`
`
`
`
`
`Eozammamzfiocmwwo>
`
`D_cozommcmbEm
`
`
`
`ucmEEooxomco
`
`
`
`
`
`cosmicEmucmvmccmuma§__mm<...wm>
`
`.m_m..mEm_mn_
`
`
`
`OZ,.02D.._®wD
`
`%m>_mo9AEm.o_mm
`
`cozomwcmh
`
`Bzomxm
`
`VEmzwxmm2mEmhmxm.
`
`>Emkmxmxcomqm
`
`SQ
`
`mEsocx
`
`.95m:
`
`_ccmEEoo
`
`mmmmwm_>_
`
`E0:
`
`<EQ.w>w
`
`Wm:
`
`TWILIO, INC. EX. 1016
`Page 3
`
`TWILIO, INC. EX. 1016
`Page 3
`
`
`
`
`
`US 2002/0032874 A1
`
`Mar. 14, 2002
`
`SYSTEM AND METHOD FOR IDENTITY
`VERIFICATION
`
`[0001] The present invention relates to the exchange of
`information via networks, more speci?cally a system and a
`method for the exchange of information via netWorks in
`order to verify the identity of a user.
`
`[0002] There are knoWn systems and methods for trans
`actions by means of electronic media, Where the transactions
`require that the identity of one party (e.g., a customer)
`should be veri?ed by means of a passWord or PIN code. It
`is also increasingly common to exchange information and
`sell products and services via the Internet. The Websites of
`neWspapers, the “netbanks” of ?nancial institutions, and the
`sale of, e.g., books, electronic equipment etc. are just a feW
`examples. Increasingly con?dential information is transmit
`ted over the Internet or other netWorks, such as messages to
`and from, e.g., the health and social Welfare services and
`pharmacies, laW of?ces and clients etc. To enable such
`transactions to be carried out in a secure manner, dedicated
`passWords or PIN codes are often used. Today’s systems for
`user recognition are highly complex in order to obtain
`adequate security for transactions over, e.g., the Internet.
`They are also dif?cult and complicated to handle. The costs
`of transactions thus become so high that, e.g., it is not
`pro?table When small sums are involved in the trading. The
`complexity of today’s systems in particular has made it
`impossible to agree on a standard, Which in turn has limited
`the spread of e-business. A number of these systems are
`based on special software (E-cash, CyberCash, Wallet and
`the like) installed in the client-machines and contribute to
`the unreliability and problems related to machine malfunc
`tion and program faults in other softWare installed in the
`client-machine. There is also a great potential for the loss of
`“money” in the event of a crash, caused by either softWare
`or hardWare. When using “traditional means”, as for
`instance credit cards, there is a high risk of fraud and this has
`resulted in a strong fear of using such cards over the Internet.
`The disadvantage of existing passWord systems is, in other
`Words, that they are very complicated to handle or they can
`easily go Wrong and are open to abuse. For example, the
`payment systems that are available on the Internet today
`have a very high threshold for the user because of the
`insecurity associated With credit card fraud, hacking etc. It
`can therefore be dif?cult to take payment for services on the
`Internet, especially for services that are relatively inexpen
`sive, as for instance neWs. Furthermore, the systems of
`existing Internet suppliers often have the disadvantage that
`the customer’s passWord is stored in the supplier’s database,
`Which is exposed to break-in. Other suppliers of Internet
`services use a system Where the customer is sent a number
`of passWords on, e.g., a plastic card that the customer then
`keeps, With the accompanying danger of abuse and theft.
`There is therefore a great need for a system and a method
`that permit secure communication via different electronic
`connections or netWorks (including the Internet), Where the
`user’s identity is veri?ed conclusively by the generation and
`transmission of a passWord that is not easy to steal or abuse.
`
`[0003] Thus, according to the invention, there is provided
`a system and a method that are characterised by the char
`acteristic features recited in independent claims 1 and 15.
`Preferred features of the invention are set forth in accom
`panying claims 2-14 and 16-28.
`
`[0004] The advanced encryption needed by the knoWn
`systems that involve the use of credit cards, “Wallet” and
`other forms of encrypted payment is not required by the
`system and the method according to the invention, as the
`con?rmation passWord is not sent via the Internet, but via the
`telecommunication netWork to a speci?ed telephone number
`and only to the person Who has the associated telephone in
`his possession. As a neW passWord is also generated for each
`transaction and this is only valid in a given period of time,
`the system Will be both very dif?cult and—not least—of
`little temptation to defraud. The system and the method
`according to the invention are thus highly suitable for all
`types of identity veri?cation.
`
`[0005] The system and the method according to the inven
`tion are, inter alia, suitable for all forms of payment and
`Would be pro?table for Internet suppliers of very inexpen
`sive services. The inventive system and the method can also
`advantageously be used for identity veri?cation in connec
`tion With many different transactions via any netWork.
`
`[0006] FIG. 1 is a schematic illustration of an embodi
`ment of the system and method according to the invention.
`The ?gure shoWs a computer 100 that via an electronic
`connection is connected to a second party 200. The second
`party has a processor 201, a database 202 and a service 300,
`and also communicates by telephones 101, 102 Which must
`belong to the ?rst party.
`
`[0007] FIG. 2 is a How chart Where “System A” is
`preferably the electronic connection; “User ID” is the iden
`tity sign of the ?rst party, Where “prede?ned parameters”
`may include, e.g., limitations as regards price, relevant time
`period or geographical areas; and “System B” is a system
`that is connected to a knoWn ID/person/system, for instance,
`a telecommunication netWork.
`
`[0008] FIG. 1 shoWs a ?rst party (e. g., a customer) Who by
`using the computer 100 via the electronic connection reg
`isters With a second party 200 (e.g., a supplier). The second
`party registers the ?rst party’s telephone number in his
`database 202, and later the ?rst party logs on to the second
`party’s Website in a knoWn Way. The ?rst party identi?es
`himself by giving his telephone number by entering the
`number on his computer 100. The telephone number is
`transmitted to the second party 200 via the electronic
`connection (e. g., the Internet), and the processor 201 veri?es
`that the telephone number given matches the telephone
`number registered in the second party’s database 202.
`
`[0009] The second party’s processor 201 then sends a
`computer-generated, unique passWord to the ?rst party’s
`telephone 101, 102. If the telephone number is a mobile
`telephone number, the passWord can be sent as a GMS text
`message, but the passWord can be sent to any telephone as
`a voice message or text message if the telephone has the
`facility to accept messages of this type.
`
`[0010] The ?rst party keys the passWord received into his
`computer 100, Whereupon it is transmitted via the electronic
`connection (System A, e.g., the Internet) to the second
`party’s processor 201 Where the passWord is veri?ed against
`the message recently sent over the telecommunication net
`Work. If the identity of the ?rst party is thus veri?ed, the
`parties establish contact for an exchange of information over
`the electronic connection. The process is also illustrated in
`FIG. 2.
`
`TWILIO, INC. EX. 1016
`Page 4
`
`
`
`US 2002/0032874 A1
`
`Mar. 14, 2002
`
`[0011] The example in FIG. 1 shows the ?rst party as a
`customer Who, e.g., Wishes to make use of the services of a
`supplier of services and products on the Internet (as the
`second party). The customer, Who Wants to purchase a
`product or service offered by the supplier, has established
`contact With the supplier and has veri?ed his identity as
`described above. The supplier’s processor 201 then veri?es
`that the price for the product and/or service ordered is Within
`a pre-agreed limit, and executes the transaction by giving the
`customer access to the service ordered or by ensuring that
`the product ordered is delivered.
`
`[0012] The passWord authorises the customer to make use
`of the supplier’s services for an amount Within a pre-agreed
`sum per transaction and/or Within a predetermined period of
`time. The agreed sum is charged to the customer’s telephone
`subscription and is invoiced on the telephone bill or another
`agreed account belonging to the ?rst party. The passWord is
`valid only for a speci?c transaction.
`[0013] Although in the foregoing description reference is
`made to examples of transactions betWeen tWo parties Where
`the electronic connection is the Internet, the system and the
`method according to the invention should not be limited to
`identity veri?cation in connection With transactions via the
`Internet. The system and the method according to the
`invention comprise identity veri?cation in connection With
`transactions via an electronic connection in general, as is
`re?ected in the attached patent claims.
`
`1. A system for identity veri?cation, Wherein a ?rst party
`(100) Wishes to execute a transaction With a second party
`(200), and Wherein the ?rst party by using a computer (100)
`via an electronic connection, or in another knoWn Way,
`registers With the second party’s computer, and Wherein the
`second party registers the ?rst party’s telephone number in
`his database (202), and Wherein the ?rst party at a later time
`in a knoWn Way per se logs on to the second party via the
`electronic connection, characterised in that:
`i) the ?rst party gives his telephone number by entering it
`on his computer (100) Which transmits the telephone
`number to the second party (200) via the electronic
`connection;
`ii) the second party’s processor (201) veri?es that the
`telephone number given matches the telephone number
`registered in the second party’s database (202);
`
`iii) the second party’s processor (201) sends a computer
`generated, unique passWord to the ?rst party’s tele
`phone (101, 102) via a telecommunication netWork;
`iv) the ?rst party enters the passWord in his computer
`(100), Whereupon it is sent via the electronic connec
`tion to the second party’s processor (201) Where the
`passWord is veri?ed against the message recently sent
`via the telecommunication netWork;
`v) if the ?rst party’s identity is thus veri?ed, the parties
`establish contact via the electronic connection for an
`exchange of information.
`2. A system for identity veri?cation according to claim 1,
`characterised in that the transaction comprises an exchange
`of information betWeen the parties.
`3. A system for identity veri?cation according to claim 1,
`characterised in that the transaction comprises the ?rst
`party’s purchase of goods or services from the second party.
`
`4. A system for identity veri?cation according to claim 1,
`characterised in that the electronic connection is the Internet.
`5. A system according to any one of claims 1 to 4,
`characterised in that the ?rst party is a customer and the
`second party is a supplier of services and products, and
`Where:
`
`i) the customer Wishes to purchase a product or service
`(300) offered by the supplier;
`ii) the supplier’s processor (201) veri?es that the price for
`the product and/or service ordered is Within a pre
`agreed limit;
`iii) if the customer’s identity is veri?ed, the transaction is
`executed by the supplier giving the customer access to
`the Internet service (300) ordered or ensuring delivery
`of the product ordered; and
`
`iv) the agreed sum is charged to the customer’s telephone
`subscription and invoiced on his telephone bill.
`6. A system according to any one of claims 1 to 4,
`characterised in that the telephone number is a mobile
`telephone number and that the passWord is sent to the
`telephone (101) as a GMS text message.
`7. A system according to any one of claims 1 to 4,
`characterised in that the passWord is sent to the telephone
`(101, 102) as a voice message.
`8. A system according to any one of claims 1 to 4,
`characterised in that the passWord is sent to the telephone
`(101, 102) as a text message.
`9. A system according to any one of claims 1 to 4,
`characterised in that the passWord authorises the ?rst party
`to make use of the second party’s services for a maximum
`of a predetermined amount per transaction.
`10. A system according to any one of claims 1 to 4,
`characterised in that the passWord authorises the ?rst party
`to make use of the second party’s services in one or more
`predetermined periods of time.
`11. A system according to any one of claims 1 to 4,
`characterised in that the price for the service or the product
`is charged to an account belonging to the ?rst party.
`12. A system according to any one of claim 1 to 4,
`characterised in that the passWord is only valid for a par
`ticular transaction.
`13. A system according to any one of claims 1 to 4,
`characterised in that the passWord is only valid Within a
`geographical area.
`14. A system according to any one of claims 1 to 4,
`characterised in that When the passWord is generated a timer
`starts that determines the duration of the passWord, and
`Where this is made visible to the ?rst party in the form of a
`countdoWn on the screen, and Where the transaction is
`rendered invalid and a neW passWord must be requested if
`the passWord has not been used before the timer has run out.
`15. Amethod for identity veri?cation, Wherein a ?rst party
`(100) Wishes to execute a transaction With a second party
`(200), and Wherein the ?rst party by using a computer (100)
`via an electronic connection, or in another knoWn Way,
`registers With the second party’s computer, and Wherein the
`second party registers the ?rst party’s telephone number in
`his database (202), and Wherein the ?rst party at a later time
`in a knoWn Way per se logs on to the second party via the
`electronic connection, characterised in that:
`
`TWILIO, INC. EX. 1016
`Page 5
`
`
`
`US 2002/0032874 A1
`
`Mar. 14, 2002
`
`i) the ?rst party gives his telephone number by entering it
`on his computer (100) Which transmits the telephone
`number to the second party (200) via the electronic
`connection;
`ii) the second party’s processor (201) veri?es that the
`telephone number given matches the telephone number
`registered in the second party’s database (202);
`iii) the second party’s processor (201) sends a computer
`generated, unique passWord to the ?rst party’s tele
`phone (101, 102) via a telecommunication netWork;
`iv) the ?rst party enters the passWord in his computer
`(100), Whereupon it is sent via the electronic connec
`tion to the second party’s processor (201) Where the
`passWord is veri?ed against the message recently sent via
`the telecommunication netWork;
`v) if the ?rst party’s identity is thus veri?ed, the parties
`establish contact via the electronic connection for an
`eXchange of information.
`16. A method for identity veri?cation according to claim
`15, characterised in that the transaction comprises an
`eXchange of information betWeen the parties.
`17. A method for identity veri?cation according to claim
`15, characterised in that the transaction comprises the ?rst
`party’s purchase of goods or services from the second party.
`18. A method for identity veri?cation according to claim
`15, characterised in that the electronic connection is the
`Internet.
`19. A method according to any one of claims 15 to 18,
`characterised in that the ?rst party is a customer and the
`second party is a supplier of services and products, and
`Where:
`
`i) the customer Wishes to purchase a product or service
`(300) offered by the supplier;
`ii) the supplier’s processor (201) veri?es that the price for
`the product and/or service ordered is Within a pre
`agreed limit;
`iii) if the customer’s identity is veri?ed, the transaction is
`executed by the supplier giving the customer access to
`
`the Internet service (300) ordered or ensuring delivery
`of the product ordered; and
`
`iv) the agreed sum is charged to the customer’s telephone
`subscription and invoiced on his telephone bill.
`20. A method according to any one of claims 15 to 18,
`characterised in that the telephone number is a mobile
`telephone number and that the passWord is sent to the
`telephone (101) as a GMS teXt message.
`21. A method according to any one of claims 15 to 18,
`characterised in that the passWord is sent to the telephone
`(101, 102) as a voice message.
`22. A method according to any one of claims 15 to 18,
`characterised in that the passWord is sent to the telephone
`(101, 102) as a teXt message.
`23. A method according to any one of claims 15 to 18,
`characterised in that the passWord authorises the ?rst party
`to make use of the second party’s services for a maXimum
`of a predetermined amount per transaction.
`24. A method according to any one of claims 15 to 18,
`characterised in that the passWord authorises the ?rst party
`to make use of the second party’s services in one or more
`predetermined periods of time.
`25. A method according to any one of claims 15 to 18,
`characterised in that the price for the service or the product
`is charged to an account belonging to the ?rst party.
`26. A method according to any one of claim 15 to 18,
`characterised in that the passWord is only valid for a par
`ticular transaction.
`27. A method according to any one of claims 16 to 19,
`characterised in that the passWord is only valid Within a
`geographical area.
`28. A method according to any one of claims 16 to 19,
`characterised in that When the passWord is generated a timer
`starts that determines the duration of the passWord, and
`Where this is made visible to the ?rst party in the form of a
`countdoWn on the screen, and Where the transaction is
`rendered invalid and a neW passWord must be requested if
`the passWord has not been used before the timer has run out.
`
`TWILIO, INC. EX. 1016
`Page 6