DE102007024144B3 - Method and arrangement for a quick log-on of a user on a service portal by means of a mobile communication device - Google Patents

Abstract

The invention relates to a method for performing a fast and secure logon of a user to a computerized service portal whose services, such as e.g. the handling of non-cash payment transactions or the downloading of certain data contents can be retrieved via a mobile communication device. It is provided that the user side, a user identifier (40) is present. This can e.g. in the form of a biometric feature of the user (60) or stored in an identification device (10) which exchanges the user identifier (40) over a short-range communication link (50) with a user-supplied mobile communication device (20) from which the identifier for registration to a computerized service portal, which is provided via a service providing device (30) is transmitted, so that now neither a user name nor a personal password of the user must be entered.

Description

For the use from computer-aided Service portals, such. B. Internet service portals to provide electronic financial services such as in particular for the settlement of non-cash payment transactions or Internet service portals for downloading data, in particular for downloading of ringtones or image data on a mobile phone, it is known that a on the service portal pre-registered user via a mobile communication device such as a mobile phone with the Services portal contacts and via this mobile communication device the for a registration process on the service portal necessary, and the user in advance as part of his registration with the service portal provider notified credentials such as user name and password.

A Such approach is different from the practical one Application less attractive because they z. B. in the release of a non-cash payment transaction on the computerized service portal leads to the necessity Submit user name and password in a sign-on service to the service portal to have to, which is a relatively time consuming process and clumsy Procedure can be undesirable, especially in practical shopping situations can, as relatively much time for such a registration process must be applied. This is special then unfavorable, if a customer z. At a payment processing point in a queue with other customers waiting behind him is engaged in the registration process on the service portal.

task The present invention is therefore a time-saving and secure procedure for registering a user on a computerized service portal provide.

These Task is by the independent Method claim 1 solved. The subordinate arrangement claim aims at an arrangement as advantageously for carrying out the method according to the invention Use finds. The dependent ones claims relate to advantageous embodiments of the present invention.

From the US 2002/0069286 A1 A method according to the preamble of claim 1 is already known, in which a designated as Internet TV device as a "user" after performing a process for a quick log on to an Internet service portal, access to services of this service portal on the Internet.

A first embodiment of the method according to the invention is based on the fact that a user identifier on an identification device (eg a radio frequency identification card) is detected by a mobile, preferably NFC-enabled (near field communication) communication device and to an access control device for a service portal, where it is compared with an identifier deposited for a particular user. It is granted an access authorization only if the user identifier can be assigned to a user account on the part of the operator of the service portal. From the WO 2006/016339 A1 Measures are already known, such as a NFC-enabled communication devices, a login process of a user can be performed on a computerized service portal.

Should such an identification device could be lost Find yourself as the original one Issue the owner of the identification device. To prevent this, It is proposed to use a mobile communication device to allow a short notice only if it has been previously approved by the User has been activated using the identification device is. A shortcut is then only with this mobile communication device possible, until a certain period has elapsed or the short notice with the same identification device and another mobile Communication device is activated.

To the access control device assigns a user access key which, as long as it is valid, both in the access control device and in those mobile Communication device is stored, with which the activation took place.

at a second embodiment The user identifier is based on biometric features of the User.

A shortcut will only be in both embodiments of the access control device accepted if the user identifier of a user has been transmitted together with the valid user access key to the access control device.

To After logging on, the user access key is preferred replaced by a new, so another short message without previous re-activation can be performed, etc.

The Advantages and features of the present invention also arise from the following embodiments in conjunction with the drawings.

It demonstrate:

1 a schematic representation of an arrangement for carrying out a first embodiment of the method according to the invention;

2 and 3 a flowchart of individual process steps, in a method according to the invention for activating the short notice at the in 1 shown arrangement are performed;

4 and 5 a flowchart of individual process steps, which in a method according to the invention of the short notice at the in 1 shown arrangement are performed.

First, in conjunction with 1 an arrangement may be described, which may find use in carrying out a first embodiment of the method according to the invention, as it can be used, for example, in an Internet services portal for handling non-cash payment transactions. The mode of operation of the individual subcomponents and their interaction in a method according to the invention will be described below with reference to FIGS 2 to 5 be explained in more detail.

In the 1 shown main components of such an arrangement are: One on the part of a user 60 existing identification device 10 (identification device IDD), also on the part of the user 60 existing mobile communication device 20 (Mobile communication device MCD), as well as a usually provided at a location other than the whereabouts of the user service providing device 30 (service providing unit SPU), which provides a computerized service portal.

The service providing facility 30 serves the central control of the services of a service portal provider, such. For example, a financial service provider offering, for example, a service portal for handling non-cash payment transactions.

This includes at the in 1 shown exemplary arrangement, the central service provision facility 30 a user data storage device 34 (User data storage unit UDSU), in the records to pre-registered users of a computerized service portal, such. B. a system for handling non-cash payment transactions are stored, in particular data from user accounts 35 (user account UAC). The user data storage device 34 stands with a central processing unit 32 (CPU Central Processing Unit). Furthermore, there is an access control device 33 (access control unit ACU) with the central processing unit 32 in connection. The central processing unit 32 coordinates the exchange of data with a service portal 36 (service portal SP), about which z. For example, financial services of financial service providers, in particular banks, credit card companies, etc., can be used.

To the user 60 towards or by the user 60 used mobile communication device 20 down, the in 1 shown central service provision facility 30 via a communication device 31 (communication unit CU), about the data between the user 60 or the mobile communication device used by him 20 and the central service provision facility 30 can be exchanged.

The mobile communication device 20 has a communication unit 23 (communication unit CU), via the data electronically over a wide-area communication link 51 (wide area communication) with the communication device 31 the service provision facility 30 can be exchanged. The term "long-range communication links" is used in particular to refer to public mobile telephone networks and in particular to the Internet and in particular to the public Communication networks understood.

Furthermore, the mobile communication device has 20 via a central processing unit 22 (central processing unit CPU), the data streams in the mobile communication device 20 processed. In the mobile communication device 20 In this case, data is exchanged between an identifier detection device 21 (identifier sensing unit IDSEU), a display device 24 (display unit DU), an input device 25 (input unit IU) and a memory device 26 (storage unit SU).

About the identifier detection means 21 can the mobile communication device 20 Information from the user-provided identification device 10 capture, and in particular of one on the identification device 10 provided identifier presentation device 12 (identification presentation unit IDPU). The identifier presentation device 12 is in turn connected to an identifier storage device 11 (identification storage unit IDSTU).

Between the identification device 10 and the service provider 30 as described below on the basis of 2 to 5 described in more detail, user identifier 40 (User identifier UID) using the mobile communication device 20 exchanged and between the mobile communication device 20 and the service providing facility 30 become bidirectional user access keys 41 . 42 (user access keys) exchanged.

By "short-range communication" is meant any type of communication in which a communication process between the identification device 10 and the mobile communication device 20 requires that these are physically brought into a relatively small distance from each other and - optionally - in particular a visual connection between these two institutions prevails and / or in particular a user brings these two devices manually very close together, possibly up to a direct physical contact between the two facilities.

To enable short-range communication between the identifier presentation device 12 and the short-range communication device 21 over the short-range communications link 50 In particular, it may be provided that RFID transmitting and receiving devices are used, which are physically approaching the identification device 10 and the mobile communication device 20 can exchange data with each other over relatively short distances in short-range communication.

• – eine (ggf. verschlüsselte) optische Darstellung des Identifizierers auf der Identifizierungseinrichtung 10 (z. B. in Form eines Strich- oder Punktcodes, der aufgedruckt ist oder aber auch auf einer Anzeigeeinrichtung, wie z. B. einer LCD-Anzeige, dargestellt ist bzw. auch eines Hologramms) und optisches Erfassen desselben auf Seiten der mobilen Kommunikationseinrichtung 20;
• – eine biologische Speicherung des Identifizierers durch Aufbringen von DNA-Sequenzen welche den Identifizierer repräsentieren auf ein Substrat (ID-Speicher- und Präsentationseinrichtung) seitens der Identifizierungseinrichtung 10 und Auslesen der DNA-Sequenz auf Seiten der mobilen Kommunikationseinrichtung 20;

Alternative forms of short-range communication can be installed by:

• - An (possibly encrypted) optical representation of the identifier on the identification device 10 (For example, in the form of a bar or dot code, which is printed or even on a display device, such as an LCD display, is displayed or a hologram) and optical detection of the same on the part of the mobile communication device 20 ;
• - Biological storage of the identifier by applying DNA sequences representing the identifier on a substrate (ID storage and presentation device) by the identification means 10 and reading the DNA sequence on the mobile communication device side 20 ;

In the presentation given so far, it was implicitly assumed that the user identifier 40 on a separate identification device 10 in the form of a custom and made by the user 60 in carrying out the method according to the invention with to be worn device such. As an RFID card, a smart card or the like, in an identifier storage device 11 is stored and by means of an identifier presentation device 12 made available for collection.

Alternatively, in a second embodiment of the inventive method, however, one or more biometric features of the user 60 the function of the user identifier 40 fulfill. In this case, the use of a separate identification device 10 be waived.

As biometric features, a user 60 can identify clearly and thus instead of an artificially generated user identifier 40 can come, come z. B. in question: fingerprints of a user 60 , Iris pattern, retina pattern, his voice, behavioral characteristics of the user 60 such as B. his handwriting, etc.

Such biometric features may be provided by appropriate identifier detection means 21 such as As a fingerprint scanner, an iris or retina scanner, etc. are detected.

In conjunction with the in 2 to 5 For the first embodiment of the method according to the invention flow diagram is now the interaction of the individual in 1 shown components for handling a secure short log in a user 60 at the service providing facility 30 explains at the user side an identification device 10 is provided for storing and exposing a user identifier 40 is provided.

Before step S1.1 in 2 It is assumed that a user 60 registered in advance on a computerized service portal (eg a financial service provider), ie that user-specific data such as As name, address, account numbers, ben ben to the creditworthiness, etc. of a user 60 in advance in one of the service delivery facility 30 reserved user data storage device 34 have been registered.

In step S1.1, the user logs 60 now at the service provision facility 30 by, for. B. his username and a pre-assigned password via the mobile communication device 20 to the access control device 33 and thereby gain access to an (Internet) service portal 36 of the service portal provider that enables the service providing facility 30 operates.

In a menu item provided in this access portal of the service portal provider, the user can 60 Now select the option "Activate shortcut" in step S1.2.

This explains the user 60 towards the service providing facility 30 that he now wants to be able to be at any time by physically approaching his identification unit 10 , which preferably contains a static, in particular once firmly embossed identifier, and its mobile communication device 20 with which he is currently performing the activation, a registration process at the service providing facility 30 trigger.

In the service delivery facility 30 is thus now flagged that the user 60 itself by a near-field communication enabling physical approximation of the identification device 10 and the mobile communication device 20 at the service providing facility for the use of services of the service portal, such as: B. a settlement of non-cash payments, want to register.

In the following there is the service providing facility 30 After completion of step S1.2, preferably now a time window before, within which the step S1.3 can be performed, in which the user 60 his identification device 10 with a mobile communication device 20 (eg, a mobile phone) must now bring together this mobile communication device 20 to be used for later use in a quick logon. This process is called "activate".

It can be provided that it is any mobile communication device 20 is. The user 60 So does not necessarily have to use a mobile phone, which in advance in the service provision facility 30 has been registered ("his own cell phone"), but he can be an arbitrary mobile communication device 20 which meets the initial technical specifications to communicate with the identification device 10 to be able to communicate (thus in particular also a "foreign mobile phone").

Approaching the user 60 his identification device 10 on which the data identifying it in the identifier storage means 11 stored to the mobile communication device 20 physically, so in the identifier presentation device 12 and in the mobile communication device 20 provided short-range communication means such. B. RFID transceivers, via standardized Nahfeldkommunikationsprotokolle (eg ISO 14443A for RFID over Mifare, FeliCa, etc. and eg ISO 18092 for NFC in dialogue mode, etc.) exchange data.

In this case, an identifier in the form of a code in an RFID transmitter on the side of the identification device 10 be provided, which by means of an RFID receiving device on the part of the mobile communication device 20 is read out.

But it is also conceivable that an identifier z. Example in the form of an optical bar code (bar code, 2D bar code, for example in the formats: Datamatrix, Semacode, BeeTagg or QR etc.) on the identification device 10 is provided, and for example by means of an optical bar code scanner or a camera on the part of the mobile communication device 20 is detected.

In particular, in step S1.4 a user identifier is created 40 from the mobile communication device 20 detected and, optionally, with an individual identifier of the mobile communication device 20 (eg the identifier of a SIM card of a mobile phone) combined.

In step S1.5 then transmits the mobile communication device 20 the user identifier 40 to the access control device 33 ,

In the service delivery facility 30 are - z. For example, in the case of operating an internet services portal to handle non-cash payments - for each pre-registered user, their user identifiers and associated user account information are stored. On the basis of the mobile communication device 20 the user identifier then becomes the user 60 belonging user account 35 (user account) identified (step S1.6).

In the service delivery facility 30 is then checked in decision step D1.1, if the user account 35 exist.

Should this not be the case, then the service providing facility will 30 in step S1.7, a response to the mobile communication device 20 given that the shortcut could not be activated. The process of the invention ends at this point with the result that the short notice for the user 60 could not be activated.

However, in step D1.1, it was determined that the user account 35 exists, it optionally continues in step S.1.8, where on the display device 24 the mobile communication device 20 a so-called activation data entry form is displayed.

As a precautionary measure in the event that in the time that has elapsed since the entry of the credentials in step S.1.3, the mobile communication device 20 should have come into the hands of an unauthorized person, can be optionally provided here that the user has to identify and authenticate here again. For this he must in step S1.8 z. For example, enter his username and personal password or enter a PIN again.

At this time, the user inputs via the input device in step S1.9 25 the requested data for its identification, which is then used by the mobile communication device ( 20 ) to the access control device 33 are transmitted back (step S1.10), where then in step S1.11 in the service providing facility 30 is again verified whether the activation data has been entered correctly.

In decision step D1.2, this option then checks whether the activation of the short-notice has been authorized. If not, then again a message from the service providing facility 30 to the mobile communication device 20 given and there in step S1.12 the message "shortcut has not been activated" on the display device 24 displayed. Then the process is again terminated in step D with the result that it would not have come to an activation of the short notice.

If, however, it is determined in the decision query D1.2 that the activation of the short-notice has been authorized, then in this optional variant of the renewed verification of the activation data (steps S1.8 to D1.2), finally the "milestone B" is reached it has been established that the user account 35 is OK, and from there to step S1.13, where on the side of the service providing facility 30 now a user access key 41 is generated.

Of the Away from the decision step D1.1 to the "milestone B" can also directly respectively.

In any case, after reaching the "milestone B" the user access key 41 in step S1.14 in the access control device 33 stored and from there in step S1.15 to the mobile communication device 20 where it is in step S1.16 in the mobile communication device with Help the storage device 26 is stored. Thereafter, on the display device 24 the message "Short message has been activated" is displayed (step S1.17), completing the complete process of activating the short message ("milestone E").

In the in 2 and 3 So now the mobile communication device finally became the final step 20 in an activation state in which it is now possible, the mobile communication device 20 for more, in 4 and 5 shown steps, for the short notice at the service providing facility 30 to use.

In 4 Now, if necessary, the actual short application process to enable, for example, a payment transaction is started in step S2.1. This can z. B. on the display device 24 a request to the user 60 are displayed, that at the start of the short-enrollment process, the identification device 10 and the mobile communication device 20 are sufficiently approximate.

Such a physical approach of identification device 10 and mobile communication device 20 takes place in step S2.2.

In step S2.3 then the user identifier 40 again from the mobile communication device 20 detected and in step S.2.4 in this exemplary embodiment of the method, the user identifier 40 and the user access key 41 from the mobile communication device 20 to the service providing facility 30 transfer.

In step S2.5, the user access key 41 with the advance for the user 60 in the service delivery facility 30 generated and in the user account 35 stored user access key 41 compared and validated.

If it is determined in decision step D2.1 that the user access key 41 is not correct, ie when performing a comparison operation is found that the user account 35 stored user access keys 41 not with the user access key currently transmitted by the mobile communication unit 41 the exception is handled via the "NO" branch from decision step D2.1 and the user 60 obtained in step S2.6 on the display device 24 the mobile communication device 20 a message "User could not be logged in", whereupon the process ends in "milestone F".

If, on the other hand, it is determined in decision step D2.1 when carrying out the comparison operation that the user access key 41 is OK, so it goes on in step S2.7, where now from the mobile communication device 20 currently transmitted user access keys with the one in the service providing unit ( 30 ) compared user access key is compared.

If it results in decision step D2.2 that the currently transmitted user access key does not match the stored user access key, the process continues in step S2.8, where on the mobile communication device 20 the message is displayed that the user could not be logged on, whereupon the process ends in the "milestone G".

If, on the other hand, it is determined in decision step D2.2 that the message from the mobile communication device 20 currently transmitted user access key is OK, so on the mobile communication device 20 in step S2.9 the computerized service portal 36 displayed. Then the method according to the invention for secure short-term registration in the "milestone H" ends with the user on the service portal 36 is logged in.

Here, the user can now access the from his mobile communication device 20 accessed services portal, and z. B. handle non-cash payment transactions or download certain content (eg ringtones on a mobile phone) etc.

Optionally, however, the decision of step D2.1 instead of the step S2.9, the sequence of in 5 Connect steps S2.10 to S2.14. In step S2.10 in 5 In this case, the next user access key is optionally available again 42 generated in step S2.11 in the access control device 33 stored and in step S2.12 to the mobile communication device 20 where it is stored in the mobile communication device in step S2.13 and then in step S2.14 the service portal 36 for the user 60 is displayed, then the user in the "milestone J" on the service portal 36 is logged in. LIST OF REFERENCE NUMBERS 10 IDD Identification Device 11 IDSTU Identifier storage device (ID storage unit) 12 IDPU Identification presentation device (ID presentation unit) 20 MCD Mobile communication device 21 IDSEU Identifier sensing unit 22 CPU Central processing unit 23 CU Communication unit 24 YOU Display unit 25 IU Input device 26 SU Storage unit 30 SPU Service Providing Facility 31 CU Communication unit 32 CPU Central processing unit 33 ACU Access control unit 34 UDSU User data storage unit 35 UAC User account 36 SP Service portal 40 UID User identifier 41 UAK User access key 42 UAK new user access key 50 Short-range communication path (proximity communication) 51 Wide area communication link 60 User User

Claims (9)

A method for rapid user logon to a computerized service portal, wherein - the service portal on a service providing device ( 30 ) and via a long-range communication path ( 51 ) on a mobile communication device ( 20 ), - user-side user identifier ( 40 ), which is a user ( 60 ) and in advance in the service providing facility ( 30 ) for the user ( 60 ) information corresponds, - in a one-time setup step in advance - the user identifier ( 40 ) by the mobile communication device ( 20 ), - the user identifier ( 40 ) from the mobile communication device ( 20 ) over a wide area communications link ( 51 ) to the service providing facility ( 30 ), - in the service providing facility ( 30 ) the user identifier ( 40 ) with the advance for the user ( 60 ), in order to obtain, upon successful validation, a user-access key legitimizing a short-enrollment on the service portal ( 41 ) from the service providing facility ( 30 ) to the mobile communication device ( 20 ), - the user access key ( 41 ) in the mobile communication device ( 20 ), and then - the mobile communication device ( 20 ) for triggering a short-enrollment process on the service portal ( 36 ) of the service providing institution ( 30 ) the user identifier ( 40 ), - the user identifier ( 40 ) for the validation of the stored user access key ( 41 ) and - on successful validation of the user ( 60 ) on the service portal ( 36 ) of the service providing institution ( 30 ), characterized in that the service providing facility ( 30 ) after successful log-on of the mobile communication device ( 20 ) a new user access key ( 42 ) to the mobile communication device ( 20 ) transmitted. Method according to claim 1, wherein an identification device ( 10 ) is provided, in which the user identifier ( 40 ) and the user identifier ( 40 ) from the identification device ( 10 ) to the mobile communication device ( 20 by physically approaching the two over a short-range communications link ( 50 ) is transmitted. Method according to claim 1, wherein the user-side user identifier ( 40 ) in the form of at least one biometric feature of the user ( 60 ) is present. Method according to claim 2, wherein the short-range communication path ( 50 ) by means of an RFID transmitter on the side of the identification device ( 10 ) and an RFID receiving device on the part of the mobile communication device ( 20 ) is realized. Method according to claim 2, wherein the short-range communication path ( 50 ) by means of the presentation of visual information on the part of the identification device ( 10 ) and an optical detection device on the side of the mobile communication device ( 20 ) is realized. Method according to one of the preceding claims, wherein the mobile communication device ( 20 ) is a mobile phone. Arrangement for carrying out a method according to claim 2, 4, 5, 6, which comprises: a) an identification device ( 10 ) with an identifier storage device ( 11 ) for storing a user identifier ( 40 ) and with an identifier presentation device ( 12 ) for presenting the user identifier ( 40 ), b) a mobile communication device ( 20 ) with an identifier detection device ( 21 ) for capturing a user identifier ( 40 ) using a short-range communications link ( 50 ) as well as funds ( 26 ) for storing a read user access key ( 41 ) and with a communication unit ( 23 ) for transmitting the user identifier ( 40 ) over a wide area communication link ( 51 ) to a service providing facility ( 30 ). Arrangement according to claim 7, wherein an RFID transmitter on the side of the identification device ( 10 ) and an RFID receiving device on the part of the mobile communication device ( 20 ) is provided. Arrangement according to claim 7, wherein a display device for the presentation of optical information on the part of the identification device ( 10 ) and an optical detection device on the part of the mobile communication device ( 20 ) is provided.