DE10336323A1 - Method for verifying access authorization via mobile terminal, uses verification device for analyzing vcard with authorization-ID - Google Patents

Abstract

A method for right of access authorization in which a mobile terminal can administer the information according to the v-card standard with a vcard (virtual business card) information, in which an authorization-ID is stored. A verification device can analyze a v-card with authorization-ID and can establish the 'settlement date' by loading and storing the v-card by the mobile terminal and in the event of verification of access transfer the card to the test device which receives the v-card and the authorization-ID is analyzed and the result displayed. Independent claims are also included for the following: (A) A mobile terminal.(B) A verification device.

Description

The The invention relates to a method for checking the access authorization using a mobile device.

Field of the invention:

prerequisite for M-commerce is an infrastructure that allows legitimization clearly and forgery-proof mobile deliver and read them from the terminal when needed again.

So can through this legitimation payment confirmations, tickets, permissions o. Ä. shown become.

State of the art:

A Ticket legitimisation at the Berlin public transport companies takes place through text messages (after GSM, SMS) representing public transport tickets. Vodafone used 2-dimensional barcodes (datamatrix codes) in a field trial for tickets a big event.

however led Both examples give unsatisfactory results, as the SMS is fake is because and expensive inspection devices required as admission control are.

From the DE 10035152 A1 An electronic business card is known that is based on the vCard (RFC 2425/2426) standard, which also lists the owner's geographic coordinates. An exchange of personal information occurs whenever two or more people communicate with each other, either on a business or personal level. This can take place both in a direct conversation, ie face-to-face, as well as over larger distances and time zones, for example electronically. Such an exchange of personal data often includes informative data.

Object of the invention:

task the invention is the provision of digital authorization information, the difficult to fake and easy to transfer.

Solution of the task:

The The object is achieved by an invention having the features of the independent claims. in this connection an authorization ID is added to a data structure that corresponds to the vCard integrated.

During one direct conversation often exchanged this informative data printed business cards exchanged with each other. The ones contained on the business card Information should be the interlocutor for example, by function, company affiliation, address and contact options, such as telephone, fax and email address, identify.

finds but communication over a greater distance instead of, for example, a videoconference, there is a possibility to exchange informative data, electronic business cards, so called vCards. The vCard automates the exchange personal Information also on traditional printed business cards can be found. A special advantage of electronic versus the Printed business card is that a lot of information fast and reliable exchanged, stored, organized and, above all, fast can be found again if this information is needed become. A vCard can therefore be used whenever between two electronic media data are exchanged. These can do this For example, data as a file attachment of an email over the Internet or an intranet between two computers, over public telephone networks or wireless, such as over a mobile network, to be exchanged.

Around to enable this exist standards, called vCard specifications (this: http: / /www.imc.org/pdi/), which structure information on the vCard and unify, that is, one Format for define the vCard. This will allow the data of the vCard for example, in the personal Address book if the software supports vCards.

One significant advantage of this invention is already wide available Infrastructure on mobile devices support the vCards (eg Nokia and Siemens mobile phones), d. h., a corresponding System would be Widely applicable on the market.

Consequently The invention relates to a modified electronic business card to the electronic communication of user information between at least two users, preferably according to standard RFC 2425/2426, wherein the electronic business card in addition to the authorization ID Address information as defined in the standard.

Furthermore is checking the vCard technically relatively simple and does not require expensive readout hardware. For reading standard notebooks, PDAs but also mobile phones are used.

According to the claims acts It is a procedure for authentication with a mobile terminal, the information can manage according to the vCard standard. This will be a vCard Transfer information, in which an authorization ID is stored. This transfer can be done at a machine or over the Internet, z. B. per E-mail.

For review and if necessary, validation will be a verification device that has a vCard with authorization ID can analyze and the due date can determine, used. For this purpose a vCard is transmitted to the checking device, which then checks the validity of the authorization ID using an algorithm. The transfer from and to the mobile device can be done wirelessly via Blooth, IRDA, WLAN or cable.

Of the Algorithm for checking can look like that in a first step, the structure of the authorization ID is checked. This can be z. B. be done by a signature that in the Permission ID inserted is being checked. Should this result be positive, then in a second step establishes a connection to a central server to which the authorization ID is transmitted. The central server checks if this Authorization ID still valid has and how many validities has this authorization ID. In the preferred embodiment the authorization is only to be used once. This is In a Transaction, the authorization ID is checked, and then reset to become. This does not allow you to make a copy of the vCard to create, since the validity stored in a database that is central. It can, however also be set to use the permission multiple times can be. In this case there is a risk that an unauthorized Copy is made and thereby the counter, the validity frequency Certainly, being downgraded by someone else. After the review, the preferably also over A wireless network like GSM can do, the result is up displayed to the verification device.

In a further embodiment the authorization ID is encrypted stored.

Of the Algorithm can be improved by additionally biometric Data of the user are stored, either when acquiring the vCard transmitted or by an optical device when acquiring the Authorization to be read. The verification device now has means to to evaluate and verify the biometric information. at these means may be fingerprint scanners or optical cameras that record a profile of the user.

One Another component of the present invention is a mobile terminal with a storage area in which an authorization ID in a vCard is stored.

In turn Another component of the present invention is an inspection device, the means that has a vCard with an authorization ID of a mobile terminal can receive. The verification device includes continue to provide means for online review of Authorization ID. In a further embodiment, there are means for checking biometric information stored in the vCard, in Connection with the authorization ID available.

in the The invention will be explained in more detail below with reference to exemplary embodiments which are shown schematically in the figures. Same reference numbers in the individual figures designate the same elements. In detail shows:

1 the decentralized legitimacy;

2 the central legitimation via a server.

Out 1 the individual steps of the procedure for a decentralized legitimation are evident. When requesting and transmitting the legitimacy (steps 1 and 2) it is requested by a central server and transmitted to the mobile device. These credentials encode a unique ID. The ID, in turn, forms an authorization, which is stored on the server side and checked during the (initial) submission of the legitimacy (steps 3 and 4). If this legitimacy has not yet been used, further actions are triggered (eg the entrance to the turnstile of an event, the "green message" for the inspector during the check in public transport, etc.) (step 5).

The ID is coded in a form (encrypted) so that its decryption preferably is expensive. The encryption process may only be known to the publisher of credentials in order to avoid creating legitimations from unauthorized side become.

To the Example could be an 8-digit ID is encrypted into a 20-digit legitimation, so - pure statistically - from all possible 20-digit codes only a very tiny fraction a correct one Legitimacy represents. This is the fake of legitimations largely excluded.

Simply copying legitimate legitimacy does not pose a potential threat, as legitimacy (and therefore the Online examination of the legitimacy) the admission takes place (example event tickets) and / or the user can be obligated on conditions of secrecy and / or non-transmission of the legitimacy by AGB.

The Legitimation itself is part of a vCard and can be mobile terminal via SMS, Bluetooth, Email, Infrared.

The review of Legitimation (ie the reading of the appropriate vCard) can per Infrared, SMS, Bluetooth, email or cable connection.

It is possible - when known clear user-related information, such as: B. biometric Data or just the telephone number of the user's mobile phone - this to be included in the coding of the legitimacy and in the control / claim the legitimacy with check. This approach would the u. U. difficult (because no mobile network, for example, due to overload) Online exam the legitimacy of their "used drawing" or invalidation when using them unnecessary (Step 4).

In the 2 The procedure described differs from that 1 in that the legitimacy check is done via a central server (steps 5 and 6), which may also have issued the credentials. Only then is the user informed in step 7 whether the legitimacy was valid.

Claims (10)

Procedure for authorization checking, - with a mobile terminal, the information after can manage the vCard standard, with a vCard information, in which an authorization ID is stored - with a verification device that has a vCard with authorization ID can analyze and determine the due date can with the following steps, - Loading and saving the vCard through the mobile device, - in the event of an authorization check, transmission, the vCard to the verifier that is the vCard receives and parses the authorization ID and displays the result. The method according to the preceding claim, characterized in that the authorization ID is stored in encrypted form becomes. The method according to one or more of the preceding Claims, characterized in that the verification device in a database validity the authorization ID checked. The method according to one or more of the preceding Claims, characterized in that the verification device via a communication link accesses a central database to verify the recoverability of the Check authorization ID. The method according to one or more of the preceding Claims, characterized in that additionally stored in the vCard biometric data identify the holder by means of the verification device. The method according to one or more of the preceding Claims, characterized in that the additional information is in data areas for binary values, like pictures, music, logo, comments and / or in custom Fields are deposited. The method according to one or more of the preceding Claims, characterized in that the transmission from and / or to mobile terminal via Blooth, IRDA, WLAN and / or cable. Mobile terminal with a storage area in which an authorization ID in a vCard is stored. The mobile device according to the preceding claim, characterized in that the authorization ID encoded is stored in the vCard and / or biometric information of the User has. Verification device marked by means that receive a vCard with an authorization ID of a mobile terminal can, With Means for online review of the Authorization ID and / or with means for checking biometric information, which is stored in the vCard in connection with the authorization ID are.