GB2438284A

GB2438284A - Payment authorisation using voice biometric

Info

Publication number: GB2438284A
Application number: GB0707988A
Authority: GB
Inventors: Jonathan Nicolas Ogden; Voicepay Limited
Original assignee: Individual
Current assignee: Individual
Priority date: 2006-05-11
Filing date: 2007-04-25
Publication date: 2007-11-21
Also published as: GB0707988D0; GB0609328D0

Abstract

To authorise transactions carried out remotely, by land line, mobile telephone or via the Internet, the voice of the user is used as a biometric identifier. The user will have previously set up an account with the provider of the service, e.g. linked to a credit card account, with the provider of the service storing the voiceprint of the user. This may be on an Internet site, the user supplying Email address, phone number details and the sample voiceprint.

Description

VoicePay Tide Guaranteed Electronic Payments using Authenticated Voice

Biometric Technology Patent Application This patent application is made on behalf of Voice Pay Ltd a company under registration in Jersey, The Channel Islands.

This claim was created and prepared by Nick Ogden, MLnstPI, email nick. ogdenogden-research. corn Recognition of Prior Technology Rights This patent recognises prior technology rights that exist to Biometric Security Limited and Voice Commerce Group Limited.

Process Rights Biometric Security Limited and Voice Commerce Group Limited legally accept that the process, operation and rights claimed by the VoicePay payment system, owned and operated by VoicePay Limited are unique.

Prior Disclosure

Parties to the VoicePay process have been subject to execution of non disclosure agreements but are all employees or shareholders or advisors to Biometric Security Limited or Voice Commerce Group Limited.

Commercialisation The VoicePay Payment service will be commercialised during 2006 Changes and Amendments Patent Application number GB 0609328.0 11th May 2006 Additional details to process flows added April 2007 Guaranteed Electronic Payments using Authenticated Voice Biometric Technology -

VoicePay -Description

This patent covers the process of securing, authentication and guaranteeing payment transaction using voice biometric through a process to be known as VoicePay. The word VoicePay when used in this document encompasses the process of guaranteeing any value or type of electronic payments using authenticated Voice Biometric Technology.

The Voice Biometric technology is owned operated and subject to certain patents by a UK registered company called Biometric Security.

The payment authorisation, customer management and reconciliation process has been developed by Voice Commerce Group, a Jersey registered company.

VoicePay combines by legal agreement the separate processes of Biometric Security and Voice Commerce Group into an operational based business delivering a unique global guaranteed payment processing service.

Voice Pay is a unique, guaranteed, secure, digitally signed and biometrically authonsed system for use in ant type of financial transaction.

Voice Pay creates an environment where financial transactions are "signed" and as a consequence of that signature the transaction is 100% guaranteed for payment to the merchant, and a complete "goods" guarantee of delivery and operability is delivered to the purchaser. Interlinked to the signature are further processes of user authentication and validation at the point of transaction and is a process Voice Pay operates by matching a captured "voice print" record of someone's voice which is attached to their personal account to a transaction or payment request from a merchant at the transaction point.

Visa and MasterCard authorise transactions against credit worthiness. VoicePay authorises transactions against confirmed identities removing the risk of transaction repudiation and identity theft.

Voice Pay enables "100% positive" authorisation of a transaction. Existing systems operated by Visa and MasterCard for example are arbitrary in their operation leaving the financial risk with the business processing a card transaction.

VoicePay transactions that are authonsed are 100% guaranteed and cannot be repudiated.

Depending on the commercial terms agreed in advance with the merchant an advanced Digital Certificate conforming to Directive 1999/93/EC may be issued.

Additional validation checks to confirm the integrity of the parties to a transaction also operate. . .

Merchants go through an on-line process of validation and confirmation of credit history together with voice biometric registration prior to their authorization to operate VoicePay transactions.

VoicePay account holders undertake a process a positive identification, ground truth, or KYC prior coupled with voice biometric registration prior to their use of the system.

VoicePay is multilingual in operation Cailbacks are a method a contact used by VoicePay during a transaction. Calibacks are initiated via PSTN or mobile phone calls, Internet Voice over IP and by connections to new communication networks including but not limited to Skype, Google Talk, MSN, and Yahoo Voice Pay guarantees both parties to an escrow transaction.

Chapter One -Account Creation -Claim 1 Prior to a VoicePay transaction being generated two types of account are required. These are: 1. Merchant account 2. Consumer or end user account Merchant account This is tied to a business, company, corporation, partnership or sole trader selling goods or services.

This account is created by the merchant making an application to VoicePay for payment acceptance services. This application is normally made over the internet but can be through the completion of a wntten application form.

Based upon a wide range of information that is supplied a credit score and risk assessment is generated.

Validation of the merchants banking relationship is obtained.

A credit limit is applied to the account which may be supplied and for underwritten by a third party A voice print from the merchant is obtained which is tied to a unique merchant account number or code.

The account is opened.

Consumer or end user account This is tied to the consumer or end user purchasing services or trading or selling services in their own right for example within an on-line auction environment.

This account is created by the consumer or end user making an application to VoicePay for a payment account service. This application is normally made over the internet but can be through the completion of a written application form.

Based upon a wide range of information that is supplied or obtained from third party sources a credit score and risk assessment is generated.

Confirmation of home address or address of normal residency is confirmed.

Validation of the consumer or end user banking relationship may be obtained.

A credit limit may be applied to the account which may be supplied and br underwritten by a third party Transaction trigger limits are set by the consumer requests that a positive authorisation is sought from them for transactions from their account above a fixed limit.

AutoPay instructions may be created by the consumer or end user to ensure that the account always remains within pre-determined credit limits Details and instruction to other financial organisations together with authorisations In practice a VoicePay account is created as follows: 1. A Customer will create a new account on the VoicePay web site. This information will include: a. Email Address b. Mobile phone number c. Land-line phone number 2. The customer creates a password that conforms with VoicePay's password rules.

3. VoicePay generates a VoicePay Account Number -which is displayed on screen.

4. The customer is advised on scrcen that voiceprint enrolment is the final stage of the account set up process.

5. VoicePay will send VoiceVault an enrolment request. This request will include:-a. VoicePay Account Number b. Land-Line number --E164 format c. Mobile Phone Number -E164 fonnat 6. VoiceVault will immediately make an outbound call the Customers Land-Line number.

7. Voice Vault performs Account Number and Pass Phrase enrolment using their existing biometric platform.

8. On completion of enrolment VoiceVault generates a 4 digit Enrolment Confirmation code. This is spoken back to the customer.

9. VoiceVault stores voiceprints, VoicePay account number and both landline and mobile numbers.

10. VoiceVault sends an Enrolment Confirmation message back to VoicePay, including the 4 digit Enrolment Confirmation Code.

11. The customer is prompted to enter the Enrolment Confirmation Code into the VoicePay web screen.

12. If the Enrolment Confirmation Code entered does not match the code sent by VoiceVault (or the customer fils to enter the code with 10 minutes) then VoicePay fails' the enrolment and sends an Account Block message to VoiceVault (see below).

Account Opening Security Summary

Enrolment is always performed by calling a physical location (rather than a mobile).

The enrolment confirmation code verifies that the person who has completed the voice enrolment is the person accessing the web site.

A VoicePay account card is sent by normal mail to confirm the registered address. If the letter is returned the account is canceled.

The account is opened.

These processes are complete when the account and supports claim number 1 which is the process of creation of a secure account tied to a voice biometric capable of use in financial transactions processing by consumers, end users and merchants to enable the creation of a transaction guaranteed against repudiation.

Chapter Two -Account Use -Claim 2 To use their account to make a payment a merchant, consumer or end user identifies themselves to the VoicePay system using their user name and a password or PiN or simply speak to identify themselves with their voice print.

Once identified as an account holder a payment amount to generate a payment transaction is provided by the account holder. This can be in any natural currency, any value to the lowest natural currency unit i.e. one penny or cent, or less than the lowest value of a natural currency unit in the case of a micro payments transaction.

Some accounts are automatically tied to desktop applications such as the White Phone system and in these instances once a user has logged in successfiully to the desktop application no further identification is required as the users account will be open to them.

The payment amount is linked to the merchant account at the time that the request to generate a payment transaction is generated.

Once a payment amount has been entered a confirmation of funds is sought.

If the account has sufficient funds available to continue with the transaction a further check takes place to ascertain if the transactions exceeds the trigger threshold established for that account.

If there are insufficient funds or the account is new then funds are sought to create a credit balance within the account.

Additional funds can be obtained through either a Credit Card top up or Auto Pay transaction.

In both cases when additional funds are sought the transaction requires a range of authorisations. These authorisations are obtained from a range of sources including but not limited to the following: Credit card issuers ACH providers and bank transfers Banks and other financial institutions eCheque schemes Physical cheque or cash deposits Transfers from other accounts i.e. PayPal In addition to these sources of authorisation secondary sources of validation using a range of anti-fraud solutions and services may also be used. These sources include but are not limited to the following: MasterCard Secure code Verified by Visa CVV match Cybersource Retail Decisions Equifax Dunn and Bradstreet During this process a voice authorisation is also sought from the account holder. This process time and date stamps the transaction and confirms that the transaction is being requested by the account holder. This process is undertaken using either a call back or call to process. In the case of a call back the account holder will receive a telephone call asking for a voice authorisation. In the case of a call to the account holder will be transferred directly to the voice authorisation centre.

The call back and Call to process provides a seamless link from the voice authorisation platform to the account holder at the time of transaction and can be initiated over a range of networks and through a range of devices.

In practice VoicePay operates like this Internet Transactions This example assumes that the customer is on line in from of a physical computer, either at their home or place of work or at a cyber café or remote internet terminal.

1. Customers completes their shopping and clicks to pay' using VoicePay. A secure session has already been initiated between the customer browser and the VoicePay system.

2. The customer will be prompted to enter the registered email address and VoicePay password.

3. VoicePay will verify the password.! 4. A unique Transaction Code is generated by VoicePay and displayed on the screen 5. The format is 6 digit number displayed as 123-456. which includes a check digit The customer will be prompted to make a phone call to VoiceVault from either their registered landline or mobile phone. VoicePay provides national access numbers and br route calls to VoiceVault data centre.

1. The customer can make a Voip call directly from their browser using The Voice Commerce Group Busta technology. This call will be terminated onto the existing number range at Voice Vault.

2. VoicePay will send VoiceVault a message consisting of the a. VoicePay Account Number b. 6 digit unique Transaction Code 3. The Transaction Code received by VoiceVault will be considered live' for 5 minutes.

After 5 minutes VoiceVault will expire the Transaction Code.

4. The customer is prompted to enter their unique Transaction Code (DTMP or speech).

5. if the Transaction Code entered does not related to a live' Transaction Code then (after 3 attempts), VoiceVault aborts the call.

6. If a CLI is received by VoiceVault then it is used as a claimed identity2. VoiceVault checks that the CLI related Account Number matches the Transaction Code Account Number supplied by VoicePay. If there is a match then VoiceVault will proceed with pass phrase verification only.

7. If no CLI is received by VoiceVault then the caller is asked to speak their VoicePay Account Number. If the Account Number spoken relates to the Transaction Code then ANy and pass phrase verification is performed.

8. If verification fails then VoiceVault or if the Transaction Code and Account Number do not match then VoiceVault will advise the customer and terminate the call. A Transaction (Failure) message is sent to VoicePay and the Transaction Code is expired.

9. If verification is successfully completed VoiceVault computes a 4 digit confirmation code. The confinnation code is spoken back to the customer and the call is terminated. A Transaction (Processed) message is sent to VoicePay.

10. The Customer types the 4 digit confirmation code into the browser. VoicePay computes and confirms the 4 digit confirmation code.

Internet Transactions Security Summary

A) Purchase verified by customer using a registered phone 1. Customer must use registered email address on the web 2. Correct web password establishes SYK 3. CLI establishes SYH.

Pass phrase establishes SYR + [SYKJ3 Authentication Level Overall process delivers three fctor authentication.

B) Purchase verified by customer using a non registered phone (or where CLI is not available) or a web VoIP call is made I. Customer must use registered email address 2. Correct web password establishes SYK 3. Account Number Verification establishes SYR 4. Pass phrase establishes second SYR [and second SYKJ Authentication Level Overall process delivers two flictor authentication.

Mobile Transactions.

Mobile transactions relate to all types of non -web based purchases that a customer undertakes.

A typical scenario is that a customer sees an advertisement for a product that has a VoicePay logo and Purchase Code and price. The Purchase Code (6 digits) will relate to a specific product.

Mobile transactions can be made using either a mobile phone or PDA or any device capable of creating a voice call either using PSTN or Mobile phone networks, 3G and other data networks or Internet WiFi networks.

The VoicePay Purchase Line' will be provided by VoicePay. Calls will be routed to tenninate at VoiceVault's data centre.

1. Customer phones VoiceVault and is prompted to speak an account number.

2. 11 CLI is available then VoiceVault checks that the account number spoken is linked to the phone used. If CLI does not match then pass phrase verification is performed.

3. If verification is successfully completed then the customer is prompted to speak the Purchase Code.

4. VoiceVault sends a message to VoicePay consisting of the Account Number and Purchase Code. VoicePay validates the Purchase Code and returns a price message (the price of the item being purchased).

5. VoiceVault speaks the price of the purchase back to the customer and asked the customer to confirm the purchase.

6. VoiceVault sends a purchase confirmation message back to VoicePay.

7. VoicePay processes the transaction and payment and sends a final purchase complete message to VoiceVault. Voice Vault speaks back a confirmation to the customer that the purchase has been completed.

8. Separately VoicePay sends a purchase confirmation SMS and email to customer.

9. VoicePay system will handle order Purchase Code and Order Management. Delivery of goods are to be made to the Account Holders registered address.

Mobile Transaction Security Summary

A) Purchase verified by customer using a registered phone CLI establishes SYH.

Account Number Verification establishes SYR Authentication Level Overall process delivers two thctor authentication.

B) Purchase verified by customer using a non registered phone (or where CLI is not available) Account Number Verification establishes SYR.

Pass phrase establishes second SYR [and SYKJ Authentication Level Overall process delivers two factor authentication Thisj,rocess is now complete and supports claim number 2 which is the process of authorisation call-backs or call too's to initiate collection of a voice biometric data for authorisation using prmal PSTN and mobile phone lines, voice over the internet protocol. SIP directory servers and, or conversion of messaging to access proprietary networks to confirm the creation of a transaction guaranteed against repudiation is unique.

Chapter Three -Making a Payment -Claim 3 Once the account has sufficient finds to meet the payment request the transaction will be completed.

If sufficient funds are still not available the transaction will be declined and the account holder and merchant informed accordingly.

If the account has sufficient funds, and the balance in the account has been subject to a voice authorisation and the payment request falls below the account trigger limit for secondary voice authorisation the transaction proceeds to completion.

If the transaction is above the account trigger limit a voice authorisation is sought using a call back Once the Call Back or Call to has been initiated and completed a transaction is either verified or declined based up the voice print match.

When a transaction has been completed at this point it is guaranteed and confirmation of the purchase is passed to the account holder and confirmation together with fill details of the transaction and a unique guarantee number indicating the financial value of the guarantee are issued to the merchant. No other account information such as credit card numbers or other personal financial details are sent to the merchant.

In practice transaction are completed as follows: Internet Transactions This example assumes that the customer is on line in from of a physical computer, either at their home or place of work or at a cyber café or remote internet terminal.

J. Customers completes their shopping and clicks to pay' using VoicePay. A secure session has already been initiated between the customer browser and the VoicePay system.

3. VoicePay will verify the password.4 4. A unique Transaction Code is generated by VoicePay and displayed on the screen 5. The format is 6 digit number displayed as 123-456. which includes a check digit The customer will be prompted to make a phone call to VoiceVault from either their registered landline or mobile phone. VoicePay provides national access numbers and br route calls to Voice Vault data centre.

11. The customer can make a Voip call directly from their browser using The Voice Commerce Group Busta technology. This call will be terminated onto the existing number range at Voice Vault.

12. VoicePay will send VoiceVault a message consisting of the a. VoicePay Account Number b. 6 digit unique Transaction Code 13. The Transaction Code received by VoiceVault will be considered Jive' for 5 minutes.

After 5 minutes VoiceVault will expire the Transaction Code.

14. The customer is prompted to enter their unique Transaction Code (DTMP or speech).

15. If the Transaction Code entered does not related to a live' Transaction Code then (after 3 attempts), VoiceVault aborts the call.

16. If a CLI is received by VoiceVault then it is used as a claimed identity5. VoiceVault checks that the CLI related Account Number matches the Transaction Code Account Number supplied by VoicePay. If there is a match then VoiceVault will proceed with pass phrase verification only.

17. If no CLI is received by VoiceVault then the caller is asked to speak their VoicePay Account Number. If the Account Number spoken relates to the Transaction Code then ANy and pass phrase verification is performed.

18. If verification fails then VoiceVault or if the Transaction Code and Account Number do not match then VoiceVauft will advise the customer and terminate the call. A Transaction (Failure) message is sent to VoicePay and the Transaction Code is expired.

19. If verification is successfully completed VoiceVault computes a 4 digit confirmation code. The confirmation code is spoken back to the customer and the call is terminated. A Transaction (Processed) message is sent to VoicePay.

20. The Customer types the 4 digit confirmation code into the browser. VoicePay computes and confirms the 4 digit confirmation code.

21. Separately VoicePay sends a purchase confirmation SMS and email to customer which acts as the guarantee for the transaction.

Mobile Transactions.

Mobile transactions can be made using either a mobile phone or PDA or any device capable of creating a voice call either using PSTN or Mobile phone networks, 30 and other data networks or Internet WiFi networks.

1. The VoicePay Purchase Line' will be provided by VoicePay. Calls will be routed to terminate at VoiceVault's data centre.

2. Customer phones VoiceVault and is prompted to speak an account number.

3. If CLI is available then VoiceVault checks that the account number spoken is linked to the phone used. If CLI does not match then pass phrase verification is performed.

4. If venflcation is successfiully completed then the customer is prompted to speak the Purchase Code.

5. VoiceVault sends a message to VoicePay consisting of the Account Number and Purchase Code. VoicePay validates the Purchase Code and returns a price message (the price of the item being purchased).

6. VoiceVault speaks the price of the purchase back to the customer and asked the customer to confirm the purchase.

7. VoiceVault sends a purchase confirmation message back to VoicePay.

8. VoicePay processes the transaction and payment and sends a final purchase complete message to VoiceVault. VoiceVauk speaks back a confirmation to the customer that the purchase has been completed.

9. Separately VoicePay sends a purchase confirmation SMS and email to customer which then acts as the guarantee for the transaction.

10. VoicePay system will handle order Purchase Code and Order Management. Delivery of goods are to be made to the Account Holders pre-registered address.

Third Party Authonsations Third part authonsation can be provided to and card issuing organisation including, Visa and MasterCard, where cards are identified as being VoicePay enabled through their uN-Issuer Identification Number.

In this case when a card transaction is entered into a Visa or MasterCard network for example the transaction is identified and passed to VoicePay for authorisation as follows An example of third party authorisation follows: 1. A Customer will have previously created a new account on the VoicePay web site to register a card or details would have been provided by the Card issuing bank or financial institution -see Account creation.

2. This information will have included a. Mobile phone number b. Land-line phone number 3. VoicePay will receive an authorisation request from the card issuing network.

4. VoicePay will check the value of the transaction against the "limit" set by the customers.

5. If the transaction value exceeds the limit VoicePay will send VoiceVault an authorisation request. This request will include:-a. VoicePay Account Number b. Mobile Phone Number -E164 format c. Voice Authorisation number 6. VoiceVault will immediately make an outbound call the Customers Mobile phone number.

7. VoiceVault performs Account Number and Pass Phrase check using their existing biometric plafform.

8. If verification is successfully completed then the customer is prompted to speak the Voice Authorisation Code 9. VoiceVauft sends a voice authorisation confirmation message back to VoicePay.

10. VoicePay processes the transaction and payment and sends a purchase complete message to the card network and card issuer 11. Separately VoicePay sends a purchase conuirrnation SMS and email to customer which then acts as the guarantee for the transaction This process is now complete and supports claim number 3 which is the process of authorising by voice biometric and concurrently guaranteeing payment for any type of financial transaction against repudiation.

Chapter Four -Escrow Transactions -Claim 4 In some cases transactions require to be placed into an escrow account. Example of these types of transactions include Proof of delivery is required Proof of ownership Proof of transfer Third party confirmation of "cleared funds" Where an escrow transaction is processed through VoicePay a number of earlier voice authorisations may have been obtained to create an account with sufficient funds or to confirm an account as a prospective seller of an item.

To complete the transaction which will release monies that are held is escrow requires a positive authorisation from both parties. Once funds are in place a guarantee will have been issued to the seller however in an escrow agreement these funds, albeit guaranteed are not released until the buyer confirms his satisfaction with the transaction.

Each party can authorise that transaction at separate times and when the goods have been shipped for example the seller will confirm that thishas happened and a voice authorisation with a time and date stamp is obtained and details of this authorisation are passed to the purchaser. Upon receipt of the goods the purchaser confirms receipts and a voice authorisation to remit the funds to the seller is requested. Once this has been received and authenticated the transaction is completed and the escrow funds are released.

This process is now complete and supports claim number 4 which is the process of authorisation by voice biometric the parties to an escrow transaction prior to financial settlement to confirm the creation of a transaction guaranteed against repudiation.

Glossary

Terni Description

Advanced Electronic Means an Electronic Signature that meets the following Signature' requirements: It is uniquely linked to the signatory * Is capable of identifying the signatory * It is created using means that the signatory can maintain under his / her sole control; and It is linked to the data to which it relates in such a manner that __________________ any subsequent change of the data is detectable.

Authentication is the process of comparing a submitted biometric against the and/or Verification biometric reference of a single enrollee whose identity is being __________________ claimed, to determine whether it matches the enrollees template Callback Calibacks are real-time communication sessions initiated via PSTN or mobile phone calls, Internet Voice over Internet _________________ Protocol and by connections or to new communication networks Digital Signature In December 1999 the European Parliament and Council adopted Directive 1999193/EC -an EU wide framework for electronic signatures. Since then, individual member states of the EU have implemented legislation that gives legal recognition to electronic ____________________ signatures Guaranteed Subject to the terms of the transaction being met the goods will be Transaction delivered and guaranteed payment will be made ISO 17799 This rating demonstrates the implementation of the most stringent __________________ operating procedures within a secure datacentre environment.

Merchant a person or company or partnership operating a business where __________________ goods or services are sold for payment Negative Voice Print 100% accuracy on the voice match was not achieved Passwords and PINs Are a widely used and accepted form of automated identification Positive Voice Print A 100% accurately matched voice print Transaction a request to process a payment of any type or value Transaction Point The location and or time that a transaction is created Voice Biometric The process of capturing an individual voice print registration ______________________________________________________________________ Voice Biometric The process of confirming that a voice print is matched using verification and over 100 different calculations and tests to compare a previously validation enrolled voice print with the voiceprint generated from different __________________ phrases spoken at the time of verification Voice Print A term that relates to the voice biometric stored and registered to __________________ a particular merchant, consumer or end user account

Claims

Claims The following claims relate to the processes detailed in the

diagrammatic representation and abstract.

1. The process of creation of a secure account tied to a voice biometric capable of use in financial transactions processing by consumers, end users and merchants to enable the creation of a transaction guaranteed against repudiation is unique.

2. The process of authorisation Call-Backs or Call To's to initiate collection of a voice biometric data for authorisation using voice over the internet protocol, SIP directory servers and, or conversion of messaging to access proprietary networks to confirm the creation of a transaction guaranteed against repudiation is unique 3. The process of authorising by voice biometric and concurrently guaranteeing payment for any type of financial transaction against repudiation is unique.

4. The process of authonsation by voice biometric the parties to an escrow transaction prior to financial settlement to confirm the creation of a transaction guaranteed against repudiation is unique.