Method and system for authorizing a commercial transaction

[0001] The present invention relates to a method and a system for authorizing a commercial transaction between a customer and a goods or service provider via an authorization service provider, the transaction including authentication of the customer by comparing a biometric sample of the customer with a biometric model of the customer stored with the authorization service provider.

[0002] Due to the comprehensive use of electronic data processing systems for financial transactions, systems for identifying and/or authenticating persons prior to the implementation of commercial transactions are becoming more and more important. The identification of a person, which is usually necessary at the beginning of the process, serves the purpose of determining the identity of the person in question. Authentication is generally defined as a control process which takes place after identification and with which it can be ascertained whether the information given by the person in the course of identification is correct; it thus serves the purpose of verifying the identity of the person.

[0003] At present, two “token”-based methods are customary in financial transactions. In this context, tokens are defined as key objects used in the identification/authentication process, i.e. primarily the conventional magnetic-strip or chip cards. When customers are prepared to pay, they identify themselves with their bank card or credit card on which the customer's signature is shown, and in which a usually four-digit personal identification number (PIN) is stored that is known only to the customer.

[0004] With the first customary method, customers must provide a signature with the salesperson in attendance, and authentication is made visually by comparing the customer's signature with the signature shown on the card. This method is often proving to be unsatisfactory due to its imminent flaws caused by the fact that with the variety of writing utensils and on different writing surfaces, signatures can vary and are often quite easy to forge. Furthermore, the sales staff is often negligent in checking the signatures.

[0005] In addition, it may happens, for example in restaurants, that fraudulent personnel can, in a short time span and unnoticed, use a customer's credit card to create an illegal copy on which a transaction unauthorized by the customer is later written.

[0006] With the second customary method, customers authenticate themselves by inserting their PIN unseen by others in a card reader installed by the goods or service provider, which is connected via a communication network with the financial institution carrying out the desired transaction, and which authorizes this transaction when the PIN entered by the customer is identical to the PIN stored in the card.

[0007] However, the principle of personal identification numbers has several disadvantages, some of which will be explained briefly below.

[0008] A person's PIN, which is not context-related but chosen purely at random, is usually written down by the customer in a presumably secure place, such as a note pad or an appointment calendar, since otherwise the customer may forget the PIN as time goes on. However, writing down the personal identification number is risky, because there is, of course, always the danger of losing the note pad or appointment calendar. As a result, the personal identification number is irretrievably lost, and the owner must apply for a new bank card or credit card with a new personal identification number, which is usually connected with an inordinate amount of administrative work, is time-consuming and often also expensive.

[0009] Furthermore, there is a risk of card abuse when a third party comes into possession of a PIN or password. This can happen when a person is surreptitiously watching the owner as he enters the PIN, or when documents such as notebooks or appointment calendars (in which such personal identification numbers are usually written) are stolen together with the bank card or credit card, or if the unauthorized person loses them, and another person finds them and makes unauthorized use of them.

[0010] Unreasonably, consumers often write their PIN directly on the bank card or credit card, so that thieves, when they steal the card, automatically are in possession of the PIN which allows them to make a false authentication. Neither can it be ruled out that a card thief uses electronic means to obtain knowledge of the PIN stored in a card.

[0011] In a newer class of authentication methods are so-called biometric methods that utilize electronic evaluation of physiological characteristics such as fingerprints, iris patterns of the eye, or individual voice characteristics (the so-called voice prints). These have the advantage that customers do not have to carry any cards or other tokens of any kind.

[0012] WO 98/09227 discloses a method and a system for authorizing commercial transactions between a customer and a vendor without the use of an authentication token, whereby the buyer signals his acceptance of the vendor's offer to implement the transaction by entering his personal authentication information, consisting of a PIN and one or more biometric samples, which are then transmitted to a computer system which compares the received authentication information of the buyer with biometric samples acquired in a registration process. If the computer system successfully identifies the buyer, the buyer's account is debited by an amount that is credited to the vendor's account, and the result of the transaction is transmitted to the vendor as well as to the buyer.

[0013] As possible biometric samples to be used, the above patent names a fingerprint of the buyer, an image of the buyer's iris, and the buyer's voice print. As an antidote against theft of the biometric information (in case of a voice print, it might be possible, for example, to secretly record the buyer's voice), WO 98/09227 proposes that the buyer change his PIN that is assigned to the biometric information in the computer's memory. This means that after a theft of the biometric information has occurred, the PIN assumes the task not only of identifying the buyer, but also indirectly of the authentication. With a finite number of digits for the PIN, it would therefore be possible with no more than 10ⁿ tries, using the stolen biometric information, to accomplish a wrong authentication and thus a fraudulent transaction.

[0014] In general, it should be considered that computer systems communicating via a public communication system are always subject to the risk of manipulation by unauthorized third parties entering the system. If an attempt is made to obtain unauthorized access to a computer system via a publicly accessible network, the manipulator often proceeds by continuously repeated automated dialing (called spamming) of the attacked system. Even if the manipulator were unsuccessful in entering the attacked system, such continuous dialing does interfere with the attacked system's communication and can even lead to the breakdown of its regular communication functions, i.e. the processing of authorized transactions could be interrupted.

[0015] To prevent manipulation, it is also desirable that the electronic communication means installed by the vendor is subject to authentication by the computer system undertaking the transaction.

[0016] It is an object of the present invention to create a method and a system for authorizing commercial transactions between a buyer and a vendor which provides greater protection against the use by a third party of illegally obtained biometric samples of a person registered as a buyer, as well as against electronic attacks by means of automated continuous dialing (spamming), the method and system furthermore able to ensure the safe identification and authentication of the vendor's connection without the use of a PIN (which has the above described disadvantages), and which can be implemented with a manageable degree of technical complexity.

[0017] This objective is achieved by providing a method and a system for authorizing a commercial transaction between a customer and a goods or service provider via an authorization service provider, the method and system including the authentication of the customer by comparing a biometric sample of the customer with a biometric model of the customer stored with the authorization service provider, wherein a telephone link is established between the goods or service provider and the authorization service provider via a router which assigns the real telephone number of the authorization service provider to a virtual telephone number and transmits the vendor's telephone number and a code which is calculated simultaneously by the router and the authorization service provider by means of the same algorithm,

[0018] wherein the telephone link is accepted by the authorization service provider when the vendor is registered with the authorization service provider under the transmitted telephone number, and when the transmitted code is identical to the code calculated by the authorization service provider,

[0019] wherein an identifier to identify the customer and a biometric sample of the customer are transmitted by the customer to the authorization service provider via the established telephone link,

[0020] wherein further the amount to be transferred and any other data which might be necessary for the transaction are transmitted by the customer to the authorization service provider via the established telephone link, and

[0021] wherein the transaction is initiated by the authorization service provider when correspondence between the biometric sample and the stored biometric model of the customer is greater than a predetermined threshold value.

[0022] In this context, a telephone link is defined as a connection via a network suitable for telephone transmission or via a radio network, and consequently a telephone is defined generally as a device suitable for telephone transmission, and a telephone network is defined as a network suitable for telephone transmission or a radio network, such as an ISDN network or a UMTS network, or the Internet.

[0023] An advantage of the invention is that the customer does not have to carry a “token” of any kind, such as a memory card, but that the handling of a payment transaction is just as easy as with a conventional credit card, which means that the invention has the effect of a “virtual credit card” without the risk of losing a real credit card or having it stolen.

[0024] In a preferred embodiment of the invention, the biometric sample consists of a sequence of words repeated by the customer, that has previously been conveyed to the customer by the authorization service provider via the established telephone link; the stored biometric model of the customer consists of a voice print of the customer; and verification of whether the repeated sequence of spoken words and the stored voice print correspond is based on individual voice peculiarities which are characteristic for the speaker, and initiation of the transaction by the authorization service provider can proceed only when the repeated sequence of words consists of the same words in the same order as the predetermined sequence (string) of words. The participant does not know the string of spoken words prior to the authentication process, since it changes with each new authentication process, which means that unauthorized voice recordings cannot be used for authentication.

[0025] An advantage of this embodiment of the invention is that the unauthorized listening to or recording of an authentication process no longer presents a security risk, since the string of spoken words necessary for authentication changes from one authentication process to another. Another advantage of this embodiment of the invention is that by using the telephone to enter the voice sample required for authentication, no expensive additional installations, such as a fingerprint scanner, are necessary.

[0026] In another advantageous embodiment of the invention, the customer transmits the biometric sample via a video telephone installed by the vendor, whereby the biometric sample consists of an electronic image of the customer's face, with which the biometric model, namely a stored electronic image of the customer's face, is compared.

[0027] In a preferred embodiment of the invention, the identifier as well as the data required for the transaction are entered by voice. Preferably, the identifier is the customer's name, so that the customer does not have to remember a number or the like.

[0028] In another preferred embodiment of the invention, initiation of the transaction is communicated directly to the vendor by the authorization service provider, for example via a fax message, an e-mail message or an SMS (short-message service) message, which means that the vendor can, for example, hand over merchandise to the customer immediately with the assurance that the appropriate payment has already been made. Advantageously, the buyer also receives immediate confirmation that the transaction has been initiated, preferably via the already established telephone link.

[0029] To avoid a continuous electronic dialing of the authorization service provider by unauthorized third parties, the link to the authorization service provider for all new authorization processes is effected preferably via an electronic transmitter by means of a virtual switch to real telephone numbers of the authorization service provider that change regularly, for example in 15-minute intervals. The use of such a virtual switch also has the advantage that the security of the link is increased, for example, when sections of the public telephone network fail due to a defect.

[0030] The invention has the advantage that the registration process, i.e. the process of initially depositing a voice sample as the reference voice pattern or to create an image of the customer's face, can be very easy and also very safe for the customer. This can be done, for example, by telephone or video telephone from a bank, post office or government office after the customer has identified himself. The institution or agency in question would subsequently confirm the registration process for the authorization service provider. It is also conceivable that customers may register by telephone from their home, with a subsequent written confirmation.

[0034] Described below is the authorization of a commercial transaction between a customer and a goods-or-service provider (GSP) by an authorization service provider, the authorization including authentication of the customer by comparing a voice sample with a voice pattern stored with the authorization service provider, according to an embodiment of the inventive system shown schematically in FIG. 1 and in accordance with an embodiment of the method, as shown schematically in FIGS. 2a and 2b.

[0035] The customer 1 who is ready to pay at the goods or service provider's telephone set 2, is connected via the telephone network 4 with the authorization service provider 5 by a router 3 installed on the vendor's side. To dial the authorization service provider 5, the router 3 assigns the real telephone number of authorization service provider 5 to a virtual telephone number (step 102 in FIG. 2a). The connection (link) with the authorization service provider 5 is transmitted by a virtual switch 6 to the real telephone number of the authorization service provider 5 via an electronic transmitter (step 103 in FIG. 2a). The real telephone number changes regularly, for example at 15-minute intervals, to prevent the continuous electronic dialing of the authorization service provider 5 by unauthorized third parties (“spamming”). The number of the vendor's telephone set 2 is transmitted to the authorization service provider 5 as a so-called CLIP (calling line identification presentation) and a code calculated by the router 3 installed on the vendor's side (step 105 in FIG. 2a). The code is produced simultaneously with the same algorithm by a connection means 7 of the authorization service provider 5 (step 104 in FIG. 2a). The connection means 7 of the authorization service provider 5 checks the code and the CLIP (step 106 in FIG. 2a) and accepts the connection only if the CLIP can be assigned to a data set stored in a memory 11 registered with the authorization service provider 5, and if the transmitted code coincides with the code calculated by the authorization service provider 5. If this is not the case, the connection is not accepted (step 107 in FIG. 2a). Otherwise, the customer 1 is requested via a voice output unit 8 to speak his full name (first and last name)—step 108 in FIG. 2a.

[0036] The customer 1 speaks his full name into telephone 2 (step 109 in FIG. 2a), and the name is transmitted via the telephone network 4 and received by connection means 7. Voice recognition unit 9 implemented by the authorization service provider 5 converts the digitized sound print of the name of the customer 1 into the customer's name. A control and evaluation unit 10 checks whether a reference voice pattern has been stored in memory 11, which pattern can be assigned to the name provided (step 110 in FIG. 2a). If this is not the case, the authentication process is aborted (step 107 in FIG. 2a) and the customer 1 is connected with an operator who may initiate further steps, for example elimination of any technical problems. If a reference voice pattern exists in memory 11, that can be assigned to the name that has been provided, this reference model is downloaded from the memory (step 111 in FIG. 2a). If, in the case of several identical names, several voice patterns exist which could be assigned to the name, all of them are downloaded. Since the customer 1 has stated his/her full name, it is unlikely that a large number of different voice patterns exists that could be potentially assigned.

[0037] The control and evaluation unit 10, via voice output unit 8, generates a previously unknown string (sequence) of words (step 112 in FIG. 2a) that is transmitted to the customer 1 via telephone network 4 (step 113 in FIG. 2a). The customer 1 repeats the string of words into telephone 2 as a voice sample (step 114 in FIG. 2b) which is then transmitted via telephone network 4 and received by the connection means 7 of the authorization service provider 5. The voice recognition unit 9 of the authorization service provider 5 analyzes whether the digitized string of words consists of the same words in the same order as the string of words generated by the control and evaluation unit 10 via the voice output unit 8 (step 115 in FIG. 2b). If this is not the case, the authorization process is aborted (step 117 in FIG. 2b) and the customer 1 is connected with an operator who may initiate further steps, such as the elimination of technical problems. Otherwise, the process is continued.

[0038] A text-independent voice recognition unit 12 of the authorization service provider 5 compares the digitized string of words with the loaded reference voice pattern or where several voice patterns have been loaded because of several identical names, with the voice pattern loaded first—for individual voice peculiarities which are characteristic for a speaker (step 119 in FIG. 2b). If correspondence between the digitized string of words and the reference voice pattern of the customer 1 with regard to individual voice peculiarities characteristic for a speaker is less than a predetermined threshold value, the control and evaluation unit checks whether another downloaded reference model exists (step 116 in FIG. 2b). If no other loaded reference voice pattern exists, the authorization process is aborted (step 117 in FIG. 2b) and the customer 1 is connected with an operator who may initiate further steps such as the elimination of technical problems.

[0039] If correspondence between the digitized string of words and the customer's reference voice pattern with regard to the speaker's characteristic individual voice peculiarities is less than a predetermined threshold value, but other loaded reference voice patterns exist, the next loaded reference voice pattern is used (step 118 in FIG. 2b) and examined for individual voice peculiarities characteristic for a speaker (step 119 in FIG. 2b). If need be, this loop is followed several times until either no further loaded voice pattern exists or correspondence between the digitized string of spoken words and the customer's reference voice pattern in terms of individual voice peculiarities characteristic for the speaker is greater than a predetermined threshold value.

[0040] If correspondence between the digitized string of words and the reference voice pattern of the customer 1 in terms of speaker's individual voice peculiarities is greater than a predetermined threshold value, a request to name the amount to be transferred and, if necessary, any further data required for the transaction to be authorized is generated via the voice output unit 8 (step 120 in FIG. 2b) and transmitted to the customer 1 via the telephone network 4. The customer 1 at telephone 2 states the amount to be transferred and, if necessary, any further information required for the transaction to be authorized (step 121 in FIG. 2b). This information is transmitted via the telephone network 4, received by the connection means 7 and translated by the voice recognition unit 9 into a form that can be processed by the control and evaluation unit 10.

[0041] The control and evaluation unit 10 causes the voice output unit 8 to repeat the amount (step 122 in FIG. 2b) and to check back with the customer whether the amount to be transferred and any further information required for the transaction to be authorized were understood correctly. This check-back question is transmitted to the customer 1 via the telephone network 4. If the customer 1 confirms that the information is correct (step 123 in FIG. 2b), the transaction is initiated by the control and evaluation unit 10 (step 124 in FIG. 2b), the customer 1 is notified of this via the telephone network 4 in the form of a message generated by the voice output unit 8 (step 125 in FIG. 2b), and the vendor immediately receives a message about the initiation of the transaction on his fax machine 13 (step 126 in FIG. 2b). Otherwise, the customer 1 is connected with an operator who will then be able to initiate the proper steps for authorizing the transaction.

Drawing Legends:

[0042]

FIG. 1
3 =	router
4 =	telephone network
6 =	virtual switch
7 =	connection means
8 =	voice output unit
9 =	voice recognition unit
10 =	control and evaluation unit
11 =	memory
12 =	text-independent voice recognition unit
13 =	fax machine
FIG. 2a
101	start of authorization process
102	assignment of virtual telephone number/real telephone number by
	the router
103	transmission of the connection [link?] via virtual switch
104	simultaneous core calculation by router and authorization service
	provider
105	transmission of code and CLIP
106	code and CLIP correct? Nein = no/ja = yes
107	abortion of process
108	customer is requested to speak his name
109	customer enters his name
110	do = 1 reference voice patterns exist? Nein = no/ja = yes
111	load reference voice pattern
112	generate new string of words
113	transmit string of words
FIG. 2b
114	customer enters voice sample
115	string of words identical? Nein = no/ja = yes
116	further reference voice pattern loaded? Ja = yes/nein = no
117	abortion of process
118	use next loaded reference voice pattern
119	do voice peculiarities correspond? no/yes
120	request to enter amount
121	customer enters amount by voice
122	voice output unit: repeat amount
123	confirmation by customer? Nein = no/ja = yes - - - 125 referral
	to an operator*
124	initiation of transaction
125	customer is notified
126	vendor is notified
*(note: duplication of reference number 125, the “referral to an operator” is not numbered in the disclosure)