SIMCARD AUTHORIZATION: ONLINE CREDIT CARD TRANSACTION APPROVAL, PRIVACY, AUTHENTICATION AND NON-REPUDIATION

AUTORISATION PAR CARTE SIM (MODULE D'IDENTITE DE L'ABONNE) : AUTORISATION DE TRANSACTION PAR CARTE DE CREDIT EN LIGNE, CONFIDENTIALITE, AUTHENTIFICATION ET NON-REPUDIATION

English Abstract

Subscriber identity module (SIM) Card authorization is a mechanism
that provides for a very strong authentication and non-repudiation
as well as greater privacy and personal data encapsulation in an
online purchase transaction. The objective of the SIM card
authorization is to use a SIM card as a credit card, the mobile
equipment as the credit card reader and identification challenger
to the user, and user's private key stored on the SIM for user's
digital signature, thus transforming the device and the
encompassing components and capabilities into a strong electronic
online authentication device.

Description

Trustshield - patent 2 - DESCRIPTION.txt
DESCRIPTION
Subscriber identity module (SIM) Card authorization is a mechanism
that provides for a very strong authentication and non-repudiation
as well as greater privacy and personal data encapsulation in an
online purchase transaction. The objective of the SIM card
authorization is to use a SIM card as a credit card, the mobile
equipment as the credit card reader and identification challenger
to the user, and user's private key stored on the SIM for user's
digital signature, thus transforming the device and the
encompassing components and capabilities into a strong electronic
online authentication device.
The mechanism provides for a new method of payment for online
transactions using a credit card of choice based on existing
online payment infrastructure. An online shopper need only provide
their mobile phone number at checkout time. A crypto short message
service (SMS) is sent to the user's mobile requesting credit card
payment information, user's information, digital signature as well
as user's explicit approval of the transaction. All data is stored
on the SIM card residing in the user's mobile equipment.
MODE OF OPERATION
SIM Card authorization is based on the premise of explicit
identification, authentication and the production of a
non-repudiated bill, by using two factors:
Something that you have: The SIM card in the mobile equipment as a
tamper proof device that encapsulates user's information, credit
card data and private key.
Something that you know: The PIN number used to sign into the
private key locally and challenged by the mobile equipment.
By achieving the above identification, authentication and
non-repudiation objectives, SIM Card authorization transforms the
nature of an online transaction using a credit card from a "Card
Absent" transaction into a much secure "Card Present" transaction,
SIM card being user's credit card and the PIN to the private key
being the first level authentication factor. SIM Card
authorization also achieves greater privacy for the user, as the
credit card data remains unknown to the online merchant; only the
authorization number is forwarded.
Network operator deploys an applet over the air to the mobile
equipment (ME)to install on the SIM card using the network
infrastructure with the proper access signature for AIM card file
Page 1
CA 02363220 2001-11-23

Trustshield - patent 2 - DESCRIPTION.txt
system authorized access.
The ME user would uses the applet installed on the SIM card to
enter the credit card data of choice, download the digital
signature and set the appropriate PIN number.
Online merchants would incorporate an SIM Card authorization
application programmer interface (API) into their payment
application interface. At payment time, user provides only their
mobile phone number, the number as well as the bill data is fed
into the API, which makes an secure socket layer (SSL), based
request to the an intermediate payment proxy/SMS gateway. SIM
Card authorization server forwards bill through crypto short
message service (SMS) -using a CA private key- to the mobile
equipment corresponding to that number. The applet already
deployed on the SIM card is enabled through the SMS download. The
applet decrypts the SMS using the certification authority (CA)
public key. The applet displays the contents of the bill to the
user, asks for approval, when granted, the user is challenged to
the PIN associated with his private key residing on the SIM card
and only accessible through the PIN. Once successful, the
digitally signed message is sent through crypto SMS-using CA
public key- back to the gateway, which verifies it and forwards it
to the original third party payment gateway the online merchant
originally uses, once an authorization number is received from the
third party payment gateway, it is forwarded back to the merchant
and thus, the transaction is concluded. SIM Card authorization
maintains the current online payment topology; SIM Card
authorization proxy gateway acts as a merchant to the payment
gateway and acts as a payment gateway to the merchant. The mobile
network operator ensures the appropriate certificate issuance and
identity verification of the mobile user based on subscriber data
warehouse already verified at service initiation time.
Figure #1 provides a visual overview of the mode of operation.
The SIM Card authorization mechanism shields user's private data
from the online merchant thus ensuring the privacy of user's data
as well as diminishing the risk of private data loss due to
unauthorized access when data is stored at merchant site.
The mechanism also greatly simplifies the payment process which
otherwise involves extensive data entry from the part of the user.
The greatest advantage of SIM Card authorization is the
transformation of nature for an online transaction from a highly
fraud prone and highly costly "Card Absent" type to the much more
secure and much less costly "Card Present" type. Thus delivering
great savings to the online merchant.
Page 2
CA 02363220 2001-11-23

Trustshield - patent 2 - DESCRIPTION.txt
Figure 2 is a Comparative chart of current credit card transaction
types vs. proposed mechanisim.
Page 3
CA 02363220 2001-11-23

Representative Drawing