# US 8,752,125 B2 · Authentication method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,125 B2 - Document ID: US8752125B2 - Status: Granted - Kind: B2 - Application number: 11/665,719 - Filed: 2005-10-19 - Published: 2008-02-21 - Granted: 2014-06-10 - Earliest claimed: 2004-10-20 - Assignees: Salt Group Pty Ltd - Applicants: Chris Baharis; Ross Oakley - Inventors: Chris Baharis; Ross Oakley - Web page: https://patentgrep.com/patent/US8752125B2 ## CPC - H04L 9/3271: {using challenge-response} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04W 12/06: Authentication - H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash - H04L 2209/80: Wireless - H04L 2463/102: applying security measure for e-commerce - H04W 88/02: Terminal devices - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract There is disclosed an authentication method comprising requesting a user of a personal mobile terminal to enter a personal code into a personal mobile terminal in response to receipt of an authentication request transmitted to the personal mobile terminal, the authentication request being related to an action that requires user authentication, and processing an entered personal code together with challenge data corresponding to the authentication request to determine whether one or more predetermined conditions are met and, if one or more predetermined conditions are met, producing a valid and signed authentication code that the user can provide in order to authenticate the action. ## Claims ### Claim 1 An authentication method comprising: requesting a user of a personal mobile terminal to enter a personal code into the personal mobile terminal in response to receipt of an authentication request transmitted to the personal mobile terminal, the authentication request including transaction data of an action that requires user authentication; displaying the transaction data on a display of the personal mobile terminal to enable the user to apprehend that the authentication request validly relates to transaction details of the action; and processing an entered personal code together with challenge data derived from the transaction data contained in the authentication request to determine whether one or more predetermined conditions are met and, if one or more predetermined conditions are met including that the personal code is correct, producing a valid and signed authentication code from the challenge data that the user can provide in order to authenticate the action; whereby the transaction data which is displayed on the display of the mobile terminal is tied to said valid and signed authentication code and the authentication code is also tied to the user through entry of the correct personal code. ### Claim 2 (depends on 1) An authentication method as claimed in claim 1, comprising transmitting challenge data to said personal mobile terminal as part of said authentication request. ### Claim 3 (depends on 1) An authentication method as claimed in claim 1, comprising generating, at said personal mobile terminal, challenge data corresponding to at least part of said authentication request. ### Claim 4 (depends on 1) An authentication method as claimed in claim 1, comprising also processing the entered personal code together with at least one key stored on the mobile phone. ### Claim 5 (depends on 4) An authentication method as claimed in claim 4, wherein at least one of said one or more predetermined conditions is that the key is correct. ### Claim 6 (depends on 1) An authentication method as claimed in claim 1, wherein the transaction data is only displayed after the personal code is entered. ### Claim 7 (depends on 1) An authentication method as claimed in claim 1, further comprising: transmitting the authentication request to a personal mobile terminal designated as belonging to a user in response to the initiation of an action that requires authentication by the user; and receiving the authentication code from the user; authenticating the action upon the authentication code being valid. ### Claim 8 (depends on 7) An authentication method as claimed in claim 7, wherein the action is a transaction initiated by the user. ### Claim 9 (depends on 8) An authentication method as claimed in claim 8, wherein the transaction is a banking transaction. ### Claim 10 (depends on 8) An authentication method as claimed in claim 8, wherein the transaction is an order for a product or service. ### Claim 11 (depends on 7) An authentication method as claimed in claim 7, wherein the action is a transaction initiated by an entity whose actions require authorization by said user. ### Claim 12 (depends on 1) A method as claimed in claim 1, further comprising configuring a personal mobile terminal by: providing an activation code to a user by a means independent of the user's personal mobile terminal; placing a security application on a web server for retrieval by the user's personal mobile terminal; providing details of the security application to the user that are sufficient for the user to retrieve the security application; running the security application on the user's personal mobile terminal in order to prompt the user for the activation code and to generate a confirmation code if the activation code is entered into the personal mobile terminal; and providing the confirmation code to the authentication system; and activating the user if the confirmation code is valid. ### Claim 13 (depends on 12) A method as claimed in claim 12, wherein the confirmation code is provided by a means independent of the user's personal mobile terminal. ### Claim 14 (depends on 12) A method as claimed in claim 12, wherein the user initiates a configuration of the user's personal mobile terminal by accessing the web server. ### Claim 15 (depends on 12) A method as claimed in claim 12, wherein the security application is personalized for said user. ### Claim 16 (depends on 1) A method as claimed in claim 1, comprising displaying the transaction data to the user prior to the user entering the personal code. ### Claim 17 (depends on 16) A method as claimed in claim 16, comprising automatically transmitting the authentication code after it is produced. ### Claim 18 (depends on 1) A method as claimed in claim 1, further comprising displaying transaction details corresponding to the transaction data on a display independent of the mobile terminal display. ### Claim 19 (depends on 1) A method as claimed in claim 1, wherein the challenge data comprises a cryptographic hash of the transaction data. ### Claim 20 (depends on 19) A method as claimed in claim 19, comprising signing the cryptographic hash with a private key stored on the mobile terminal to produce the authentication code. ### Claim 21 A computer program stored on a web server for downloading to a mobile terminal, that, when executed by a personal mobile terminal, enables the personal mobile terminal to: request a user of the mobile terminal to enter a personal code following receipt of an authentication request transmitted to the mobile terminal, the authentication request including transaction data of an action that requires user authentication; display the transaction data on a display of the personal mobile terminal to enable the user to apprehend that the authentication request validly relates to transaction details of the action; process an entered personal code together with challenge data derived from the transaction data contained in the authentication request; and produce a valid and signed authentication code from the challenge data that the user can provide in order to authenticate the action if one or more predetermined conditions are met, including that the personal code is correct; whereby the transaction data which is displayed on the display of the mobile terminal is tied to said valid and signed authentication code and the authentication code is also tied to the user through entry of the correct personal code. ### Claim 22 (depends on 21) A computer program stored on a web server as claimed in claim 21, that enables a personal mobile terminal to process challenge data transmitted to said personal mobile terminal as part of said authentication request. ### Claim 23 (depends on 21) A computer program stored on a web server as claimed in claim 21, wherein said computer program generates, at said personal mobile terminal, challenge data corresponding to at least part of said authentication request. ### Claim 24 (depends on 21) A computer program stored on a web server as claimed in claim 21, wherein the computer program enables the personal mobile terminal to process the entered personal code together with at least one key stored on the mobile phone. ### Claim 25 (depends on 24) A computer program stored on a web server as claimed in claim 24, wherein at least one of said one or more predetermined conditions is that the key is correct. ### Claim 26 (depends on 21) A computer program stored on a web server as claimed in claim 21, wherein the transaction data is only displayed after the personal code is entered. ### Claim 27 (depends on 21) A computer program stored on a web server as claimed in claim 21, wherein the computer program is arranged to be automatically executed by the personal mobile terminal upon receipt of the authentication request. ### Claim 28 (depends on 21) A computer program stored on a web server as claimed in claim 21, that causes the personal mobile terminal to automatically provide the authentication code on the user's behalf after completion of processing of the personal code. ### Claim 29 (depends on 21) A computer program as claimed in claim 21, wherein the challenge data comprises a cryptographic hash of the transaction data. ### Claim 30 (depends on 29) A computer program as claimed in claim 29, comprising signing the cryptographic hash with a private key stored on the mobile terminal to produce the authentication code. ### Claim 31 A personal mobile terminal comprising: a request handler arranged to request a user of the mobile terminal to enter a personal code following receipt of an authentication request transmitted to the mobile terminal, the authentication request including transaction data of an action that requires user authentication; a data display engine arranged to display the transaction data on a display of the personal mobile terminal to enable the user to apprehend that the authentication request validly relates to transaction details of the action; and a data crypto engine arranged to process an entered personal code together with challenge data derived from the transaction data contained in the authentication request to determine whether one or more predetermined conditions are met, including that the personal code is correct, and produce a valid and signed authentication code from the challenge data that the user can provide in order to authenticate the action if the one or more predetermined conditions are met; whereby the transaction data which is displayed on the display of the mobile terminal is tied to said valid and signed authentication code and the authentication code is also tied to the user through entry of the correct personal code. ### Claim 32 (depends on 31) A personal mobile terminal as claimed in claim 31, wherein the challenge data comprises a cryptographic hash of the transaction data. ### Claim 33 (depends on 32) A personal mobile terminal as claimed in claim 32, comprising signing the cryptographic hash with a private key stored on the mobile terminal to produce the authentication code. ### Claim 34 A system for authenticating actions comprising: an action authentication server; and one or more personal mobile terminals belonging to respective ones of one or more users of the system, the action authentication server being configured to transmit an authentication request to a personal mobile terminal of a user in response to initiation of an action requiring authentication by a user, the authentication request including transaction data of the action; each users' personal mobile terminal being configured to: request the user of the personal mobile terminal to enter a personal code following receipt of the authentication request; display the transaction data on a display of the personal mobile terminal to enable the user to apprehend that the authentication request validly relates to transaction details of the action; process an entered personal code together with challenge data derived from the transaction data contained in the authentication request corresponding to the authentication request; and produce a valid and signed authentication code from the challenge data that the user can provide in order to authenticate the action if one or more predetermined conditions are met, including that the personal code is correct; whereby the transaction data which is displayed on the display of the mobile terminal is tied to said valid and signed authentication code and the authentication code is also tied to the user through entry of the correct personal code. ### Claim 35 (depends on 34) A system as claimed in claim 34, wherein the action authentication server is configured to receive the authentication code and authenticate the action if the authentication code is valid. ### Claim 36 (depends on 34) A system for authenticating actions as claimed in claim 34, wherein the challenge data comprises a cryptographic hash of the transaction data. ### Claim 37 (depends on 36) A system for authenticating actions as claimed in claim 36, comprising signing the cryptographic hash with a private key stored on the mobile terminal to produce the authentication code.