# US 8,789,161 B2 · Device and method for authenticating a transaction with a data processing apparatus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,161 B2 - Document ID: US8789161B2 - Status: Granted - Kind: B2 - Application number: 13/103,607 - Filed: 2011-05-09 - Published: 2011-08-25 - Granted: 2014-07-22 - Earliest claimed: 2002-10-17 - Assignees: Vodafone Group PLC - Applicants: David Jeal; Charles William Debney - Inventors: David Jeal; Charles William Debney - Web page: https://patentgrep.com/patent/US8789161B2 ## CPC - G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards - G06F 21/12: Protecting executable software - G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets} - G06F 21/35: communicating wirelessly - G06K 7/10237: {the reader and the record carrier being capable of selectively switching between reader and record carrier appearance, e.g. in near field communication [NFC] devices where the NFC device may function as an RFID reader or as an RFID tag} - G06Q 20/1235: {with control of digital rights management [DRM]} - G06Q 20/305: {using wired telephone networks} - G06Q 20/341: {Active cards, i.e. cards including their own processing means, e.g. including an IC or chip} - G06Q 20/3552: {Downloading or loading of personalisation data} - G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists - G06Q 20/4014: {Identity check for transactions} - G06Q 20/40975: {using encryption therefor} - G07F 7/0886: {the card reader being portable for interacting with a POS or ECR in realizing a payment transaction} - G07F 7/1008: {Active credit-cards provided with means to personalise their use, e.g. with PIN-introduction/comparison system} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 2463/102: applying security measure for e-commerce - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06K: GRAPHICAL DATA READING (image or video recognition or understanding G06V); PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G07F: COIN-FREED OR LIKE APPARATUS (coin sorting G07D3/00; coin testing G07D5/00; {handling coins or paper currencies apart from payment activated apparatus G07D; payment architectures, schemes or protocols G06Q20/00}) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A device or “dongle” (30) is provided for controlling communications between a Subscriber Identity Module (for SIM) (12), such as of the type used in a GSM cellular telephone system, and a computer, such as a WINDOWS® operating system-based PC (10). The SIM (12) can be authenticated by the telephone network, in the same way as for authenticating SIMs of telephone handset users in the network, and can in this way authenticate the user of the PC (10) or the PC (10) itself. Such authentication can, for example, permit the use of the PC (10) for a time-limited session in relation to a particular application, which is released to the PC (10), after the authentication is satisfactorily completed. The application may be released to the PC (10) by a third party after and in response to the satisfactory completion of the authentication process. A charge for the session can be debited to the user by the telecommunications network and then passed on to the third party. The dongle (30) provides additional security for the authentication data stored on the SIM by requiring a PIN to be entered and/or by only being responsive to requests received from the PC (10) which are encrypted using a key, which requests are generated by a special PC interface driver (38). ## Claims ### Claim 1 A device for connection to a data processing apparatus, the device comprising: a first interface operatively coupled to an authentication storage means, the authentication storage means being registered with a telecommunications system and storing predetermined authentication information that is respectively associated with a subscription of a user with the telecommunications system, the predetermined authentication information corresponding to information used for authenticating a telecommunications terminal that is respectively used in association with the subscription of the user with the telecommunications system for conducting communications in the telecommunications system, the telecommunications system including an authenticating means that maintains a correspondence between the information used for authenticating the telecommunications terminal and the subscription of the user with the telecommunications system; a second interface configured to connect to the data processing apparatus; and an interface driver that, upon the first interface operatively coupling to the authentication storage means and the second interface connecting to the data processing apparatus, controls access to the predetermined authentication information and, in response to an input message transmitted in a communication session established between the data processing apparatus and the authenticating means included within the telecommunications system requesting a response that is based on the input message and the predetermined authentication information, enables the authenticating means, via the communication session between the data processing apparatus and the authenticating means included within the telecommunications system, to execute an authentication process for authenticating a transaction by the user with the data processing apparatus, and wherein the authentication process for authenticating the transaction by the user with the data processing apparatus involves use of the predetermined authentication information stored by the authentication storage means, does not require use of the telecommunications terminal that is respectively associated with the subscription of the user with the telecommunications system, and does not require the telecommunications terminal to be authenticated for conducting communications in the telecommunications system using the information used for authenticating the telecommunications terminal that corresponds to the predetermined authentication information that is respectively associated with the subscription of the user. ### Claim 2 (depends on 1) The device of claim 1, further comprising security data entry means for obtaining security data independently of the data processing apparatus, and means for analyzing the entered security data for determining whether to allow access to the predetermined authentication information. ### Claim 3 (depends on 2) The device of claim 2, wherein the security data entry means comprises alphanumeric data entry means. ### Claim 4 (depends on 2) The device of claim 2, wherein the security data entry means comprises a keypad. ### Claim 5 (depends on 2) The device of claim 2, wherein the security data comprises a Personal Identification Number (PIN), and wherein the analyzing means compares the PIN obtained by the security data entry means with a PIN stored on the authentication storage means and only allows access to the predetermined authentication information when the respective PINs match. ### Claim 6 (depends on 1) The device of claim 1, comprising a display for displaying security information. ### Claim 7 (depends on 1) The device of claim 1, wherein the interface driver comprises a data processing module for controlling communication with the data processing apparatus via the second interface. ### Claim 8 (depends on 7) The device of claim 7, wherein the data processing module of the device is configured for communicating with a corresponding data processing module of the data processing apparatus via the second interface. ### Claim 9 (depends on 8) The device of claim 8, wherein communication between the authentication storage means and the data processing apparatus is performed using the respective data processing modules. ### Claim 10 (depends on 7) The device of claim 7, wherein the data processing module of the device includes means for decrypting encrypted data received from the data processing module of the data processing apparatus. ### Claim 11 (depends on 10) The device of claim 10, wherein the respective data processing modules comprise a key for allowing encryption and/or decryption of data. ### Claim 12 (depends on 11) The device of claim 11, wherein the key comprises a shared secret key for each of the respective data processing modules. ### Claim 13 (depends on 7) The device of claim 7, wherein the data processing module of the device includes means for encrypting data transmitted via the second interface to the data processing module of the data processing apparatus. ### Claim 14 (depends on 1) The device of claim 1, in which each subscriber of the telecommunications system is authenticated in the telecommunications system by use of a respective subscriber identity module for the subscriber, and in which the predetermined authentication information that is stored by the authentication storage means and respectively associated with the subscription of the user corresponds to or simulates a respective subscriber identity module for the user. ### Claim 15 (depends on 14) The device of claim 14, wherein the telecommunications system includes means for levying a charge for the transaction when authorised. ### Claim 16 (depends on 14) A device according to claim 14, wherein the respective subscriber identity module for the user is utilized in authenticating the transaction when the subscriber identity module is operable in a mobile terminal. ### Claim 17 (depends on 14) A device according to claim 14, wherein the respective subscriber identity module for the user is further operable to authenticate a mobile terminal for conducting communications in the telecommunications system in association with the subscription of the user with the telecommunications system. ### Claim 18 (depends on 1) The device of claim 1, in which the transaction involves use of data processing functions of the data processing apparatus. ### Claim 19 (depends on 1) The device of claim 1, in which the authentication storage means is integrated with the device. ### Claim 20 (depends on 1) The device of claim 1, in which the authentication process is performed in response to the authenticating means transmitting the input message and receiving the response that is based on the input message and the predetermined authentication information in the communication session. ### Claim 21 (depends on 1) The device of claim 1 in combination with the data processing apparatus. ### Claim 22 (depends on 1) The device of claim 1 in combination with the telecommunications system. ### Claim 23 (depends on 1) A device according to claim 1, wherein the device communicates wirelessly to authenticate the transaction. ### Claim 24 (depends on 1) The device according to claim 1, wherein an authentication unit is registered with the telecommunications system in association with the subscription of the user and corresponds to the information used for authenticating the telecommunications terminal in association with the subscription of the user, and wherein, upon the authentication unit being operatively coupled to the telecommunications terminal, the authentication unit is used in connection with the information used for authenticating the telecommunications terminal to authenticate the telecommunications terminal with the telecommunications system for conducting communications in the telecommunications system in association with the subscription of the user. ### Claim 25 (depends on 24) The device according to claim 24, wherein the predetermined authentication information simulates the authentication unit during execution of the authentication process for authenticating performance of the transaction by the data processing apparatus. ### Claim 26 A method for authenticating a transaction with a data processing apparatus, the data processing apparatus being operatively associated with a security device, the security device being operatively associated with an authentication storage means that is registered with a telecommunications system and stores predetermined authentication information that is respectively associated with a subscription of a user with the telecommunications system, the predetermined authentication information corresponding to information used for authenticating a telecommunications terminal that is respectively used in association with the subscription of the user with the telecommunications system for conducting communications in the telecommunications system, the security device being configured to control access to the predetermined authentication information, the telecommunications system including an authenticating means that maintains a correspondence between the information used for authenticating the telecommunications terminal and the subscription of the user with the telecommunications system, the method comprising: operatively coupling the security device to the authentication storage means and connecting the device to the data processing apparatus; and using the security device to, in response to an input message transmitted in a communication session established between the data processing apparatus and the authenticating means included within the telecommunications system requesting a response that is based on the input message and the predetermined authentication information, obtain the predetermined authentication information from the authentication storage means and enable the authenticating means, via a communication session between the data processing apparatus and the authenticating means included within the telecommunications system, to execute an authentication process for authenticating the transaction by the user with the data processing apparatus that involves use of the predetermined authentication information stored by the authentication storage means, and wherein the authentication process for authenticating the transaction by the user with the data processing apparatus does not require use of the telecommunications terminal that is respectively associated with the subscription of the user with the telecommunications system and does not require the telecommunications terminal to be authenticated for conducting communications in the telecommunications system using the information used for authenticating the telecommunications terminal that corresponds to the predetermined authentication information that is respectively associated with the subscription of the user. ### Claim 27 (depends on 26) The method of claim 26, further comprising obtaining security data independently of the data processing apparatus, and analyzing the security data for determining whether to allow access to the predetermined authentication information. ### Claim 28 (depends on 27) The method of claim 27, wherein the security data is obtained by alphanumeric data entry means. ### Claim 29 (depends on 28) The method of claim 28, wherein the alphanumeric data entry means comprises a keypad. ### Claim 30 (depends on 27) The method of claim 27, wherein the security data comprises a Personal Identification Number (PIN), and wherein the analyzing step compares the PIN obtained by the security data entry means with a PIN stored on the authentication storage means and only allows access to the predetermined authentication information when the respective PINs match. ### Claim 31 (depends on 26) The method of claim 26, further comprising displaying security information. ### Claim 32 (depends on 26) The method of claim 26, wherein communication between the security device and the data processing apparatus is controlled by a data processing module of the security device. ### Claim 33 (depends on 32) The method of claim 32, wherein the data processing module of the security device is configured for communicating with a corresponding data processing module of the data processing apparatus. ### Claim 34 (depends on 33) The method of claim 33, wherein communication between the authentication storage means and the data processing apparatus is performed via the respective data processing modules. ### Claim 35 (depends on 32) The method of claim 32, wherein the data processing module of the security device decrypts encrypted data received from the data processing module of the data processing apparatus. ### Claim 36 (depends on 35) The method of claim 35, wherein the respective data processing modules comprise a key for allowing encryption and/or decryption of data. ### Claim 37 (depends on 32) The method of claim 32, wherein the data processing module of the security device encrypts data transmitted from the security device to the data processing module of the data processing apparatus. ### Claim 38 (depends on 36) The method of claim 36, wherein the key comprises a shared secret key for each of the respective data processing modules. ### Claim 39 (depends on 37) The method of claim 37, wherein the respective data processing modules comprise a key for allowing encryption and/or decryption of data. ### Claim 40 (depends on 26) A method according to claim 26, in which each subscriber of the telecommunications system is authenticated in the telecommunications system by means of use of a respective subscriber identity module for the subscriber, and in which the predetermined authentication information stored by the authentication storage means that is respectively associated with the subscription of the user corresponds to or simulates a respective subscriber identity module for the user. ### Claim 41 (depends on 40) A method according to claim 40, wherein the respective subscriber identity module for the user is utilized in authenticating the transaction when the subscriber identity module is operable in a mobile terminal. ### Claim 42 (depends on 40) A method according to claim 40, wherein the respective subscriber identity module for the user is further operable to authenticate a mobile terminal for conducting communications in the telecommunications system in association with the subscription of the user with the telecommunications system. ### Claim 43 (depends on 26) A method according to claim 26, in which the transaction involves use of the data processing functions of the data processing apparatus. ### Claim 44 (depends on 26) A method according to claim 26, in which the authentication storage means is integrated with the security device. ### Claim 45 (depends on 26) A method according to claim 26, in which the authentication storage means is associated with the data processing apparatus by being associated with data or software for use by that data processing apparatus. ### Claim 46 (depends on 26) A method according to claim 26, in which the authentication process is performed in response to the authenticating means transmitting the input message and receiving the response that is based on the input message and the predetermined authentication information in the communication session. ### Claim 47 (depends on 26) A method according to claim 26, wherein a charge is levied for the transaction when authenticated. ### Claim 48 (depends on 47) A method according to claim 47, wherein levying of the charge is carried out by the telecommunication system. ### Claim 49 (depends on 26) A method according to claim 26, in which the data processing apparatus is a personal computer. ### Claim 50 (depends on 26) A method according to claim 26, wherein the security device communicates wirelessly with the data processing apparatus to enable the authenticating means execute the authentication process. ### Claim 51 (depends on 26) The method according to claim 26, wherein an authentication unit is registered with the telecommunications system in association with the subscription of the user and corresponds to the information used for authenticating the telecommunications terminal in association with the subscription of the user, and wherein, upon the authentication unit being operatively coupled to the telecommunications terminal, the authentication unit is used in connection with the information used for authenticating the telecommunications terminal to authenticate the telecommunications terminal with the telecommunications system for conducting communications in the telecommunications system in association with the subscription of the user. ### Claim 52 (depends on 51) The method according to claim 51, wherein the predetermined authentication information simulates the authentication unit during execution of the authentication process for authenticating performance of the transaction by the data processing apparatus. ### Claim 53 A device, comprising: authentication storage means registered with a telecommunications system and storing predetermined authentication information that is respectively associated with a subscription with the telecommunications system, the predetermined authentication information corresponding to information used for authenticating a telecommunications terminal that is respectively used in association with the subscription with the telecommunications system for conducting communications in the telecommunications system, the telecommunications system including an authenticating means that maintains a correspondence between the information used for authenticating the telecommunications terminal and the subscription with the telecommunications system, a first interface for coupling to a data processing apparatus to provide for the predetermined authentication information to be used to authenticate a transaction to be performed by the data processing apparatus, a security means for controlling access to the predetermined authentication information via the data processing apparatus, and an interface driver that, upon the first interface coupling to the data processing apparatus, in response to an input message transmitted in a communication session established between the data processing apparatus and the authenticating means included within the telecommunications system requesting a response that is based on the input message and the predetermined authentication information, enables the authenticating means, via a communication session between the data processing apparatus and the authenticating means included within the telecommunications system, to execute an authentication process that involves use of the predetermined authentication information stored by the authentication storage means for authenticating performance of the transaction by the data processing apparatus, and wherein the authentication process for authenticating performance of the transaction by the data processing apparatus does not require use of the telecommunications terminal that is respectively used in association with the subscription with the telecommunications system and does not require the telecommunications terminal to be authenticated for conducting communications in the telecommunications system using the information used for authenticating the telecommunications terminal that corresponds to the predetermined authentication information that is respectively associated with the subscription with the telecommunications system. ### Claim 54 (depends on 53) The device of claim 53, wherein the security means comprises means for obtaining security data from a user and means for checking the validity of the security data and only allowing access to the predetermined authentication information if the security data is valid. ### Claim 55 (depends on 53) The device of claim 53, wherein the security means comprises data processing means for receiving an encrypted authentication request, encrypted using a predetermined key, from the data processing apparatus and for decrypting the request. ### Claim 56 (depends on 55) The device of claim 55 in combination with the data processing apparatus, wherein the data processing apparatus comprises means for encrypting the authentication request using said key. ### Claim 57 (depends on 53) A device according to claim 53, wherein the device communicates wirelessly with the data processing apparatus to enable the authenticating means execute the authentication process. ### Claim 58 (depends on 53) The device according to claim 53, wherein an authentication unit is registered with the telecommunications system in association with the subscription with the telecommunications system and corresponds to the information used for authenticating the telecommunications terminal that is respectively used in association with the subscription with the telecommunications system, and wherein, upon the authentication unit being operatively coupled to the telecommunications terminal, the authentication unit is used in connection with the information used for authenticating the telecommunications terminal to authenticate the telecommunications terminal with the telecommunications system for conducting communications in the telecommunications system in association with the subscription with the telecommunications system. ### Claim 59 (depends on 58) The device according to claim 58, wherein the predetermined authentication information simulates the authentication unit during execution of the authentication process for authenticating performance of the transaction by the data processing apparatus. ### Claim 60 A device for connection to a data processing apparatus, the device comprising: a first interface operatively coupled to an authentication storage means, the authentication storage means being registered with a telecommunications system and storing predetermined authentication information that is respectively associated with a subscription of a user with the telecommunications system, the predetermined authentication information corresponding to an authentication unit that is registered with the telecommunications system in association with the subscription of the user and that is used for authenticating a telecommunications terminal to be used in association with the subscription of the user with the telecommunications system for conducting communications in the telecommunications system, the telecommunications system including an authenticating means that maintains a correspondence between information used for authenticating the telecommunications terminal in connection with the authentication unit and the subscription of the user with the telecommunications system; a second interface configured to connect to the data processing apparatus; and an interface driver that, upon the first interface operatively coupling to the authentication storage means and the second interface connecting to the data processing apparatus, controls access to the predetermined authentication information and, in response to an input message transmitted in a communication session established between the data processing apparatus and the authenticating means included within the telecommunications system requesting a response that is based on the input message and the predetermined authentication information, enables the authenticating means, via a communication session between the data processing apparatus and the authenticating means included within the telecommunications system, to execute an authentication process for authenticating a transaction by the user with the data processing apparatus, and wherein the authentication process for authenticating the transaction by the user with the data processing apparatus involves use of the predetermined authentication information stored by the authentication storage means, does not require use of the authentication unit that is registered with the telecommunications system in association with the subscription of the user, and does not require the telecommunications terminal to be authenticated for conducting communications in the telecommunications system using the information used for authenticating the telecommunications terminal.