WO1999045690A1

WO1999045690A1 - Method and device for universal access to telephone networks

Info

Publication number: WO1999045690A1
Application number: PCT/EP1999/000709
Authority: WO
Inventors: Uwe Korst; Clemens Wanko
Original assignee: Deutsche Telekom Ag
Priority date: 1998-03-04
Filing date: 1999-02-03
Publication date: 1999-09-10
Also published as: EP1060607A1; DE19809043A1

Abstract

The invention relates to a method and device for universal protected access to networks, especially to telephone networks, using a calling card system, whereby subscribers must identify themselves to the system. If the identification is correct, the subscriber is granted access to the system. The subscriber receives the desired service which is charged to the identification. A mobile data carrier (1) is used as an identification and automatically sends the I.D., especially in the form of a biometric characteristic, using a specially equipped terminal (2,3) over a switched, mobile or fixed network to a central computer (6) or a unit that verifies identification (8). If the identification characteristics are stored in a mobile data carrier (1), profile evaluation is carried out first in the central computer (6) or identification verification unit (8) to improve security. A plausibility test is, for example, subsequently carried out. This involves checking whether it is possible for the identifier to be present at a specific terminal (2,3). If utilization occurred only a few hours earlier from a remote location, it is highly unlikely that the subscriber is authentic. Once verification of the subscriber's identification proves to be positive, the system automatically provides the subscriber with user facilities that are stored, for instance, in a data base (7) which is connected to the central computer (6).

Description

- 1 -

DESCRIPTION

METHOD AND DEVICE FOR UNIVERSAL AND SECURED ACCESS TO TELEPHONE NETWORKS

The invention relates to a method and a device for universal and secure access to telephone networks with mobile accessibility of the user, in particular to telephone networks according to the preamble of claim 1 for the method and claim 6 for the device.

Switching technology facilities that can be reached by a user via toll-free numbers are generally known today. After successful selection of the switching technology facility, the user must identify himself to the switching technology facility. This is usually done by entering an identification number, for example via the keypad of a telephone, using the tone dialing method or by voice input. Certain features or an existing credit in a certain currency or certain telephone units can be assigned to the identification numbers. The user can then call up the features or the credit after successful identification. An essential feature of this method is that no special terminal is required (tone dialing / voice input is sufficient) and there are no costs on site by dialing in via a toll-free number. Since the identification feature can have a "paid" or "still to be paid" character, the identification can be linked to either a specific fixed credit or an open billing procedure comparable to that of a normal telephone connection. Furthermore, special individual performance features can be linked to each individual identification. - 2 -

These so-called calling card systems are usually based on a central control unit with a corresponding database or a central computer.

A service has been introduced in the USA under the name Virtual Calling Card (VCC), which enables customers to make calls from any telephone by specifying an access code in conjunction with a PIN (Personal Identification Number). The billing is carried out via an account assigned to the customer. This service is also becoming increasingly important in Europe, for example in "Deutsche Telekom AG - Vision" February 1995, pages 44 and 45, the T-Card with Connect Service from Deutsche Telekom is described. This article also states that the range of services extends from the telephone card to the credit card. For example, paragraph 4.1.2.1, starting on page 61 of the book "Chip Cards as a Tool" by Beutelsberger, Kersten and Pfau describes how memory chip cards are checked for authenticity using known challenge-response methods. With these chip cards it is possible with the help of a terminal or card reader to identify the card and check for plausibility. Authentication is carried out in a security module installed in the terminal. For this purpose, the security module receives the chip data and, based on a system key, calculates an individual card key located in the memory chip card. In addition, a method for checking memory chip cards is known from DE 196 04 349 AI, which enables two or more authentication using cryptographic functions and using a terminal. The disadvantage of these described methods and systems is that they require the user to provide an identification feature, for example a card number. For security reasons - 3 -

this card number should be as many digits as possible. The user can specify the ID feature in relation to a machine or an intermediate operator. However, due to the diversity of the ID feature, this procedure is lengthy and complicated in comparison with the usual telephony. The cumbersome handling keeps many potential users from intensive use of so-called calling card systems.

The invention is therefore based on the object of providing a method and a device for universal and secure access to networks, in particular to the telephone network, in which the subscribers identify themselves to a system and the individual usage profile is checked and, after correct identification of the subscribers, access to the System and thus to the desired service, the billing is assigned to the identification, the identification is to be carried out on a mobile basis and / or biometric identifications are used.

The solution according to the invention for the method is characterized in the characterizing part of patent claim 1.

The solution according to the invention for the device is characterized and described in the characterizing part of patent claim 6.

Further solutions or refinements for the method according to the invention are specified in the characterizing parts of patent claims 2 to 5 and for the device in the characterizing part of patent claims 7 to 9.

Although biometric identifications are generally known for security systems of all kinds, the application has - A -

This identification above all has the advantage that biometric features can be stored on chip cards and that after the identification has been entered, a profile evaluation can also be carried out in the central computer. A check is carried out, for example, as to whether it is plausible that the participant can be at the respective input device at all. If a usage took place a few hours earlier from a remote location, then the participant is very likely not authentic. Furthermore, the method and the device according to the invention can be used to check against a usage profile as part of the identification check, that is to say how often, when, from which location, with what turnover and which usage properties are used, for example. This makes CallingCard systems easier and safer to use. The response times to identified security problems are considerably shorter compared to the previous method and the assignment of performance features for identification can now be carried out in the central computer or in a central control unit of the switching equipment.

Further advantages, features and possible uses of the present invention, both for the network operator and the network operations and for the user, result from the following description in connection with the exemplary embodiments shown in the drawing.

The invention is described below with reference to embodiments shown in the drawing. In the description, in the patent claims, in the abstract and in the drawing, the terms and associated reference symbols used in the list of reference symbols given below are used. - 5 -

In the drawing:

Fig. 1 is a schematic diagram for explaining the method according to the invention;

2 shows a further basic illustration to explain the method according to the invention;

3a shows a basic diagram for a

Usage behavior or profile of a participant;

Fig. 3b is a diagram showing the stay of a

Participant in places depending on time and

3c shows a diagram for the services used by customers.

1 shows two terminals 2 and 3, which have a reading device for identifying a subscriber. These terminals 2 and 3 are each used by a mobile data carrier 1 for identification with the system, in particular the calling card system. Alternatively, the biometric identifications shown in principle below, for example, can also be carried out, for example with the aid of iris recognition, with the aid of fingerprint recognition or with the aid of special speech features. Terminal 2 is connected to the calling card system in the present example via a dial-up network 4. In the present example, this consists of a central computer 6 which is connected to a database 7 and a unit for identification 8. In the calling card system, the identification is checked and the performance features are assigned for identification. After the participant has been correctly identified, they will be given access to the - 6 -

System and then the desired service. This can be, for example, a transfer to a desired subscriber, the billing being assigned to the identification. As already stated, a mobile data carrier 1 is used in this method as identification, which automatically sends the identification to a specially equipped terminal 2 or 3. For example, a biometric feature or two biometric features or more are transmitted as identification for the purpose of greater security. After checking the identification in the unit for identification check 8, the performance features are assigned to the respective identification. Identification can be increased in the security standard, for example, by additional secret information, for example a personal identification number. Above all, it is also interesting to combine the biometric identification features, for example the iris, the fingerprint and / or the language features for subscriber identification. This significantly increases the security standard without complicating the test procedures. The biometric identification in the form of iris, fingerprint and / or language features can above all be stored in addition to the existing security identifications, such as a personal identification number. As a result, it is also possible to subject the participant to a check in advance of the biometric features stored on the chip card, for example, using the iris 10, a fingerprint 11 or language features 12 of a subscriber.

2 again shows a basic illustration of a system for carrying out the method. It in turn consists of a dial-up network 4 or a direct connection 5 with an identifier 9 in on one side - 7th

Are connected and on the other hand with the central computer 6, which in turn is connected to a database 7. The identifier 9 can again identify itself with the help of a mobile data carrier by means of biometric identification features. Type testing of the identification of the biometric features can be done by storing the properties on the chip card. After the identification has been entered, for example by means of a chip card, biometric properties, number input, etc., a profile evaluation is first carried out in the central computer 6. For example, it is checked whether it is plausible that the subscriber can be at the terminal at all. For this purpose, a user profile is stored in the unit for the identification check 8, for example, which indicates the location and the day on which a particular subscriber or the identifier 9 was or is located. Such a diagram is shown in Fig. 3b. For example, if an identification or use has already taken place at a distant location a few hours before the current identification, then the participant is very likely not authentic. 3a shows the usage behavior of an identifier 9 as an example, in which, for example, the sales made are shown on one day or on several days. This profile is then also saved in the unit for the identification check and is updated again and again. Furthermore, as part of the identification check, a check is made against a usage profile shown in FIG. 3c, that is to say how often, when, from which location, with which turnover which usage properties are used. For this purpose, the customers C1 to C3 are shown in the diagram on the vertical and the services DLa to DLd used on the horizontal. - 8th -

List of reference numbers

I mobile data carrier 2.3 terminals

4 dial-up network

5 direct connection

6 central computers

7 database

8 Identification verification unit

9 Identical

10 eye (iris)

II fingerprint

12 Language or language features

U sales

0 place

T day

C customer

DL service

Claims

- 9 -PATENT CLAIMS

1. Method for universal and secure access to networks, in particular telephone networks with a calling card system, in which subscribers identify themselves and after correct identification the subscriber is granted access to the system that he then receives the desired service, the billing being assigned to the identification is characterized by

that a mobile data carrier (1) is used as identification means via terminals (2 and / or 3) equipped with reading devices for identification and

that the identification as a biometric feature (10 to 12) is automatically sent via the terminals (2 and / or 3), via networks (4 and / or 5) to an identification verification unit (8) of the calling card system for the purpose of identity verification.

2. The method according to claim 1, characterized in

that the identification is transmitted in encrypted form, in particular a biometric feature.

3. The method according to any one of claims 1 or 2, characterized in

that individual features are assigned to the subscriber and stored centrally, which are retrieved by the central computer (6) from a database (7). - 10 -

4. The method according to any one of claims 1 to 3, characterized in

that individual features that are stored in the system are assigned to the subscriber.

5. The method according to any one of claims 1 to 4, characterized in

that in addition to identification as a biometric feature (10 to 12), secret information, in particular a personal identification number (PIN), is entered via the terminals (2 or 3) from the mobile data carrier (1).

6. Device for performing the method according to one or more of claims 1 to 5, characterized in that

that a chip card with memory and processor units contains the properties for checking the identification of biometric features in a specific memory area.

7. Device for performing the method according to one or more of claims 1 to 5, characterized in that

that the terminals (2 and / or 3) are equipped with a reading device for identification and also have devices for recording the biometric features (10 to 12) of an identifier (9).

8. A method of operating the device according to claims 6 or 7, characterized in that - 11 -

that after entering the identification, e.g. by means of a chip card, biometric properties or characteristics, special number entry, etc. A profile evaluation is first carried out in the central computer (6), which records and stores certain profile features of the participants and can automatically call them up for a plausibility check with regard to the identifier (9).

9. The method according to claim 8, characterized in

that the profile features of the identifier (9) are stored in the mobile data carrier (1) and / or in the terminal (2, 3) and, if appropriate, in the unit for the identification check (8) and are always automatically kept up to date.