Method and computer system for ensuring authenticity of an electronic transaction
At least one embodiment of the present invention relates to a method for ensuring authenticity of an electronic transaction performed during a transaction session. The method includes receiving, over a first network, a request from a user for the completion of an electronic transaction; receiving, over the first network, an authentication code from the user which has been provided to the user over a second network separated from the first network, thereby authenticating the user, completing the electronic transaction; and storing information associated with the electronic transaction and the transaction session. The method further includes generating a one-way hash value based on information comprised in the electronic transaction and information associated with the transaction session, and providing the one-way hash value to the user, wherein the one-way hash value is usable for ensuring the authenticity of the electronic transaction. The procedure enables authentication, integrity, non-repudiation, and time stamping in a cost efficient way. An enhanced security level can be achieved as the network used for providing the authentication code to the user is separate from the network where the user returns the authentication code. At least one embodiment of the present invention also relates to a corresponding computer system adapted for ensuring the authenticity of an electronic transaction.
1. A method for ensuring authenticity of an electronic transaction performed during a transaction session, the method comprising:
receiving, over a first network, a request from a user for the completion of an electronic transaction;
providing, over a second network, an authentication code to the user;
receiving, over the first network, the authentication code entered by the user at a user terminal connected to the first network, thereby authenticating the user;
completing the electronic transaction;
storing a string of characters representing the electronic transaction and the transaction session, the string of characters including date, time, session identification, and IP address values associated with the electronic transaction;
generating a one-way hash value from the string of characters such that a non-repudiation connection is formed between the authenticated user and the completed electronic transaction; and
providing the one-way hash value to the user, wherein the one-way hash value is usable for ensuring the authenticity of the electronic transaction,
wherein the one-way hash value is included with a receipt for the electronic transaction and the transaction session is signed using a digital session certificate.
2. The method according to claim 1 , wherein the first network is a computer network and the second network is a mobile network.
3. The method according to claim 1 , wherein the authentication code is a one-way hash value generated based on information associated with initiation of the transaction session.
4. A computer system adapted to ensure authenticity of an electronic transaction performed during a transaction session, the computer system comprising:
means for receiving, over a first network, a request from a user for the completion of an electronic transaction;
means for providing, over a second network, an authentication code to the user;
means for receiving, over the first network, the authentication code entered by the user at the user terminal connected to the first network, thereby authenticating the user;
means for completing the electronic transaction;
means for storing a string of characters representing the electronic transaction and the transaction session, the string of characters including date, time, session identification, and IP address values associated with the electronic transaction;
means for generating a one-way hash value from the string of characters such that a non-repudiation connection is formed between the authenticated user and the completed electronic transaction; and
means for providing the one-way hash value to the user, wherein the one-way hash value is usable for ensuring the authenticity of the electronic transaction,
wherein the one-way hash value is included with a receipt for the electronic transaction and the computer system further comprises means for generating a digital session certificate for digitally signing the transaction session.
5. The computer system according to claim 4 , wherein the first network is a computer network and the second network is a mobile network.
6. The computer system according to claim 4 , wherein the authentication code is provided to the user by a third party communicatively connected to the computer system.