Authentication and verification services for third party vendors using mobile devices
A method to provide authentication services to third party vendors by a service provider hosting an authentication, authorization and accounting (AAA) server or a similar device that can authenticate users for some other service. This method enables easy and substantially error-free end-user authentication, which forms the basis for enabling electronic transactions (e.g., web-based) that are less vulnerable to fraud.
1. An apparatus for authenticating a user transaction with a vendor, a user having a mobile device, the apparatus comprising:
a memory; and
a processor communicatively connected to the memory and configured to execute instructions received from the memory, the processor configured to:
receive, at a mobile service provider, identification information associated with said user and an identifier associated with said mobile device, wherein the received mobile device identifier comprises at least one of a cell phone number, a subscriber identity module (SIM) card number, and an electronic serial number (ESN), and the user identification information comprises one or more of a name and an address of a registered user;
determine, at the mobile service provider, that the received mobile device identifier and user identification information are associated with a mobile device and a corresponding registered user of the mobile service provider, said registered user being associated with a randomized key string adapted to enable the vendor to authenticate said user after receiving said randomized key string from the mobile device;
generate and transmit said randomized key string toward the mobile device according to a periodic schedule; and
transmit said randomized key string toward the vendor in response to receiving from the vendor said mobile device identifier and said user identification information of the registered user of the mobile service provider, said randomized key string transmitted toward said vendor being adapted to enable automatic authentication of said user transaction.
2. The apparatus of claim 1 , wherein the processor is configured to transmit said randomized key string in response to receiving said mobile device identifier and user identification information associated with a registered user of the mobile service provider.
3. The apparatus of claim 1 , wherein the processor is configured to transmit said randomized key string to said mobile device associated with a registered user of the mobile service provider periodically.
4. The apparatus of claim 1 , wherein said randomized key string transmitted toward said vendor is adapted to enable automatic verification of said user.
5. The apparatus of claim 1 , wherein the inquirer is one of a vendor, a service provider, or a transaction handler.
6. The apparatus of claim 1 , wherein the processor is configured to:
verify that an owner of a mobile device identified by the mobile device identifier is associated with the other identifying data.
7. The apparatus of claim 1 , wherein the processor is configured to:
receive the name and the mobile device identifier; and
verify that an owner of the mobile device identified by the mobile device identifier is associated with the received name.
8. The apparatus of claim 1 , wherein the processor is configured to:
send a data string to both the inquirer and the mobile device identified by the mobile device identifier.
9. The apparatus of claim 1 , wherein the processor is configured to transmit the randomized key string toward the vendor and the mobile device upon determining the match between the received and determined other identifying data.
10. An apparatus for authenticating a user transaction with a vendor, a user having a mobile device, the apparatus comprising:
a memory; and
a processor communicatively connected to the memory and configured to execute instructions received from the memory, the processor configured to:
transmit, by the vendor, toward a mobile service provider, identification information associated with said user and an identifier associated with said mobile device, wherein the received mobile device identifier comprises at least one of a cell phone number, a subscriber identity module (SIM) card number, and an electronic serial number (ESN), and the user identification information comprises one or more of a name and an address of a registered user;
receive, by the vendor, a first data string comprising a randomized key string sent by the mobile service provider in response to receiving from the vendor said mobile device identifier and said user identification information of the registered user of the mobile service provider and determining that the received mobile device identifier and user identification information are associated with a mobile device and a corresponding registered user of the mobile service provider; and
receive, by the vendor, a second data string comprising said randomized key string from the mobile device, wherein a match between the first and the second data strings comprising said randomized key string indicates authenticity of the user participating in the transaction, said randomized key string being assigned to the user and adapted to enable the vendor to automatically authenticate said user, said randomized key string being generated and transmitted by the mobile service provider toward the mobile device according to a periodic schedule.
11. The apparatus of claim 10 , wherein the processor is configured to transmit said randomized key string in response to receiving said mobile device identifier and user identification information associated with a registered user of the mobile service provider.
12. The apparatus of claim 10 , wherein the processor is configured to transmit said randomized key string to said mobile device associated with a registered user of the mobile service provider periodically.
13. The apparatus of claim 10 , wherein said randomized key string transmitted toward said vendor is adapted to enable automatic verification of said user.
14. The apparatus of claim 10 , wherein the inquirer is one of a vendor, a service provider, or a transaction handler.
15. The apparatus of claim 10 , wherein the processor is configured to:
verify that an owner of a mobile device identified by the mobile device identifier is associated with the other identifying data.
16. The apparatus of claim 10 , wherein the processor is configured to:
receive the name and the mobile device identifier; and
verify that an owner of the mobile device identified by the mobile device identifier is associated with the received name.
17. The apparatus of claim 10 , wherein the processor is configured to:
send a data string to both the inquirer and the mobile device identified by the mobile device identifier.
18. The apparatus of claim 10 , wherein the processor is configured to transmit the randomized key string toward the vendor and the mobile device upon determining the match between the received and determined other identifying data.