WO2013171727A1

WO2013171727A1 - Method and system for extracting subscriber and device identifiers from a mobile communication device

Info

Publication number: WO2013171727A1
Application number: PCT/IB2013/054130
Authority: WO
Inventors: Malan Francois JOUBERT; Colin Robert SINDLE; David Michael Weber
Original assignee: PRAXIS CYBERNETICS Pty Ltd
Current assignee: PRAXIS CYBERNETICS Pty Ltd
Priority date: 2012-05-18
Filing date: 2013-05-20
Publication date: 2013-11-21
Anticipated expiration: 2014-11-18

Description

METHOD AND SYSTEM FOR EXTRACTING SUBSCRIBER AND DEVICE IDENTIFIERS FROM A MOBILE COMMUNICATION DEVICE

BACKGROUND OF THE INVENTION

THIS invention relates to the extraction of identification information from a mobile communication device. Examples of such communication devices include GSM based mobile telephones.

Modern financial and other transactions typically require some form of physical token (e.g. a plastic transaction card bearing some unique form of identification) and a second token that must be produced by the bearer, such as a signature or a PIN number. An example of such a transaction card is a conventional credit or debit card. For security and as a result of wear and tear it is common to replace such cards regularly, with resultant cost and inconvenience. tt is an object of the invention to provide an alternative to the use of transaction cards for at least certain types of transaction. SUMMARY OF THE INVENTION

According to the invention there is provided a method of obtaining identification information from a mobile communication device, the method including: providing an electromagneticaily shielded enclosure having an opening therein and including an antenna within said enclosure; inserting a mobile communication device into the electromagneticaily shielded enclosure via the opening; operating base station communication apparatus to communicate with the mobile communication device via the antenna within the electromagneticaily shielded enclosure to obtain identification information from the mobile communication device; and utilising the identification information to identify a participant in a transaction.

The electromagneticaily shielded enclosure can be, for example, a small container similar to a personal safe with a door, the opening in the enclosure being sufficiently large to receive a mobile telephone or another mobile communication device.

Preferably, the electromagneticaily shielded enclosure includes a sensor associated with the door, the method including utilising an output of the sensor to detect whether the door is open or closed, the operation of the base station apparatus being disabled when the door is open.

The base station communication apparatus may comprise conventional GSM base station equipment which communicates with the mobile communication device on one or more selected channels. The channel or channels are preferably selected to correspond to channels utilized by one or more network service providers to allow mobile telephones utilised on such networks to attach rapidly to the base station apparatus.

The method preferably includes configuring the base station communication apparatus to interrogate the mobile communication device for a subscriber identity number (IMS!) and/or a unique device identification number (IMEI).

The device identification data is preferably associated with a client of a merchant in a registration process for subsequent use in transactions between the client and the merchant.

Further according to the invention there is provided a system for obtaining identification information from a mobile communication device, the system including: an efectromagneticaliy shielded enclosure having an opening therein through which a mobile communication device can be inserted into said enclosure; an antenna within the electromagnetically shielded enclosure; base station communication apparatus operable to communicate with the mobile communication device via the antenna within the electromagnetically shielded enclosure to obtain identification information from the mobile communication device; and data storage for storing the identification information for use in identifying a participant in a transaction.

The electromagnetically shielded enclosure can be, for example, a small container similar to a personal safe with a door, the opening in the enclosure being sufficiently large to receive a mobile telephone or another mobile communication device.

Preferably, the electromagnetically shielded enclosure includes a sensor associated with the door and arranged to disable the operation of the base station apparatus when the door is open.

The base station communication apparatus may comprise conventional GSM base station equipment configured to communicate with the mobile communication device on one or more selected channels.

The channel or channels are preferably selected to correspond to channels utilized by one or more network service providers to allow mobile telephones utilised on such networks to attach rapidly to the base station communication apparatus.

The base station communication apparatus is preferably configured to interrogate the mobile communication device for a subscriber identity number (iMSI) and/or a unique device identification number (IMEI).

The system may include a terminal with data entry means connected to the base station communication apparatus and usable by an operator to control the base station communication apparatus.

The terminal is preferably connected to the data storage and usable by an operator to enter client data during registration with a merchant or during a transaction with a merchant.

The terminal is preferably connected to the base station communication apparatus and the data storage via a secure communication link.

The device identification data is preferably associated with a client of a merchant in a registration process for subsequent use in transactions between the client and the merchant. BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 is a simplified schematic diagram showing a system according to an example embodiment of the invention for extracting identification information from a mobile communication device;

Figure 2 is a flow chart summarising the operation of a client registration or enrolment process according to the invention; and

Figure 3 is a flow chart summarising a transaction process according to the invention.

DESCRIPTION OF AN EMBODIMENT

The present invention relates to the extraction of identification information from a mobile communications device. Examples of such communications devices include GSM based mobile telephones and other portable devices using a Subscriber Identity Module (SIM card). The identification information can be extracted with or without the cooperation of the relevant network service provider.

The method of the invention aims at obtaining the identity of mobile communication devices, particularly the unique identifiers associated with a physical handset including the International Mobile Equipment Identity (IMEI) as well as the fnternationai Mobile Subscriber Identity (IMSI) associated with the telephone number of a network subscriber who is the holder of the handset and usually encoded in a Subscriber Identity Module (SIM).

The method of the invention achieves these goals by first depriving the mobile communication device of any radio (electromagnetic) connectivity to its default host network's base stations. It then offers the device an alternative base station (ABS). The mobile communication device protocol causes it to attach to the offered base station, at which point the alternative base station is at liberty to interrogate the device for its IMSE, IMEI and other network related details using published network standard protocols.

In the special case of the GSM protocol, the ABS can be operated in such a way that it presents electromagnetic beacons (broadcast control channels) at a plurality of selected GSM radio channels (ARFCN's) allowing devices from multiple network providers to attach quickly to the ABS. This minimizes the time required for the mobile device to attach to the ABS, thereby providing response times below 10 seconds.

Electromagnetic isolation is achieved by means of inserting a user's mobile communication device 10 into a door in an electromagnetical!y shielded enclosure 12 defining a Faraday cage. The enclosure contains an antenna for transmitting electromagnetic radiation to and from the device 10. Only a very low power transmission is required. A commercial base station apparatus (referred to as an "Alternative Base Station" or ABS 14) is connected to the antenna in the enclosure, thereby facilitating communications with the isolated mobile device 10.

The enclosure is provided with a micro switch or other sensor associated with the door thereof which provides a signal to the ABS 14 to indicate if the door has been opened and the electromagnetic isolation thus compromised. The ABS can thus suspend its transmissions while the door is opened to insert or remove the mobile device from the enclosure.

The enclosure thus contains any electromagnetic transmissions from the alternative base station 14, thereby preventing the transmission of potentially interfering electromagnetic radiation. This is important as it ensures that the system complies with the requirements of communication authorities such as ICASA in South Africa and the FCC in the United States of America. Associated with the alternative base station 14 is a terminal 16 with an associated keypad (or other data entry means such as a touch screen) which can be used by an operator to control the alternative base station and to enter client data during an enrolment procedure with a merchant and during a transaction with the merchant. The terminal 16 is connected via a secure communication link 18 (preferably an encrypted link) to a merchant database 20 in which client account and identification data is stored.

One purpose of the invention is to facilitate the use of the mobile communication device as one authentication factor or token in a financial transaction (or other transaction requiring identification of a party thereto). This requires that the mobile communication device be linked to both a client or customer, and an account with a merchant or other entity through which transactions will be undertaken.

An example of a registration or enrolment procedure between a client and a merchant to achieve this is set out befow:

1. A representative of the merchant verifies the identity of the client to be enrolled, using a conventional identification document or other acceptable means of identification.

2. The representative enables an "Enrolling mode" on the data terminal 16 associated with the ABS 14.

3. The client places his or her mobile communication device 10 into the enclosure 12.

4. The ABS 14 extracts the client's IMSI (and/or other identification information) from the device 10 as described above.

5. The IMSI is sent over a separate (encrypted) data connection 18 to be registered against an account of the client with the merchant (either new or existing), and stored in a database 20.

6. The client enters a Personal Identification Number (PIN) on the keypad of the data terminal 16. The PIN choice is then confirmed by having the client enter it a second time. 7. The PfN is transmitted over the encrypted data connection 18 to the client's bank or other financial institution to be registered against the client's account at the bank or institution. Alternatively, the client may be given an option to use a PIN already stored by the merchant (e.g. her bank card's PIN), or to enter this new PIN via the terminal 16.

8. The device 10 and the PIN are now registered against the client's account with the merchant, and can be used for authentication and confirmation of transactions between the client and the merchant.

The registration process is summarised in the flow chart of Figure 2.

Once the client has been registered with the merchant as described above, the client can enter into transactions with the merchant, suing their mobile telephone or other mobile communication device as a token to identify and/or authenticate themselves.

An example of a financial transaction between a client and a merchant is set out below:

1. The client places their mobile device 10 into the enclosure 12.

2. The ABS 14 extracts the client's IMSI (and/or other identification information) from the device 10 as described above.

3. The client then requests a financial transaction using the terminal 16.

4. The client enters their PIN into the terminal 16 as prompted.

5. The entered PIN is compared with the stored PIN via the data connection 18 to the financial institution's data storage 20.

6. If the PIN numbers match, the requested transaction is executed via the financial institution.

7. The ABS 14 then sends an SMS to the client's mobile device with a text message describing the outcome of the requested transaction.

8. The client then removes their mobile device from the enclosure 12. The transaction process is summarised in the flow chart of Figure 3.

The invention allows a mobile communication device to be used in a transaction instead of a physical token such as a credit card, thus eliminating the need for maintenance and replacement of the physical tokens. The invention works without the need for special software to be loaded on the mobile device and does not require the mobile device to communicate with a host network in order to function as a token. The mobile device will thus operate as a token in areas without mobile network coverage as well.

Claims

C LAI MS

1. A method of obtaining identification information from a mobile communication device, the method including: providing an electromagneticaliy shielded enclosure having an opening therein and including an antenna within said enclosure; inserting a mobile communication device into the electromagneticaliy shielded enclosure via the opening; operating base station communication apparatus to communicate with the mobile communication device via the antenna within the electromagneticaliy shielded enclosure to obtain identification information from the mobile communication device; and utilising the identification information to identify a participant in a transaction.

2. The method of claim 1 wherein the electromagneticaliy shielded enclosure is a container with a door, the opening in the enclosure being sufficiently large to receive a mobile telephone or another mobile communication device.

3. The method of claim 2 wherein the electromagneticaliy shielded enclosure includes a sensor associated with the door, the method including utilising an output of the sensor to detect whether the door is open or closed, the operation of the base station communication apparatus being disabled when the door is open.

4. The method of any one of claims 1 to 3 wherein the base station communication apparatus comprises conventional GSM base station equipment which communicates with the mobile communication device on one or more selected channels.

5. The method of claim 4 wherein said one or more selected channels are selected to correspond to channels utilized by one or more network service providers to allow mobile telephones utilised on such networks to attach rapidly to the base station communication apparatus.

6. The method of claim 5 including configuring the base station communication apparatus to interrogate the mobile communication device for a subscriber identity number (IMSI) and/or a unique device identification number (IMEI).

7. The method of any one of claims 1 to 6 wherein the device identification data is associated with a client of a merchant in a registration process for subsequent use in transactions between the client and the merchant.

8. A system for obtaining identification information from a mobile communication device, the system including: an electromagneticaily shielded enclosure having an opening therein through which a mobile communication device can be inserted into said enclosure; an antenna within the electromagneticaily shielded enclosure; base station communication apparatus operable to communicate with the mobile communication device via the antenna within the electromagneticaily shielded enclosure to obtain identification information from the mobile communication device; and data storage for storing the identification information for use in identifying a participant in a transaction.

9. The system of claim 8 wherein the electromagnettcally shielded enclosure is a container with a door, the opening in the enclosure being sufficiently large to receive a mobile telephone or another mobile communication device.

10. The system of claim 9 wherein the electromagnetically shielded enclosure includes a sensor associated with the door and arranged to disable the operation of the base station communication apparatus when the door is open.

11. The system of any one of claims 8 to 10 wherein the base station communication apparatus comprises conventional GSM base station equipment configured to communicate with the mobile communication device on one or more selected channels.

12. The system of claim 9 wherein said one or more selected channels are selected to correspond to channels utilized by one or more network service providers to allow mobile telephones utilised on such networks to attach rapidly to the base station apparatus.

13. The system of claim 12 wherein the base station communication apparatus is configured to interrogate the mobile communication device for a subscriber identity number (IMSI) and/or a unique device identification number (IMEI).

14. The system of any one of claims 8 to 13 including a terminal with data entry means connected to the base station communication apparatus and usable by an operator to control the base station communication apparatus.

15. The system of claim 14 wherein the terminal is connected to the data storage and usable by an operator to enter client data during registration with a merchant or during a transaction with a merchant.

16. The system of claim 14 or claim 15 wherein the terminal is connected to the base station communication apparatus and the data storage via a secure communication link.

17. The system of any one of claims 8 to 16 wherein the device identification data is associated with a client of a merchant in a registration process for subsequent use in transactions between the client and the merchant.