EP4104478A1

EP4104478A1 - Method and system of verifying mobile phone information of users who are connected to the internet with a wired/wireless gateway other than the gsm mobile network with a mobile device in the gsm mobile network area

Info

Publication number: EP4104478A1
Application number: EP21771313.0A
Authority: EP
Inventors: Kaan EKSEN
Original assignee: Crenno Bilisim Hizmetleri Ar Ge San Tic Ltd Sti
Current assignee: Crenno Bilisim Hizmetleri Ar Ge San Tic Ltd Sti
Priority date: 2020-03-20
Filing date: 2021-03-15
Publication date: 2022-12-21
Also published as: TR202004363A2; EP4104478A4; WO2021188081A1

Abstract

A system enabling to verify the phone number (MSISDN) information of the user who connects to the internet via the Internet Service Provider (ISP) (2) to which this Gateway is connected, through a Wired/Wireless Gateway (6) using a Mobile Device (1) with a SIM Card (5) inserted and actively connected to the GSM Mobile Network, comprising a GSM Operator (4), a Internet Service Provider (ISP) (2), a Mobile Device (1), a SIM card (5) inserted to the Mobile Device (1), GSM Operator SIM Management Platform (4.1) that sends the request to connect to the URL containing single-use tracking/reference information to the SIM card (5) inserted in the mobile device (1) with a trigger mode, the User Verification Platform (3) that enables the verification of the user phone number (MSISDN) information by controlling the tracking/reference information, IP/PORT information and all other information that is limited or completely identifying the Mobile Device (1) via the Internet Service Provider (ISP) (2) and the database (3.1) storing the tracking/reference information, IP/PORT information and all other information that is limited or completely identifying the Mobile Device (1).

Description

METHOD AND SYSTEM OF VERIFYING MOBILE PHONE INFORMATION OF USERS WHO ARE CONNECTED TO THE INTERNET WITH A WIRED/WIRELESS

GATEWAY OTHER THAN THE GSM MOBILE NETWORK WITH A MOBILE DEVICE IN THE GSM MOBILE NETWORK AREA

TECHNICAL FIELD RELATED TO THE INVENTION

The invention relates to a method that enables to verify the phone number (MSISDN information) of the user who connects to the Internet via a wired/wireless gateway (6) with a Mobile Device (1) with a SIM Card (5) inserted and actively connected to the GSM Mobile Network, via the Internet Service Provider (ISP) (2) to which this gateway is connected.

THE STATE OF ART RELATED TO THE INVENTION (PRIOR ART)

Today, it is not possible to verify the phone number of users who are in the GSM Mobile Network area and connect to the internet using a wired/wireless gateway outside this network without end-user intervention. Within our knowledge, three different methods are used, and these methods are insufficient in practice.

Method 1: When the user connects to the internet over the GSM Mobile Network, GGSN (Gateway GPRS Support Node) can share the user's phone number with the GGSN Header Enrichment method (GGSN Header Enrichment Method). If the user connects to the internet using a wired/wireless network other than the GSM Mobile Network, in this method, if the users request to connect to any service while surfing the internet, their phone numbers cannot be verified because MSISDN data cannot be accessed. (For example Login Operations, Operation Verification, etc.)

Method 2: In case the user's phone number is requested to be verified over the Mobile Device GSM line, a one-time password (OTP) method is used. Since this method requires human intervention, it is very vulnerable to Phishing attacks and its use is limited due to its risk. Method 3: Another solution is to request users to share their device information via a mobile application that they will download to their devices. In this solution, users do not want to give the necessary powers of applications that will collect the necessary information to such applications. Apart from this, it is necessary to verify with another device (SIM card) that is known to belong to the user at the first entry, or the institution to verify should have this information previously and through a verified channel. For these reasons, the implementation of the solution is insufficient.

In this sense, due to the inadequacies in the current situation of the used techniques, there is a need to develop a new technique in the technical field. SUMMARY AND AIMS OF THE INVENTION

The invention verifies something you have, which is one of the three basic factors used for identity verification of users connected to the Internet via their mobile devices. In the invention, the verification of the user is provided by using the information of the requester to be verified and the MSISDN information connected to the SIM card inserted in the mobile device to which this request is received.

Another purpose of the invention is to provide a structure that eliminates user-dependent trust, unlike the solutions used in existing techniques. Thus, Phishing attacks are prevented. In this method, it will not be sufficient for the attacker to obtain only the required information of the user to be authenticated, but also they need to capture the device he/she owns, so such attacks will be substantially prevented.

Another purpose of the invention is to verify the phone number of the user in the use of paid services behind Wired/Wireless networks and to perform charging based on this verification.

The structural and characteristic features of the invention were indicated in the figures given below and in the detailed description sections written by making references to these figures. The advantages of the invention will be understood more clearly by examining these figures and detailed description sections.

DEFINITIONS OF THE FIGURES EXPUAINING THE INVENTION Figure 1 - The general representation of the system of the invention.

Figure 2 - A general flow chart diagram representation describing the method and alternative process steps of the invention.

DEFINITIONS OF THE EEEMENTS AND PARTS FORMING THE INVENTION

1. Mobile device (User) (1)

2. Internet Service Provider (ISP) (2)

3. User Verification Platform (3)

1. Database (3.1)

4. GSM Operator (4)

1. GSM Operator SIM Management Platform (4.1)

5. SIM (5)

6. Wired/Wireless Gateway (6)

100. The user sends a login request to the verification server.

105. The Internet service provider assigns IP/PORT to the user for login requests. 110. The verification server receives IP/PORT information from the incoming request.

115. The verification server determines the reference of the operation and stores it in the database with IP/PORT and other information.

120. The verification server sends a request for a reference URL to be triggered to the operator. 125. The operator transmits the trigger request to the GSM Operator SIM Management Platform. 130. The Operator SIM Management Platform sends an SMS to the user's device in trigger mode.

135. The device sends a request directly to the URL in the SMS.

140. The device opens the application with Deep Link in SMS. 145. The application makes a call to the Verification server with the incoming reference code.

150. The verification server receives the device's IP/PORT and other information.

155. It compares the information in the database with the reference number.

160. The verification server verifies the phone number in the requested request.

165. The device shows the PoP-UP SMS to the user.

170. It sends requests based on user approval.

DETAILED DESCRIPTION OF THE INVENTION

The preferred embodiments of the invention included in the detailed description in this section are expressed only for a better understanding of the subject matter and without any restrictive effect.

The user connects to the User Verification Platform (3) via the wired/wireless Gateway (6) and the Internet Service Provider (ISP) (2) to which this network is connected, by using the Mobile Device (1) with SIM Card (5) inserted and actively connected to the GSM Mobile Network and requests to login (100). The IP and PORT information of the network to which the Mobile Device (1) sending this request is connected, is assigned permanently or temporarily by the internet service provider (2) (105). The assigned IP and PORT information are transmitted to the User Verification Platform (3) along with the request (110) and this IP/PORT information and tracking/reference information of the user Mobile Device (1) are recorded in the Database (3.1) (115). The information therein is not limited to IP/PORT but may include all information such as location, a universally unique identifier (UUID), User-Agent, which are limited or fully identifiers of the device. This information alone does not give information about the user's ownership of the user device. The created tracking/reference information is unique for each operation and has a certain lifetime (Time to live (TTL)). The tracking/reference information cannot be reused after the first use. If more than one request with the same tracking/reference information reaches the verification server, the login request from all users with the relevant tracking/reference information is rejected and, if any, active connections are terminated. The User Verification Platform (3) sends a URL verification request containing single-use tracking/reference information to the GSM Operator (3) to transmit to the user's phone number to confirm the phone number of the person (120). The GSM Operator (4) creates the HTTPS connection via the GSM Operator SIM Management Platform (4.1) to access the single- use URL for the user's SIM card (5) according to the existing Global Platform v.2.2 Amendment B standards with the trigger mode (Push Mode) (125). In the trigger mode, a binary (binary, configurative, invisible, and unreadable to the user) SMS is sent to the SIM card (5) inserted in the Mobile Device (1) by the GSM Operator SIM Management Platform (4.1) (OTA) containing the request for connecting the URL containing the User Verification Platform (5) single-use tracking/reference information (130).

The sent Trigger SMS can be interpreted in three different ways on the user's device.

1. The content of the Trigger SMS includes the URL to which the Mobile Device (1) should be connected. The Mobile Device (1) receiving this message realizes the request to connect to the URL specified in the SMS over the Internet Service Provider (ISP) (2) or 3G, 4G, or similar GSM networks in case of a connection problem on this network (135). The specified URL is the User Verification Platform (5) URL and the Mobile Device (1) connects to the User Verification Platform (5) by using this URL.

2. The data received in the content of the trigger SMS is shown to the user on the screen as a pop-up SMS (165). Here, the user is asked whether she/he will continue the operation/approve the operation by showing information about the login request. According to the response from the user, the operation verification request is transmitted to the User Verification Platform (5), together with all the information that is limited or fully identifying the device and is not limited to tracking/reference information (170).

3. If the login request to the User Verification Platform comes through the User Verification Platform Integrated Mobile Application, the URL in the Trigger SMS's content allows the Mobile Device (1) to open this mobile application directly by using the Deep Link structure (140). Using the User Verification Platform integration, the data in Deep Link is received by the Verification Platform Integrated Mobile Application running on the Mobile Device (1). With this transported data, the Verification Platform Integrated Mobile Application makes a direct call (145) to the User Verification Platform (5). The User Verification Platform (5) receives (150) the tracking/reference, IP/PORT information of the connected device, and all other information that is limited or fully identifying the Mobile Device (1). The device ownership of the user will be verified (160) by comparing with the IP address and PORT number (155) previously registered with the tracking/reference information and the information transmitted by the device by connecting with the URL after the trigger. Since the user did not/could not perform an active operation/correction/intervention during this verification operation, possible information sharing and user errors are prevented. The user's identity is verified by verifying the ownership of the SIM card number inserted in the Mobile Device.

The device can also receive an SMS from networks, such as 2G/3G/4G, etc. When there is a problem in the Internet service provider (ISP) connection, it can switch to networks, such as 2G/3G/4G, etc. for data use. Here (135) the user identity is verified by using the MSISDN Forwarding method.

The verification operation is not limited to the registered user's mobile phone ownership in the login process, whether the user actually owns the claimed phone number in the new user registration process, the operation confirmation processes, but can be used in every operation that the user needs to authenticate.

The elements and functions constituting the system of the invention are as follows;

• The Mobile Device (1) to be used by the user in the verification operation

• The SIM card (5) inserted in the Mobile Device (1) to be used by the user in the verification operation,

• Wired/Wireless Gateway (6) to be used to connect the Mobile Device (1) to the Internet Service Provider (ISP) (2),

• Internet service provider (ISP) (2) that enables the Mobile Device (1) to connect to the internet,

• User Verification Platform (3) to which the Mobile Device (1) is connected for verification • The database (3.1) where the IP/PORT information received by the User Verification Platform (3) from the Internet service provider (ISP) (2) and all other information that is limited or fully identifying the Mobile Device (1) is kept,

• GSM Operator (4) to which the User Verification Platform connects for user phone number verification

• GSM Operator SIM Management Platform (4.1) that sends a trigger mode that includes a request to connect to a URL containing single-use tracking/reference information to the SIM card (5) inserted in the mobile device (1),

The process steps performed by the system of the invention are as follows;

• The user connects to the User Verification Platform (3) via the wired/wireless Gateway (6) and the Internet Service Provider (ISP) (2) to which this network is connected, by using the Mobile Device (1) actively connected to the GSM Mobile Network and requests to login (100),

• The IP/PORT information is assigned (105) by the Internet Service Provider (ISP) (2) to the Mobile Device (1) or to the network to which it is connected specifically to the Mobile Device (1),

• The IP/PORT information assigned by the Internet Service Provider (ISP) (2) specifically to the Mobile Device (1) is received (110) from the incoming request by the User Verification Platform (3),

• The tracking/reference, IP/PORT information, and all other information that is limited or fully identifying the Mobile Device (1) are saved (115) to the Database (3.1) by the User Verification Platform (3),

• To verify the phone number of the person making the request, the URL information containing the single-use tracking/reference information is forwarded (120) to the GSM Operator (4) to be sent to the user's phone number by the User Verification Platform (3),

• The GSM Operator (4) forwards (125) the incoming request to the GSM Operator SIM Management Platform (4.1), • The GSM Operator SIM Management Platform (4.1) creates an HTTPS connection to access the single-use URL for the user's SIM card (5) according to the existing Global Platform v.2.2 Amendment B standards with the trigger mode (Push Mode),

• In the trigger mode, a binary (binary, configurative, invisible, and unreadable to the user) SMS is sent to the SIM card (5) inserted in the Mobile Device (1) by the GSM Operator SIM Management Platform (4.1) (OTA) containing the request for connecting the URL containing the User Verification Platform (5) single-use tracking/reference information (130),

• The sent Trigger SMS is interpreted in one of three different ways on the user's device, o Mobile Device (1) that receives the message of connecting to a single-use URL address, accesses (135) the URL address specified in the SMS via the Wired/Wireless Gateway (6) and the Internet Service Provider (ISP) (2), o The Mobile Device (1), which receives the message to connect to the single-use URL address, shows the user the login request information on the screen as a Pop- Up SMS (165) and according to the response from the user, makes a request (170) to the URL address specified in the SMS through Wired/Wireless Gateway (6) and the Internet Service Provider ( ISP) (2), o The Mobile Device (1), which receives the message to connect to the single-use URL address, opens the User Verification Platform Integrated Mobile Application installed thereon (140), shows the login request information to the user with the data in Deep Link and according to the response from the user or without showing any information to the user, makes requests (145) directly to the User Authentication Platform (3), via the Wired/Wireless Gateway (6) and the Internet Service Provider (ISP) (2),

• The Mobile Device (1) connects to the User Verification Platform (3) by using the URL routing received by the Trigger Mode SMS, so receives (150) the IP/PORT information assigned by the Internet Service Provider (ISP) (2) to which the Mobile Device (1) is connected, and all other information that is limited or fully identifying the Mobile Device (1) and compares (155) IP/PORT information and all other information that is limited or fully identifying the Mobile Device (1) stored in the database using the tracking/reference information of the User Verification Platform (3) as a result of which the user's telephone number information is verified (160).

Claims

1. A system enabling to verify the phone number (MSISDN) information of the user who connects to the internet via the Internet Service Provider (ISP) (2) to which this Gateway is connected, through a Wired/Wireless Gateway (6) using a Mobile Device (1) with a SIM Card (5) inserted and actively connected to the GSM Mobile Network, characterized in that it comprises; o GSM Operator SIM Management Platform (4.1) that sends a trigger mode request to connect to a URL containing single-use tracking/reference information to the SIM card (5) inserted in the Mobile Device (1) actively connected to the GSM Mobile Network, o Internet Service Provider (ISP) (2), which enables the Mobile Device (1) actively connected to the GSM Mobile Network to connect to the Internet using a Wired/Wireless Gateway (6) other than the GSM Mobile Network, o User Verification Platform (3), which enables to verify the IP/PORT information, tracking/reference information, and all other information that is limited or fully identifying the Mobile Device (1), received from the Internet Service Provider (ISP) (2) by the Mobile Device (1) actively connected to the GSM Mobile Network, o Database (3.1) where IP/PORT information, tracking/reference information, and all other information that is limited or fully identifying the Mobile Device (1) is kept.

2. A method enabling to verify the phone number (MSISDN) information of the user who connects to the internet via the Internet Service Provider (ISP) (2) to which this Gateway is connected, through a Wired/Wireless Gateway (6) using a Mobile Device (1) with a SIM Card (5) inserted and actively connected to the GSM Mobile Network, characterized in that it comprises the following steps;

• connecting the User to a Wired/Wireless Gateway (6) other than the GSM Mobile Network via the Mobile Device (1), • entering the User Information (Phone Number, User Name, Password, etc.) to the application requested to login via the Mobile Device (1) by User,

• connecting the User to the User Verification Platform (3) by using the Internet Service Provider (ISP) (2) to which a Wired/Wireless Gateway (6) is connected, other than the GSM Mobile Network, via the Mobile Device (1) and requesting to login (100),

• assigning (105) IP and PORT to this Gateway (6) for the login request of The Internet Service Provider (ISP) (2), to which a Wired/Wireless Gateway (6) is connected via the Mobile Device (1), other than the GSM Mobile Network,

• receiving (110) the IP/PORT information assigned by the User Verification Platform (3) to the Gateway (6) based on the Internet Service Provider's (ISP) (2) Mobile Device (1) request

• receiving the User Information and all other information that is limited or fully identifying the Mobile Device (1) by the User Verification Platform (3),

• storing (115) The User Verification Platform (3), the IP/PORT, the created single-use tracking/reference information, and all other information that is limited or fully identifying the Mobile Device (1) in the Database (3.1)

• sending (120) a request by the User Verification Platform (3) to the GSM Operator (4) containing a single-use tracking/reference URL address to be sent to this number to verify the Telephone Number matched with the user,

• transmitting (125) the URL address with single-use tracking/reference information to be triggered to the GSM Operator SIM Management Platform (3) by The GSM Operator receiving the request,

• creating of an HTTPS connection with the trigger mode (Push Mode) by The GSM Operator SIM Management Platform (3) to access the single-use URL in the SIM card (5) in the Mobile Device (1),

• sending (130) a request to connect to the SIM card (5) in the trigger mode, to the URL containing single-use tracking/reference information created by the User Verification Platform (3) by the GSM Operator SIM Management Platform (4.1),

• interpreting of The sent Trigger SMS as one of three different ways on the user's device, o Mobile Device (1) that receives the message of connecting to a single-use URL address, accesses (135) the URL address specified in the SMS via the Wired/Wireless Gateway (6) and the Internet Service Provider (ISP) (2), o showing (165) The Mobile Device (1), which receives the message of connecting to the single-use URL address, the login request information on the screen as a Pop-Up SMS to the user, and making a request (170) to the URL address specified in the SMS according to the response from the user through Wired/Wireless Gateway (6) and the Internet Service Provider ( ISP) (2), o opening the User Verification Platform Integrated Mobile Application (140) installed on Mobile Device (1), which receives the message of connecting to the single-use URL address, showing the login request information to the user with the data in Deep Link and making requests (145) directly to the User Authentication Platform (3), via the Wired/Wireless Gateway (6) and the Internet Service Provider (ISP) (2) according to the response from the user or without showing any information to the user,

• receiving (150) the IP/PORT information assigned by the Internet Service Provider (ISP) (2) to which the Mobile Device (1) is connected and all other information that is limited or fully identifying the Mobile Device (1) by connecting the Mobile Device (1) to the User Verification Platform (3) by using the URL routing received by the Trigger Mode SMS, and verifying (160) of the user's telephone number (MSISDIN information) s a result of comparing (155) the IP/PORT information by the User Verification Platform (3) in the database using the tracking/reference information and all other information that is limited or fully identifying the Mobile Device (1)