WO2002060209A1

WO2002060209A1 - Date source authentication comprising transmission of positional information

Info

Publication number: WO2002060209A1
Application number: PCT/GB2002/000339
Authority: WO
Inventors: Jonathon Nicholas Ogden
Original assignee: Worldpay Limited
Priority date: 2001-01-24
Filing date: 2002-01-24
Publication date: 2002-08-01
Also published as: EP1354492A1; GB0101836D0

Abstract

A verification system for authenticating the source of data includes the transmission of positional information based on global positioning system coordinates received at the originator site (10) by a GPS receiver (32) locked onto GPS satellites. The system provides geographical positional data relevant to the user which can be compared at an authentication site (22) with stored positional data on the user. In the presence of a suitable match between the received and stored positional data, the data itself can be passed or permitted to be transmitted.

Description

DATA SOURCE AUTHENTICATION COMPRISING TRANSMISSION OF POSITIONAL INFORMATION

This invention relates to data transaction authentication. It is particularly, though not exclusively, applicable to financial transaction authentication.

Basic to the concept of financial transactions, conducted electronically by dedicated network or over the Internet, is authentication of the source of the financial transaction.

The Internet is an inherently open environment. This medium is a highly adaptable and convenient way for businesses, or merchants and customers, to trade using electronic funds transfer as the payment mechanism. However, the open nature of the Internet means that security has to be invested in the data that is sent.

For example, it is possible to make payments by credit card over the Internet through secure payment protocols. The system creates a hash of some or all of the transaction data which is sent to the transaction verification site. If the hash does not match the data at the transaction verification site, it is an indication that an attempt at tampering with the transaction information has taken place or a bogus transaction has been attempted. Secure transmission by use of a hash of the information to be sent is well-known. It is a form of encryption using public and/or private keys. However, it is not impregnable. It is possible to mimic the source of a financial transaction and, thus, derive financial gain by unauthorised use of financial transaction data. As the dependence on electronic funds transfer in its many forms grows, the techniques for overcoming the security measures put in place to protect the data transmitted become more sophisticated.

One such secure transmission enabling device is the Trusted Authentication Device (TAD) made by Enterprises Solutions Inc. of 140 Wood Road, Suite 200, Braintree, Massachusetts, USA. The TAD comprises a site box for enabling secure transactions across an open network that is designed to counter hostile software loaded on the server or computer by which the TAD is connected to the Internet. While the TAD processes the transaction itself, the procedures by which the transaction data is communicated across the Internet are conducted by the server or computer to which it is linked. It has a swipe card reader, a keypad by which the user enters their personal identification number (PIN) and an interface for connection to the personal computer. The personal computer is loaded with software by which the data is communicated from the TAD, over the Internet, to the payment gateway/financial systems to which the user is contracted.

The inventors of the present invention have recognised that the ability to attack the integrity of the user systems for data transactions, and thereby make fraudulent use of the information, is based on breaking the encrypted data and accessing the identification information unique to the user. As long as the electronic address of the merchant site can be imitated, the actual geographical location is irrelevant in such conventional systems.

The present invention aims, in one embodiment, to provide an enhancement to secure electronic transactions based on >the geographical location of the originator of the transaction or a form of identity location verification itself.

In another embodiment, the present invention aims to provide an enhancement to secure electronic transactions based on an additional check on the identity of the user via a separate channel of identification from that used in the transaction.

According a first aspect of the invention there is provided a data source authentication device comprising a transmitter for transmitting data, a position information determining apparatus for deriving position information relative to the location of the device, and a position information transmitter' for transmitting position information.

Preferably, the transmitter for transmitting data is a cellular telephone, or an electronic network, such as the Internet.

Preferably, the position information transmitter is a position fixing system, such as a global positioning system.

In a preferred embodiment, the data source authentication device further comprises an encoder for encoding the data transmitted, and a decoder for decoding the encoded data.

Preferably, the data source authentication device for authenticating the identity of a user further comprises identification apparatus for receiving information relevant to the identity of the user, verification apparatus for verifying the identity of the user, authorisation apparatus for authorising release of details relating to the user. In a preferred embodiment, the data source authentication device for authenticating the identity of a user further comprises a receiver for receiving the details relating to the user.

Preferably, the position information determining apparatus is connected to the receiver for receiving the details relating to the user.

Preferably, the position information determining apparatus is connected to the transmitter for transmitting data.

Preferably, the position information determining apparatus is part of a cellular network.

In a preferred embodiment, the invention comprises a financial transaction system comprising a data authentication device defined above.

According to a further aspect of the invention there is provided a method of data authentication comprising storing authorising data specific to a particular user, requesting and receiving user identification data, comparing the requested user identification data with the stored authorising data, requesting and receiving data identifying the geographical location of the user, determining if the received geographical location data is within authorised limits stored in the authorising data specific to the particular user, and verifying the identity of the user based on a matching of the user identification data with the stored authorising data.

Preferably, the method further comprises approving release of data specific to the particular user in response to verification of the identity of the user.

According to a further embodiment there is provided a data authentication system comprising a data authentication device operable to generate the data and position information relevant to the location of the device, and to transmit position information, the system further comprising a receiver for receiving the position information, a store for storing information on the location of the device, and comparison apparatus for comparing the received position information with the stored information in order to verify the source of the data.

Preferably, the data authentication device comprises a transmitter for transmitting data, and the transmitter is a cellular telephone, or an electronic network, such as the Internet.

Preferably, the data authentication device comprises a position information transmitter, and the position information transmitter is a position fixing system, such as a global positioning system.

Preferably, the data authentication system further comprises an encoder for encoding the data transmitted, and a decoder for decoding the encoded data, and in a further embodiment, may comprise identification apparatus for receiving information relevant to the identity of the user, verification apparatus for verifying the identity of the user, authorisation apparatus for authorising release of details relating to the user.

Preferably, the data authentication system for authenticating the identity of a user further comprises a receiver for receiving the details relating to the user. Preferably, the data authentication device comprises a position information determining apparatus, and the position information determining apparatus is connected to the receiver for receiving the details relating to the user, or to the transmitter for transmitting data, or is part of a cellular network.

According to a further aspect there is provided a financial transaction system comprising a data authentication system as defined above.

According to yet a further aspect there is provided data source authentication device comprising means for transmitting data, means for deriving position information relevant to the location of the device, and means for transmitting the position information.

Preferably, the means for transmitting the position information is a mobile device, or an electronic network, such as the Internet.

Preferably, the means for transmitting the position information is a position fixing system, such as a global positioning system.

Preferably, the data source authentication device for authenticating the identity of a user further comprises identification apparatus for receiving information relevant to the identity of the user, verification apparatus for verifying the identity of the user, authorisation apparatus for authorising release of details relating to the user. In a further preferred embodiment, the data source authentication device further comprises a receiver for receiving the details relating to the user. Preferably, the means for transmitting the position information is connected to the receiver for receiving the details relating to the user, or to the means for transmitting data, or is part of a cellular network.

According to a further aspect there is provided a data authentication system comprising a data authentication device operable to generate the data and position information relevant to the location of the device, and to transmit position information, the system further comprising means for receiving the position information, means for storing information on location of the device, and means for comparing the received position information with the stored information in order to verify the source of the data.

The invention provides an enhancement to existing security measures or a security measure in itself. It is applicable to position information derived dynamically from a position fixing system, such as the Global Positioning

System (GPS). However, fixing or position locating information can be derived from other sources, such as the United States Coast Guard Loran-C system or the cell location information used in cellular radio systems.

The present invention can be put into practice in various ways, some of which will now be described by way of example with reference to the accompanying drawings in which:

Figure 1 is a schematic diagram of a system according to a first embodiment; Figure 2 illustrates a site device according to the invention;

Figure 3 is a schematic diagram of a further embodiment according to the invention; and Figure 4 is a flow diagram of an embodiment of the invention.

Referring to Figure 1, a data transaction system comprises a trusted authentication device (TAD) 10 which is connected, via a USB datalink, to a personal computer 12. The computer 12 is connected via a fire wall 14 to the Internet 16, and a further gateway fire wall 18 to secure a B3 assured security server 20. The fire walls are not essential to the system as the TAD is resistant to attacks over the Internet because commands cannot be sent to the device by that means.

The security server 20 is, in turn, connected to a global positioning system (GPS) verification secure database server 22 and an authentication infrastructure facility 24. The verification server 22 holds location information on subscriber sites which are preloaded when the subscriber contracts with the system provider. These are in the form compatible with location .information received from the TAD site when data transaction authentication is sought, as described below.

As will be seen in Figure 2, the Trusted Authentication Device includes a financial data input module, providing known means for reading smart cards via a reader, and magnetic cards via a swiping slot 26. The module also comprises a four line/twenty character liquid crystal display 28 and a personal identification number (PIN) trusted entry pad which is connected via a trusted path (ie a direct pin-connected pad/processor assembly) to the module processor (not shown). The housing for the module is attack resistant and the TAD processor is hardened against infiltration by its limited instruction set and in that instructions cannot be issued to it from outside the device.

The processor 10 and the personal computer 12 are loaded with software by which data in respect of a purchase, wager or other financial transaction entered into the module through the keypad is transmitted to the personal computer on receipt of a correctly entered PIN associated with the data read from the smart card or magnetic card, and the user pushing an authorisation key on the keypad. The computer is arranged to send data received from the module over the Internet. The USB port allows fast data connection to the personal computer and also for power to be drawn by the TAD.

The chip card reader supports both public key infrastructures (PKI), for example PKCS#11 (Public Key Cryptography Standard) smart cards and other conventional credit card/debit card secret key encryption technology.

The functionality of the TAD described thus far is based on the TAD manufactured by Enterprises Solutions, Inc. referred to above.

Also built into the module is a global positioning system (GPS) processing device with in-built antenna for receiving information from GPS satellites. In addition to the in-built antenna, the GPS processor is connected with an external amplified GPS antenna through a radio frequency BNC connector 32 and RG174 cable.

Typical GPS specifications provide information in a choice of positional coordinates, including latitude/longitude, map references, UTM UPS, Maidenhead and MGRS, for example. As is known, the GPS processor is programmed with data on the location of satellites from which co-ordinate information to provide a positional fix can be derived. GPS relies on triangulation between the data transmitted by at least 3 of the GPS satellites. The distances of a point on earth from each of the satellites from which the data is read represent a unique combination by which the fix can be derived. The GPS system is well-known to the person of ordinary skill in the art and will not be described in further detail here. It has an accuracy of 5°. The module 10 has a differential-ready GPS receiver 32 having 12 parallel satellite information channels which continuously track the satellites to provide positional information with an accuracy of 5° and a resolution of +/-1⁰. The GPS system is typically accurate to between 10 and 100 feet depending on the number of satellites from which data is received at any one time, with a resolution of 1 foot. In addition, the GPS processor can derive altitude information in the range minus to plus 30,000 feet.

The specifications for the external GPS antenna 36 include a frequency range of 1.57542GHz plus or minus 10MHz. Satellite information is received as right- hand circularly polarised transmissions. The gain of the aerial is 4.0dBic at antenna zenith. Radio frequency cable losses at 1.57542GHz are in the range of 3.5dB per ft. for the RG174 cable.

The built-in antenna amplifier gain is 27dB +/- 2dB with a noise figure of 1.15dB. The output voltage standing wave ratio is less than 1.5:1.

The invention is applicable to data transmission requiring authentication at a remote site of the data originator. This may be financial or other data. According to one embodiment of the invention, GPS co-ordinates (for example latitude and longitude) are held on the GPS verification secure database 22 for a subscriber. On receipt of position information from the module GPS unit, transmitted over the Internet by the computer together with a GPS data id field, the B3 assured security server 20 which accesses the main payment gateway and financial systems, recognises the GPS id field and accesses the GPS verification secure database 22 which passes relevant latitude and longitude information according to the identity of the alleged source of the data. The security server 20 decodes the latitude and longitude position information as transmitted and the GPS verification secure database 22 attempts to match the decoded position information to its own stored co-ordinates for the module site. The result of the attempt at matching is either success or failure of authorisation. If the result is failure, the data transfer is barred from the payment gateway and financial systems. Successful matching of stored coordinate data with that decoded from the transmitted data allows the security server 20 to pass the transaction data through the payment gateway. Thus, an attempt to send data from the source is initiated by transmission of the GPS latitude/longitude data from the security server 20 which then seeks a match with the GPS verification secure database 22. Only in the event of a successful match between the stored and received positional data is authorisation information passed back to the GPS TAD through the transaction computer to allow completion of the data transaction.

In an alternative embodiment, the position information is sent with the position information. If a successful match of the position information transmitted with that received is achieved, the security server 20 allows the financial data on to the payment gateway. For particularly sensitive data, extra user verification can be performed as part of the transaction by requiring the GPS TAD user to enter additional credentials. These credentials may be part of a public key infrastructure by which the data is encrypted, such that the GPS TAD is required to send the public key for decryption in the authentication infrastructure database 24 for submission to the security server 20. Other forms of authentication can take the place of the public key infrastructure as will be apparent to the person skilled in the art. However, the position information can form the basis of a basic authentication system on its own.

As mentioned above, the invention is applicable to data transmission requiring authentication at a remote site of the data originator. This may be financial or other data. A possible method of improving security is to use an e-wallet. An e-wallet is a system in which the payment details, for example credit card details, are held in a secure environment rather than being transmitted directly from the person making the payment, whether this be over the Internet or mobile phone or other mobile device such as a Personal Digital Assistant (PDA). The details are only released to the vendor after verification of the identity of the shopper. „ '

With the increasing availability of mobile phones, it is possible to use the mobile phone system as. a separate channel of identification from that used to make the purchase, whether that be by Internet, phone or face-to-face.

A further preferred embodiment of the invention is illustrated in Figure 3 which shows apparatus comprising the data source authentication system according to a preferred embodiment and in Figure 4 which shows the steps involved in implementing the system illustrated in Figure 3.

With regard to Figures 3 and 4, in step 1, the shopper 50 registers location information with the e-wallet (or the payment provider) defining the geographical areas in which purchases are authorised to be made using the shopper's payment details. Subsequently, if the shopper 50 decides to make a purchase, the shopper 50, having selected the goods to be purchased proceeds, in step 2, to the check-out where he may decide to pay by e-wallet. In step 3, the shopper 50 is then transferred to the e-wallet and is asked by the e-wallet supplier to provide identification to the identification apparatus 51 of the e- wallet supplier. This request may be passed, for example, by SMS message to the shopper's mobile phone 52 whose number has been registered by the subscriber to the e-wallet with the e-wallet provider/supplier. The SMS message may require a user ID, for example a PIN to be entered. The shopper 50, in step 4, then enters the PIN which is then transmitted to the e-wallet, by either the mobile device 52, or example a mobile phone, or via the Internet, where it is processed in step 5 by the verification apparatus 53 of the e-wallet provider. In step 6, the e-wallet then determines if the user ID, such as the PIN number is correct. In steps 5 and 6, if the user does not submit the requested user UD or if the submitted data is incorrect, the transaction will be denied in step 7. The e-wallet also determines, in step 8, the location of the mobile device 52 being used in connection with the transaction from information obtained from a position determining system 54. If the location of the mobile device 52 is determined to be outside an authorised area, the transaction is denied in step 9. If the PIN number is verified as correct and the location of the mobile device 52 is determined to be in an authorised area, a password specific to the transaction concerned is issued, in step 10, to the shopper, by the authorisation apparatus 55 of the e-wallet provider. In step 11, the shopper 50 then enters the password, preferably via the original payment channel, for example, by phone 52 or the Internet. The verification apparatus 53 verifies that the correct password has been entered in step 12. If an incorrect password has been entered, the transaction is denied. If it is determined that the correct password has been entered, this is taken as confirmation that the shopper 50 is the registered subscriber or authorised representative thereof having knowledge of the correct PIN and password. The card details of the shopper are then released in encrypted form to the vendor, in step 13, or through the payment provider thereby instructing payment to be made to the vendor. The transaction is then completed and payment made in step 14.

The position information providing the geographical information of the mobile device 52 being used by the shopper 50 in a particular transaction may be derived dynamically from a position fixing system 54, such as the global positioning system (GPS) or from other sources as described above with regard to the other embodiments of the invention. In particular, it may be obtained either from the phone company providing the service to the mobile phone 52, from a GPS receiver incorporated in the mobile device 52, or from a GPS receiver incorporated in the point of sale terminal 56.

Verification of the shopper's PIN is conducted in the same manner as described above with respect to the earlier described embodiments.

In a preferred embodiment, the shopper 50 may specify that he will only use the mobile device 52, for example, his mobile phone, for transactions in a particular location. The location information of the mobile device 52 being used in the transaction could be obtained from, for example, the phone company by dialling a special number. The accuracy of the location information obtained in this manner will depend upon the location concerned and the telephone company operator, but this system allows transactions to be carried out using mobile devices not having a GPS receiver.

In a further preferred embodiment, a shopper 50 may register more than one geographical zone, enabling transactions to be carried out from more than one location, for example, at home and at work.

Furthermore, use may be limited to a particular country and, in a preferred embodiment, default zones may be set, permitting use, for example, only in the shopper's home country unless the shopper 50 defines other countries in which use is to be permitted.

In a further preferred embodiment, the shopper 50 may chose to register use in large geographical zones, such as Greater London, or in as small a geographical area as he wishes.

The use of this zoning using position information systems 54 can improve the security of transactions by preventing transactions being made unless the mobile device 52 be within an area specified by the shopper/card holder 50.

In an alternative embodiment, in its simplest form, all that may be necessary to complete the transaction is for the user 50 to send a confirmation message approving the transaction from his mobile device 52, assuming the positional data is transmitted or obtained automatically from the position determining system 54. Furthermore, the entire transaction may be conducted using the mobile device 52 ("m-commerce").

The advantage of the above method is that security is enhanced as the card details of the shopper are not provided by the user 50 over a potentially insecure medium, but at least two forms of identification are used, for example, a PIN, and a verification that the shopper 50 is in an approved geographical location from which transactions may be made. This is submitted to the e-wallet, and, upon verification, the e-wallet retrieves the card details of the user 50 and payment is completed. The shopper's card details and approved geographical transaction locations may be pre-stored and held by the e-wallet.

In an alternative embodiment, in step 3, the SMS message could be generated directly by the internet payment provider and the user 50 replies to the SMS message, for example, by inserting a PIN which, if correct, confirms that the mobile user 50 is the authorised shopper or his authorised representative.

In a further alternative embodiment, in step 3, when the shopper 50 is requested to identify himself to the e-wallet, he could enter his mobile phone number into the payment page instead of his card number by which payment is to be made. An encrypted message may be transmitted via the user's mobile phone 52 to the e-wallet to provide the card details. Before the card details are released, the e- wallet verifies with the phone company that the specified mobile phone number is actually that being used in a particular transaction (caller line identification).

In a preferred embodiment, a third party e-wallet provider could hold payment details and mobile phone numbers and trigger the transmission of an SMS message, in stage 4, whenever a payment is initiated using the e-wallet. The SMS message may demand a reply before the transaction is finalised, for example, the submission of a password or PIN. The SMS message may act as an independent receipt of the transactions.

In a further embodiment, a card issuer could be the provider of the SMS message in step 4 rather than the e-wallet provider.

Alternatively, the identification used in step 4 to identify the shopper 50 may be a Personal Digital Assistant (PDA) arranged to capture an electronic image of a card holder's signature to confirm a transaction, or a mobile device used in conjunction with various recognition methods such as voice or retina, to confirm identification.

In a further preferred embodiment, an e-wallet may be incorporated in the mobile device 52 which may be used as the payment instrument, using for example, PKI encryption. The phone line charges incurred during the transaction may then be charged to the user. The identification of the user in step 4 is conducted at a fixed site by the user's mobile phone.

In another preferred embodiment, the shopper's mobile device may constitute the payment instrument and communicates in-store with an EFTPOS terminal using, for example, infrared connection or Bluetooth short-range radio technology. The mobile device 52 could act as a virtual wallet. The identification to the e-wallet in step 4 may require a PIN to be entered at the EFTPOS terminal or may require other identification such as voice and/or retina identification which is conducted at the EFTPOS terminal. Whilst the above systems have been described in relation to financial transactions, it will be appreciated that similar methods could be used to secure transactions involving confidential data such as medical records, as well as financial transactions.

Furthermore, whilst the above systems have been described such that the position information is sent by the same medium as the data, it is also possible for the two to use different communication techniques.

Claims

CLAIMS:

1. A data source authentication device comprising means for transmitting data, means for deriving position information relevant to the location of the device, and means for transmitting the position information.

2. A data source authentication device according to claim 1, wherein the means for transmitting the position information is a mobile device.

3. A data source authentication device according to claim 1, wherein the means for transmitting the position information is an electronic network.

4. A data source authentication device according to claim 1, wherein the means for transmitting the position information is a position fixing system.

5. A data source authentication device according to claim 4, wherein the position fixing system is a global positioning system.

6. A data source authentication device according to any preceding claim, further comprising an encoder for encoding the data transmitted, and a decoder for decoding the encoded data.

7. A data source authentication device for authenticating the identity of a user according to any preceding claim, further comprising identification apparatus for receiving information relevant to the identity of the user, verification apparatus for verifying the identity of the user, authorisation apparatus for authorising release of details relating to the user.

8. A data source authentication device for authenticating the identity of a user according to claim 7, further comprising a receiver for receiving the details relating to the user.

9. A data source authentication device for authenticating the identity of a user according to claim 7 or 8, wherein the means for transmitting the position information is connected to the receiver for receiving the details relating to the user.

10. A data source authentication device for authenticating the identity of a user according to claim 7 or 8, wherein the means for transmitting the position information is connected to the means for transmitting data.

11. A data source authentication device for authenticating the identity of a user according to claim 7 or 8, wherein the means for transmitting the position information is part of a cellular network.

12. A financial transaction system comprising a data authentication device according to any preceding claim.

13. A method of data authentication comprising storing authorising data specific to a particular user, requesting and receiving user identification data, comparing the requested user identification data with the stored authorising data, requesting and receiving data identifying the geographical location of the user, determining if the received geographical location data is within authorised limits stored in the authorising data specific to the particular user, and verifying the identity of the user based on a matching of the user identification data with the stored authorising data.

14. A method of data authentication according to claim 13, further comprising approving release of data specific to the particular user in response to verification of the identity of the user.

15. A data authentication system comprising a data authentication device operable to generate the data and position information relevant to the location of the device, and to transmit position information, the system further comprising means for receiving the position information, means for storing information on location of the device, and means for comparing the received position information with the stored information in order to verify the source of the data.

16. A data authentication system according to claim 15, wherein the data authentication device comprises a transmitter for transmitting data, and the transmitter is a mobile telephone.

17. A data authentication system according to claim 15, wherein the data authentication device comprises a transmitter for transmitting data, and the transmitter is an electronic network.

18. A data authentication system according to claim 15, wherein the data authentication device comprises a position information transmitter, and the position information transmitter is a position fixing system.

19. A data authentication system according to claim 18, wherein the position fixing system is a global positioning system.

20. A data authentication system according to any of claims 15 to 19, further comprising an encoder for encoding the data transmitted, and a decoder for decoding the encoded data.

21. A data authentication system for authenticating the identity of a user according to any of claims 15 to 20, further comprising identification apparatus for receiving information relevant to the identity of the user, verification apparatus for verifying the identity of the user, authorisation apparatus for authorising release of details relating to the user.

22. A data authentication system for authenticating the identity of a user according to claim 21, further comprising a receiver for receiving the details relating to the user.

23. A data authentication system for authenticating the identity of a user according to claim 21 or 22, wherein the data authentication device comprises a position information determining apparatus, and the position information determining apparatus is connected to the receiver for receiving the details relating to the user.

24. A data authentication system for authenticating the identity of a user according to claim 21 or 22, wherein the data authentication device comprises a position information determining apparatus, and the position information determining apparatus is connected to the transmitter for transmitting data.

25. A data authentication system for authenticating the identity of a user according to claim 21 or 22, wherein the data authentication device comprises' a position information determining apparatus, the position information determining apparatus being part of a cellular network.

26. A financial transaction system comprising a data authentication system according to any of claims 15 to 25.

27. A data source authentication device substantially as hereinbefore described with reference to any one embodiment as that embodiment is illustrated in the accompanying drawings.

28. A data authentication system substantially as hereinbefore described with reference to any one embodiment as that embodiment is illustrated in the accompanying drawings.

29. A financial transaction system substantially as hereinbefore described with reference to any one embodiment as that embodiment is illustrated in the accompanying drawings.

30. A method of data authentication substantially as hereinbefore described with reference to any one embodiment as that embodiment is illustrated in the accompanying drawings.

3 LA data source authentication device comprising a transmitter for transmitting data, a position information determining apparatus for deriving position information relative to the location of the device, and a position information transmitter for transmitting position information.

i 32. A data source authentication device according to claim 31, wherein the transmitter for transmitting data is a cellular telephone.

33. A data source authentication device according to claim 31, wherein the transmitter for transmitting data is an electronic network.

34. A data source authentication device according to claim 31 wherein the position information transmitter is a position fixing system.

35. A data source authentication device according to claim 34 wherein the position fixing system is a global positioning system.

36. A data source authentication device according to claim 31, further comprising an encoder for encoding the data transmitted, and a decoder for decoding the encoded data.

37. A data source authentication device for authenticating the identity of a user according to claim 31, further comprising identification apparatus for receiving information relevant to the identity of the user, verification apparatus for verifying the identity of the user, authorisation apparatus for authorising release of details relating to the user.

38. A data source authentication device for authenticating the identity of a user according to claim 37, further comprising a receiver for receiving the details relating to the user.

39. A data source authentication device for authenticating the identity of a user according to claim 38, wherein the position information determining apparatus is connected to the receiver for receiving the details relating to the user.

40. A data source authentication device for authenticating the identity of a user according to claim 38, wherein the position information determining apparatus is connected to the transmitter for transmitting data.

4 LA data source authentication device for authenticating the identity of a user according to claim 38, wherein the position information determining apparatus is part of a cellular network.

42. A financial transaction system comprising a data authentication device according to claim 31.

43. A method of data authentication comprising storing authorising data specific to a particular user, requesting and receiving user identification data, comparing the requested user identification data with the stored authorising data, requesting and receiving data identifying the geographical location of the user, determining if the received geographical location data is within authorised limits stored in the authorising data specific to the particular user, and verifying the identity of the user based on a matching of the user identification data with the stored authorising data.

44. A method of data authentication according to claim 43, further comprising approving release of data specific to the particular user in response to verification of the identity of the user.

45. A data authentication system comprising a data authentication device operable to generate the data and position information relevant to the location of the device, and to transmit position information, the system further comprising a receiver for receiving the position information, a store for storing information on the location of the device, and comparison apparatus for comparing the received position information with the stored information in order to verify the source of the data.

46. A data authentication system according to claim 45, wherein the data authentication device comprises a transmitter for transmitting data, and the transmitter is a cellular telephone.

47. A data authentication system according to claim 45, wherein the data authentication device comprises a transmitter for transmitting data, and the transmitter is an electronic network.

48. A data authentication system according to claim 45, wherein the data authentication device comprises a position information transmitter, and the position information transmitter is a position fixing system.

49. A data authentication system according to claim 48, wherein the position fixing system is a global positioning system.

50. A data authentication system according to claim 45, further comprising an encoder for encoding the data transmitted, and a decoder for decoding the encoded data.

51. A data authentication system for authenticating the identity of a user according to claim 45, further comprising identification apparatus for receiving information relevant to the identity of the user, verification apparatus for verifying the identity of the user, authorisation apparatus for authorising release of details relating to the user.

52. A data authentication system for authenticating the identity of a user according to claim 51, further comprising a receiver for receiving the details relating to the user.

53. A data authentication system for authenticating the identity of a user according to claim 52, wherein the data authentication device comprises a position information determining apparatus, and the position information determining apparatus is connected to the receiver for receiving the details relating to the user.

54. A data authentication system for authenticating the identity of a user according to claim 52, wherein the data authentication device comprises a position information determining apparatus, and the position information determining apparatus is connected to the transmitter for transmitting data.

55. A data authentication system for authenticating the identity of a user according to claim 52, wherein the data authentication device comprises a position information determining apparatus, the position information determining apparatus being part of a cellular network.

56. A financial transaction system comprising a data authentication system according to claim 55.