Abstract:
A system and a method are used for certification when paying online or confirming the user&#39;s identity using the communication network. The system mainly includes a certification system ( 1 ), a bank website ( 2 ), a mobile telephone network ( 3 ), a user terminal ( 4 ) and a user mobile telephone ( 5 ) and so on. The method includes: the step for certification between the certification system ( 1 ) and the user mobile telephone ( 5 ) using the mobile telephone network ( 3 ), the step for calculating the certification code ( 8 ) using a certification formula ( 7 ) defined by the user ( 6 ), the step for certification by sending the certification formula ( 7 ) defined by the user ( 6 ) to the certification system ( 1 ) and storing it therein, then calculating the certification code ( 8 ) in the certification system ( 1 ) or by sending the certification formula ( 7 ) defined by the user ( 6 ) to the bank website ( 2 ) and storing it therein, then calculating the certification code ( 8 ) in the bank website ( 2 ). The present invention may efficiently prevent any hacker from hacking the certification code ( 8 ), and thus the use of the method and system provides high security for online payment.

Description:
TECHNICAL FIELD 
       [0001]    The present invention relates to a method and system for online payment, and particularly to a method and system for online payment with random certification. 
       BACKGROUND OF THE INVENTION 
       [0002]    The popularity of online payment such as e-bank is increasing. Due to the popularity of online shopping, online business purchasing and online individual shopping and the like are made via the e-bank, either paying by credit card through a network or paying by using a communication network system, and even the depositing and withdrawing of money via an automatic teller machine or ATM of a bank are also made by using a communication network system. However, the security of online payment is of the greatest importance for payment via a network. Many of previous patents or patent applications have related to this issue, including previous patent applications of numbers 00109820.9 and 01119849.4 to the inventor, both of which propose to use random dynamic code for online certification so as to assure secure online payment. Since there are hackers in the network industry who often take advantage of loopholes in network programs to hack the information of paying customers, such as bank customers, customers owning various fiscards, etc. during online transactions, including hacking the random dynamic code. As a result, secure online payment is somewhat threatened and the dynamic code may be stolen, which may incur losses to various persons such as bank customers when they pay online. 
         [0003]    Therefore, a more advanced certification method for online payment and the corresponding system thereof are desirable, and a method and system in which any hacker will not succeed even if he has stolen the dynamic code is also in an urgent need. 
       SUMMARY OF THE INVENTION 
       [0004]    The object of the present invention is to provide a novel certification method for online payment and the corresponding system thereof, in which a dynamic code can not work directly and thus can not be used directly even if it is stolen, thereby assuring the security of online payment via the communication network. The system of the present invention is also applicable to all circumstances of online payment, including banking, credit card certification, ATM withdrawing certification and the like. In the specification, the bank website ( 2 ) refers to various online payment facilities. 
         [0005]    The object of the present invention is achieved by adopting such a method for certification when paying online using a communication network, said method comprising the steps of: 
         [0006]    certificating between a certification system ( 1 ) and a user mobile telephone ( 5 ) via a mobile telephone network ( 3 ), 
         [0007]    calculating a certification code ( 8 ) using a certification formula ( 7 ) defined by the user ( 6 ), 
         [0008]    certificating by sending the certification formula ( 7 ) defined by the user ( 6 ) to the certification system ( 1 ) and storing it therein, then the certification system ( 1 ) calculating the certification code ( 8 ), or by sending the certification formula ( 7 ) defined by the user ( 6 ) to the bank website ( 2 ) and storing it therein, then the bank website ( 2 ) calculating the certification code ( 8 ); 
         [0009]    and the object is also achieved by a communication network certification system mainly comprising a certification system ( 1 ), a bank website ( 2 ), a mobile telephone network ( 3 ), a user terminal ( 4 ) and a user mobile telephone ( 5 ), a certification formula ( 7 ) defined by the user ( 6 ) and a certification code ( 8 ) and the like. 
         [0010]    The present invention is characterized in that an alternative approach certification method is used, in which the mobile telephone network is also used as a second approach for the transmission of certification information, in addition to using the original network for the transmission of certification information. The certification center places a call to the user telephone using a dynamic telephone number, the last part of the displayed number seen by the user on the mobile telephone being a random dynamic code. The certification code is calculated with the certification formula pre-defined by the user using operations such as addition, subtraction, multiplication and division, and then the user uses his/her own mobile telephone to dial the telephone number composed of the main telephone number of the certification system and the certification code to the certification system. The certification system recognizes, from the incoming call number, that it is the call placed by the user, the last part of the dialed number being the certification code of the user. Even if the dynamic code is intercepted by a hacker, since the hacker can not calculate the certification code without the user&#39;s own formula, and the certification code is required to be transmitted from the mobile telephone of the user, the hacker can not be successfully certificated. The present invention is applicable to all online payment certifications and various applications that require certifications, including e-bank certification, credit card certification, ATM withdrawing certification, credit card companies, stock broker companies, file storage certification, financial institutions, website and personal information certifications. 
         [0011]    The important features and advantages of the present invention are the method for certification, which may improve the deficiency of current certification that uses only the code, and may make full use of the characteristics that the mobile telephone network and the mobile telephone may not be forged easily, thereby using a simple and low cost method to implement the alternative approach certification. Take the GSM mobile telephone network for example, if someone duplicates the SIM card of a user, as soon as the coexistence of the mobile telephone with the duplicated SIM card and the mobile telephone of the user is detected, the mobile telephone company will disable the mobile telephone number and the SIM card of the user. Later, the user should apply to the mobile telephone company for a new SIM card so that he/she can continue to use this mobile telephone number. This characteristic makes the mobile telephone network more secure and reliable compared with the Internet. 
         [0012]    Furthermore, the main advantages and features of the present invention include: 
         [0013]    1. The certification formula is defined by the user and is known only by the user, and the user calculates the certification code using the certification formula upon receipt of the random code. So far, however, no additional formula is used for confirmation, while commonly the received code or the code displayed on a code generator is directly inputted. This is the innovation of the present invention. 
         [0014]    2. The code is transmitted by means of caller ID display. 
         [0015]    3. Two different approaches are used for certification, one being the currently-used Internet, the other being the mobile telephone network. 
     
    
     
       DESCRIPTION OF THE DRAWINGS 
         [0016]      FIG. 1  is an illustration of the method and system according to the present invention. 
       
    
    
     DESCRIPTION OF PREFERRED EMBODIMENTS 
       [0017]    The method and system according to the present invention will be further described in detail below in connection with the accompanying drawing. 
         [0018]    The described drawing and its illustration are all illustrative, and the spirit of the present invention is not limited by the specific illustration of the embodiments. 
         [0019]    Referring now to  FIG. 1 , which shows the system according to the present invention. The communication network certification system according to the present invention mainly comprising: 
         [0020]    a certification system ( 1 ), which is a communication device having a computer, mainly including a random dynamic code generator ( 1 - 1 ) and a dialer ( 1 - 2 ), wherein the random dynamic code generator ( 1 - 1 ) is a computer server, having a random code generation program installed therein for generating a random numeric string code of specified length, in accordance with predetermined procedures; a dialer ( 1 - 2 ), which is a telephone exchange device connected to the mobile telephone network directly or through the fixed telephone network, wherein the telephone number of the user mobile telephone may be dialed in accordance with predetermined procedures using the line of the telephone number provided by the mobile telephone network or fixed telephone network operator; or the random dynamic code may also be sent to the user by means of SMS or MMS in accordance with predetermined procedures; 
         [0021]    a bank website ( 2 ), which is an online transaction website for various of financial institutions or a website that needs to certificate the user&#39;s identity; 
         [0022]    a mobile telephone network ( 3 ), which is a common mobile telephone network, such as GSM network, CDMA network, etc.; 
         [0023]    a user terminal ( 4 ), generally being a computer or any of various electronic devices that can be connected to the network and be capable of online payment, 
         [0024]    a user mobile telephone ( 5 ), 
         [0025]    a certification formula ( 7 ), which is defined by the user ( 6 ) and by which the certification code ( 8 ) is calculated, wherein certification is performed by the user by sending the certification formula ( 7 ) defined by the user to the certification system ( 1 ) and storing it therein, then the certification system ( 1 ) calculating the certification code ( 8 ), or by the user by sending the certification formula ( 7 ) defined by the user to the bank website ( 2 ) and storing it therein, then the bank website ( 2 ) calculating the certification code ( 8 ). 
         [0026]    With the utilization of the above described system of the present invention, the object of the present invention may be achieved in several different steps. 
         [0027]    The first set of methods according to the present invention is composed of the set A of steps A1 to A8, wherein:
       A1. the certification is performed by the user ( 6 ) by defining the certification formula ( 7 ) in the certification system ( 1 ) in advance and storing it therein, then the certification system ( 1 ) calculating the certification code ( 8 );   A2. The user ( 6 ) logs on the bank website ( 2 ) using the user terminal ( 4 ), and enters the log-in account number and password ( 0 ) therein;   A3. After checking that the log-in account number and password of the user ( 6 ) are correct, the bank website ( 2 ) finds the number of the user mobile telephone ( 5 ) from the log-in account number of the user ( 6 ), and sends the number of the user mobile telephone ( 5 ) to the certification system ( 1 );   A4. The certification system ( 1 ) generates a random dynamic code having a length of N digits through the dynamic code generator ( 1 - 1 ), and then dials, through the dialer ( 1 - 2 ), the number of the user mobile telephone ( 5 ) using the telephone line of the telephone number composed of the main telephone number of the certification system ( 1 ) and the random dynamic code, and hooks on as soon as the call is put through;   A5. When the user ( 6 ) sees the caller number of the certification system ( 1 ) by means of the caller ID display on the mobile telephone ( 5 ), he/she knows that the last N digits of the number of the incoming call are the random dynamic code, and then calculates the certification code ( 8 ) using the certification formula ( 7 ) pre-defined by the user;   A6. The user ( 6 ) replaces the original last N digits of the incoming call from the certification system ( 1 ) with the N digits of the certification code ( 8 ) in order to form a certification telephone number including the certification code ( 8 ), and then dials the certification telephone number to the certification system ( 1 ) through the user mobile telephone ( 5 ), and hooks on as soon as the call is put through;   A7. Upon receipt of the incoming call from the user ( 6 ), the certification system ( 1 ) finds the number dialed to the user mobile telephone ( 5 ) in step A4 and the random code from the records of the certification system ( 1 ) based on the number of the incoming call from the user mobile telephone ( 5 ), calculates the certification code ( 8 ) and the certification telephone number based on the random code using the certification formula ( 7 ) defined by the user in step A1, the certification is successful as long as the certification telephone number calculated is the same as the certification telephone number dialed by the user mobile telephone;   A8. Upon successful certification, the certification system ( 1 ) informs the bank website ( 2 ) that the number of the mobile telephone ( 5 ) just sent by the bank website ( 2 ) in step A3 is certificated successfully, and the bank website ( 2 ) may permit the user ( 6 ) to log on formally.       
 
         [0036]    For the N digits in the above described steps A4, A5 and A6, N is a positive integer, preferably 6 or 7 or 8. 
         [0037]    The certification system ( 1 ) of the present invention has a particularly unique nature that is as unique DNA gene in a human body, and hence the certification system ( 1 ) in the system of the present invention may also be called DNA certification system. 
         [0038]    To implement the present invention in terms of telephone numbers of communications, DNA certification system is required first to apply to the mobile telephone company or fixed telephone network company for a plurality of telephone lines and a plurality of telephone numbers, for example, for 100 telephone lines and 1,000,000 telephone numbers, wherein the last 6 digits of a telephone number, or other code length, i.e., the above mentioned N digits, may be used as the code (e.g., 95599-XXXXXX), and the telephone number may be extended, i.e., more digits may be added to the end of the commonly-used telephone numbers, for the purpose of increasing usable numbers. Take Hong Kong telephone numbers for example, a telephone number in Hong Kong has 8 digits, upon addition of 3 digits to the number, the number of usable telephone numbers are significantly increased by 1,000 times. For example, when one applies to the telephone company for a set of telephone numbers beginning with fixed 5 digits, occupying 1,000 of 8-digit telephone numbers. If the telephone number is changed to 11-digit telephone number by the addition of 5 digits, the number of all the usable telephone numbers will be up to 1,000,000. For example, the telephone number beginning with fixed digits of 31000 is 31000XXXXXX, the usable numbers are from 31000000000 to 31000999999, totaling 1,000,000 telephone numbers, wherein the first 5 digits are fixed and used as the so-called main telephone number of the DNA certification system ( 1 ). The user will know that it is the number from the DNA certification system ( 1 ) as soon as he/she sees the incoming call number beginning with these 5 digits. 
         [0039]    At the same time, the user ( 6 ) has to register his/her own mobile telephone number on the website and set the log-on account number and password for the bank website ( 2 ), and define a set of certification formulas ( 7 ); the certification formula ( 7 ) is defined by the user, which may be operations such as addition, subtraction, multiplication, division and shift, and the calculating method is defined by the user. 
         [0040]    The above description is applicable to each set of methods according to the present invention, including those illustrated in set B of steps and set C of steps described below. 
         [0041]    In the above step A5, the certification formula ( 7 ) defined by the user ( 6 ) is for example: (the random dynamic code+1968)/12−8, wherein the decimal point is ignored, that is, the first 6 digits form the certification code ( 8 ). 
         [0042]    For example, the user ( 6 ) sees that the number of the incoming call from the certification system ( 1 ) on the mobile telephone ( 5 ) is 31000546382, he/she knows that the last 6 digits, i.e., 546382, are the random code. 
         [0043]    The certification formula is calculated as: (546382+1968)/12−8=45687.833333; 
         [0044]    The decimal point in the result 45687.833333 is ignored, that is, the first 6 digits of 45687.833333, i.e., 456878, are the certification code ( 8 ). 
         [0045]    In addition, step A9 may be added to the above steps, that is: 
         [0046]    A9. When the user ( 6 ) makes a transaction of a large amount of money, the bank website ( 2 ) may again ask the user to certificate, in order to ensure the security of the user account. 
         [0047]    The amount of the transaction of a large amount of money may be determined respectively by each of banks, financial institutions and user ( 6 ) according to particular situations. 
         [0048]    The specific steps of the second embodiment of the method of the present invention are composed of the following steps B1 to B8, wherein:
       B1. the certification is performed by the user ( 6 ) by defining the certification formula ( 7 ) in the bank in advance and storing it in the bank website ( 2 ), then the bank website ( 2 ) calculating the certification code ( 8 );   B2. The user ( 6 ) logs on the bank website ( 2 ) using the user terminal ( 4 ), and enters the log-in account number and password ( 0 ) therein;   B3. After checking that the log-in account number and password of the user ( 6 ) are correct, the bank website ( 2 ) finds the number of the user mobile telephone ( 5 ) from the log-in account number of the user ( 6 ), and sends the number of the user mobile telephone ( 5 ) to the certification system ( 1 );   B4. the certification system ( 1 ) generates a random dynamic code having a length of N digits through the dynamic code generator ( 1 - 1 ), and sends the random dynamic code to the user by one of:
           B41. dialing, through the dialer ( 1 - 2 ), the number of the mobile telephone ( 5 ) of the user ( 6 ) using the telephone line of the telephone number composed of the main telephone number of the certification system ( 1 ) and the random dynamic code, and hooks on as soon as the call is put through; or   B42. sending, by the certification system ( 1 ), the random dynamic code to the user mobile telephone ( 5 ) via text message; or   B43. sending, by the certification system ( 1 ), the random dynamic code to the user mobile telephone ( 5 ) via MMS;   sending, by the certification system ( 1 ), the random dynamic code to the bank website ( 2 ) at the same time;   
           B5. When the user ( 6 ) sees the caller number of the certification system ( 1 ) by means of the caller ID display on the mobile telephone ( 5 ), he/she knows that the last N digits of the number of the incoming call are the random dynamic code, or sees the random dynamic code from the content of the text message or MMS, and then calculates the certification code ( 8 ) using the certification formula ( 7 ) pre-defined by the user ( 6 );   B6. Entering, by the user ( 6 ), the N digits of the certification code ( 8 ) to the bank website ( 2 );   B7. The bank website calculates the certification code ( 8 ) using the certification formula defined by the user ( 6 ) in step B1 from the random dynamic code sent by the certification system ( 1 ) in step B4, the certification is successful as long as the certification code ( 8 ) calculated is the same as the certification code entered by the user ( 6 ) in step B6;   B8. Upon successful certification, the bank website ( 2 ) may permit the user ( 6 ) to log on formally.       
 
         [0061]    Similarly, for example, in the above step B5, the certification formula ( 7 ) defined by the user ( 6 ) is for example: (the random dynamic code+1968)/12−8, wherein the decimal point is ignored, that is, the first 6 digits form the certification code ( 8 ). 
         [0062]    For example, the user ( 6 ) sees that the number of the incoming call from the certification system ( 1 ) is 31000546382, he/she knows that the last 6 digits, i.e., 546382, are the random code, 
         [0063]    then the certification formula is calculated as: (546382+1968)/12−8=45687.833333; 
         [0064]    The decimal point in the result 45687.833333 is ignored, that is, the first 6 digits of 45687.833333, i.e., 456878, are the certification code ( 8 ). 
         [0065]    Similarly, step B9 may also be added, that is: 
         [0066]    B9. When the user ( 6 ) makes a transaction of a large amount of money, the bank website ( 2 ) may again ask the user to certificate, in order to ensure the security of the user account. 
         [0067]    A further improvement on the set B of steps in the present embodiment is embodied in step B5, in which, as soon as the user ( 6 ) receives the caller call from the certification system ( 1 ) with the random dynamic code number, he/she uses his/her mobile telephone ( 5 ) to dial the random dynamic code telephone number, and hooks on as soon as the call is put through; on the other hand, upon receipt of the incoming call, the certification system ( 1 ) knows that it is a call from the user ( 6 ) based on the number of the incoming call and that the user ( 6 ) has confirmed, and transmits the confirmation information to the bank website ( 2 ) immediately. In this way, the security of certification may further be enhanced. 
         [0068]    The specific steps in the third set of steps of the present invention are composed of the following steps C1 to C8, wherein:
       C1. the certification is performed by the user ( 6 ) by defining the certification formula ( 7 ) in the certification system ( 1 ) in advance and storing it therein, then the certification system ( 1 ) calculating the certification code ( 8 );   C2. The user ( 6 ) logs on the bank website ( 2 ) using the user terminal ( 4 ), and enters the log-in account number and password ( 0 ) therein;   C3. After checking that the log-in account number and password of the user ( 6 ) are correct, the bank website ( 2 ) finds the number of the user mobile telephone ( 5 ) from the log-in account number of the user ( 6 ), and sends the number of the user mobile telephone ( 5 ) to the certification system ( 1 );   C4. The certification system ( 1 ) generates a random dynamic code having a length of N digits through the dynamic code generator ( 1 - 1 ), and sends the random dynamic code to the user mobile telephone ( 5 ) by means of text message or MMS;   C5. The user ( 6 ) knows that it is a text message or MMS sent by the certification system ( 1 ) based on the caller number in the text message or MMS, and sees the random dynamic code from the content of the text message or MMS, and then calculates the certification code ( 8 ) using the certification formula ( 7 ) predefined by the user ( 6 );   C6. The user ( 6 ) uses his/her own mobile telephone ( 5 ) to transmit the certification code ( 8 ) back to the certification system ( 1 ) by means of text message or MMS;   C7. Upon receipt of the certification code ( 8 ) sent back by the user ( 6 ) using his/her mobile telephone ( 5 ), the certification system ( 1 ) finds the random dynamic code sent to the user ( 6 ) in step C4 from the records of the certification system ( 1 ) based on the number of the incoming call from the user mobile telephone ( 5 ), calculates the certification code ( 8 ) based on the random dynamic code using the certification formula ( 7 ) defined by the user ( 6 ) in step C1, the certification is successful as long as the certification code ( 8 ) calculated is the same as the certification code sent back by the user mobile telephone;   C8. Upon successful certification, the certification system ( 1 ) informs the bank website ( 2 ) that the number of the mobile telephone ( 5 ) just sent by the bank website ( 2 ) in step C3 is certificated successfully, and the bank website ( 2 ) may permit the user ( 6 ) to log on formally.       
 
         [0077]    As in the previously described set A of steps and set B of steps, the same example is used in step C5, in which the calculation of the certification code based on the certification formula ( 7 ) is illustrated. 
         [0078]    Similarly, the certification formula ( 7 ) defined by the user ( 6 ) is for example: (the random dynamic code+1968)/12−8, wherein the decimal point is ignored, that is, the first 6 digits form the certification code ( 8 ). 
         [0079]    For example, the user ( 6 ) sees that the caller number is 31000546382, he/she knows that the last 6 digits, i.e., 546382, are the random code, 
         [0080]    then the certification formula is calculated as: (546382+1968)/12−8=45687.833333; 
         [0081]    The decimal point in the result 45687.833333 is ignored, that is, the first 6 digits of 45687.833333, i.e., 456878, are the certification code ( 8 ). 
         [0082]    The certification formula ( 7 ) is defined by the user ( 6 ), and more examples of the certification formula ( 7 ) defined by the user are illustrated as follows: 
       Example 1 
       [0083]    a six-digit code is used, and the random code is 945218: 
         [0084]    The certification formula ( 7 ) is: the random code×7−111100, 
         [0000]      945218×7−111100=6505426, 
         [0085]    The first six digits, i.e., 650542, are the certification code ( 8 ); 
       Example 2 
       [0086]    an eight-digit code is used, and the random code is 54125236, 
         [0087]    The certification formula ( 7 ) is: (the resulting number obtained by exchanging the first two digits with the last two digits for the random code)×3, 
         [0088]    Exchanging the first two digits with the last two digits for 54125236=36125254, 
         [0000]      36125254×3=108375762, 
         [0089]    The first eight digits, i.e., 10837576, are the certification code ( 8 ); 
       Example 3 
       [0090]    a seven-digit code is used, and the random code is 6589462, 
         [0091]    The certification formula ( 7 ) is: (the resulting number obtained by changing the 4 th  to 6 th  digits to 128)×9+1668, 
         [0092]    Changing the 4 th  to 6 th  digits for 6589462 to 128=6581282, 
         [0000]      6581282×9+1668=59233206, 
         [0093]    The first seven digits, i.e., 5923320, are the certification code ( 8 ); 
       Example 4 
       [0094]    a ten-digit code is used, and the random code is 9452123176, 
         [0095]    The certification formula ( 7 ) is: (the 7 th  digit for the random code+1 and the 8 th  digit+1), 
         [0096]    The 7 th  digit+1 and the 8 th  digit+1 for 9452123176=9452124276, 
         [0097]    The first ten digits, i.e., 9452124276, are the certification code ( 8 ); 
         [0098]    The length (digits) of the random code, i.e., the random dynamic code may be the same as the certification code ( 8 ), for example, “N” as used in this specification is only to make it convenient for user to remember. Instead, the two can be of different length, for example, it is also possible that the certification code ( 8 ) is fixed to 6 digits and so on, which falls within the protected scope of the present invention. 
         [0099]    Since telephone numbers used in telephone networks in various countries are different in length, a dynamic code with an appropriate length may be selected accordingly; the most ideal length is 6 to 8 digits. The mobile telephone network used in the present invention is not connected to the Internet directly, so even if a hacker hacks the log-on password of the user ( 6 ) using any Trojan and Spyware programs, as he does not have the mobile telephone ( 5 ) of the user ( 6 ), he can not receive the random dynamic code from the DNA certification system; besides, the hacker does not have the certification formula ( 7 ) defined by the user ( 6 ) either, so he can not be certificated, thereby assuring the security of online payment for the user ( 6 ). 
         [0100]    In view of the foregoing, a ninth step may be added to the end of the various above-mentioned sets of steps, that is: 
         [0101]    When the user ( 6 ) makes a transaction of a large amount of money, the bank website ( 2 ) may again ask the user to certificate, in order to ensure the security of the user account. 
         [0102]    And the algorithm of the certification code ( 8 ) is that, when the non-integer result is obtained by calculating the random dynamic code using the certification formula ( 7 ), the decimal point of the result is ignored, that is, the first N digits are the certification code ( 8 ). 
         [0103]    The abbreviation MMS used herein refers to Multimedia Messaging Service. 
         [0104]    Also, the above described certification method is characterized in that, the certification method performs certification via two different approaches, one being the currently-used Internet, the other being the mobile telephone network ( 3 ). 
         [0105]    And the above described certification method is characterized in that, both of the random dynamic code and the certification code ( 8 ) are transmitted using caller ID display. 
         [0106]    And the above described certification method is applicable to all online payment certifications, including e-bank certification, credit card certification, ATM withdrawing certification, and also including various applications that require certification, such as user&#39;s identity certification, personal loan database certification, website and personal information certification, financial institution certification, file storage certification, stock broker company certification, and the like. 
         [0107]    The implementation of the certification method according to the present invention may bring excellent effects for parties like the bank and the user.