JP2003006546A - Information providing method and system utilizing mondex card - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the introduction cost of an authentication processing func tion on an information provision service provider side and to safely provide information held by an information provision service provide only to a specified user. SOLUTION: For an information provision request from a user computer to an information provision computer, an authentication processing by a Mondex (R) purse care is requested from the information provision computer to the user computer. The user computer performs individual authentication processing by the Mondex purse card held by a user, and further a Mondex card authentication computer performs card authentication processing for confirming the authenticity of the Mondex purse card itself. When individual authentication and card authentication are successfully performed, Mondex purse card identification information is transmitted to the information provision computer and the information provision computer permits the browsing of the information held by the information provision computer to the user computer.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention performs an authentication process using a Mondex card used as one medium for electronic money settlement, and if the authentication is successful, various types of information provided by an information service provider or the like. The present invention relates to an information providing method and system for permitting browsing of information.

[0002]

2. Description of the Related Art Authentication methods on the Internet include
Up to now, user stored information authentication method by password, terminal authentication method by callback, SSL (Secure Socket)
Digital signature authentication method using Layer) is used. These conventional methods have a problem in that if a password is leaked or a personal computer is used by a person other than a normal user, information is viewed by a person other than the person himself / herself. Also, password authentication and the like require many passwords to be transmitted over the Internet, which is a security problem.

Therefore, an authentication method using an IC card is drawing attention. By using an IC card, it is possible to expect improvement in security by storing a password, user ID, etc. in the card. Further, the IC card has an advantage over the magnetic card in that it is difficult to forge or illegally change.

The Mondex card, which is one of the IC cards, has its own authentication function and uses password authentication.
It is possible to realize the authentication (card authentication) of Mondex Perth itself using the electronic signature. By the way, Mondex card is (1) Mondex purse card that functions as an electronic wallet, (2) SV card dedicated for authentication to authenticate the authenticity of the card itself, (3) Mondex purse card authentication Management maintenance card (PPS card) used by the administrator to release the lockout state when the transaction fails or clear the error log when the transaction fails
(4) It is composed of four types of cards such as a personalized card (PCA card) for the administrator to change the personal name of the user who owns the Mondex Perth card and set the maximum amount of money. Electronic money can only be transferred between Mondex Perth cards. Each of these cards has its own communication protocol and an authentication function using a cryptographic algorithm. Such a Mondex card is effective in terms of security protection such as prevention of "spoofing" and forgery of the card. Therefore, by utilizing the authentication function of the Mondex card, it becomes possible to safely provide the information held by the information providing service provider only to the specific user.

[0005]

However, in order to perform authentication using a Mondex card, an information providing computer (for example, a Web server) of an information providing service provider controls an SV card for card authentication and controls it. System is required, and a dedicated authentication computer for authenticating the Mondex card is required for use on the Internet, which causes a problem of high installation cost.

An object of the present invention is to reduce the introduction cost of the authentication processing function on the information providing service provider side and to provide information held by the information providing service provider safely only to a specific user. And to provide a system.

[0007]

In order to achieve the above object, the present invention performs authentication processing using a Mondex purse card held by a user and provides information held by an information providing computer via the Internet. A first step of requesting an authentication process by a Mondex purse card from the information providing computer to the user computer in response to an information providing request from the user computer to the information providing computer, and a user at the user computer. The second step of requesting card authentication processing for confirming the authenticity of the Mondex purse card itself by performing the personal authentication processing by the Mondex purse card held by the. , Mondex Card Authentication Computer Smell The card authentication processing of the Mondex purse card held by the user is performed, and if the card authentication is successful, the third step of transmitting the Mondex purse card identification information to the information providing computer and the Mondex card authentication in the information providing computer It is determined whether the user information corresponding to the Mondex purse card identification information received from the computer is registered, and if registered, the user computer is permitted to browse the information held by the information providing computer. And a fourth step. Further, a cookie indicating that the personal authentication and the card authentication are successful is transmitted to the user computer for which the personal authentication and the card authentication are successful in the second and third steps, and the cookie is retained, and the information is provided again thereafter. For the request, the date and time when the cookie is generated is determined in the first step, and if the request is a re-request within a predetermined period from the date and time when the cookie was generated, the second and third steps are omitted. In the third step, if the card authentication is unsuccessful, the information providing computer is notified that the card is an unauthorized card. In the fourth step, it is further determined whether or not the user is a blacklist registrant, and if the user is a blacklist registrant, the browsing is rejected. Further, the information of the card authentication result in the third step is transmitted with an electronic signature. Also, an authentication processing fee according to the number of times the card authentication result is transmitted in the third step is settled between the Mondex Perth card owned by the Mondex card settlement computer and the Mondex Perth card owned by the information providing computer. The method further comprises the step of:

In the information providing system according to the present invention, the information providing computer receives the information providing request from the user computer and requests the user computer to perform an authentication process using a Mondex purse card. Upon receiving the card authentication successful mondex purse card identification information received from the computer, it is determined whether or not the user information corresponding to the mondex purse card identification information is registered, and if registered, the user A means for permitting the computer to browse the information held by itself, and a means for the user computer to receive an information provision request from the user holding the mondex card and transmit it to the information provision computer; In response to the Mondex Perth Card authentication request from the computer It communicates with the user's Mondex purse card, performs personal authentication processing, and if personal authentication is successful, performs card authentication processing to the Mondex card authentication computer to confirm the authenticity of the Mondex purse card itself. The Mondex card authentication computer performs card authentication processing in response to the card authentication processing request from the user computer. If the card authentication is successful, the Mondex card authentication information is sent to the information providing computer. It is characterized by comprising means for transmitting. Further, the Mondex card authentication computer further comprises means for requesting an information processing computer an authentication processing fee according to the number of times the card authentication result is transmitted, and the information providing computer owns the Mondex purse card and the Mondex. It is characterized by further comprising means for paying the authentication processing fee with the Mondex purse card owned by the card payment computer.

[0009]

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, one mode for carrying out the present invention will be specifically described with reference to the drawings. FIG. 1 is an overall configuration diagram showing an embodiment of a system to which the present invention is applied. The system shown in FIG.
An information providing computer 11 and a registered member information DB 12 managed by the user, a user computer 5 used by a user 2 who owns the Mondex purse card 3, an authentication computer 61 installed in a certificate authority 6, and a payment computer 62. It consists of The information providing computer 11 has a Mondex purse card (for payment) 13 for paying the certification fee to the certification body 6. In addition, the authentication computer 61 uses a plurality of SV cards 63a-6a to perform authentication processing for a large number of users at the same time.
I own 3n. In addition, the payment computer 62
Owns a plurality of Mondex purse cards (for receiving) 64a to 64n in order to settle the authentication processing fee with a plurality of information providing computers at the same time.

The user computer 5 has a WWW browser 51 for browsing information provided from the information providing computer 11 through the Internet 7 and a Mondex client program 52 for performing authentication processing unique to the Mondex card. It is implemented. The information providing computer 11, the user computer 5, the authentication computer 61, and the settlement computer 62 are provided with a read / write device (not shown) for the mondex card, and the read / write device allows the storage contents of the mondex card to be stored. It is designed to read and write.

FIG. 2 is a flow chart showing a processing procedure in the information providing computer 11, the user computer 5 and the authentication computer 61 in the above-mentioned configuration. Less than,
The details of the information providing method of the present embodiment will be described with reference to this flowchart. (1) The WWW browser 51 of the user computer 5 requests the information providing computer 11 to provide member-only information (step S201). (2) The information providing computer 11, in response to the request for providing the member-only information, authenticates the user computer 5 with the mondex purse card 3 held by the user 4, instead of distributing the member-only information. An authentication request command is created to carry out (step S202). (3) The user computer 5 transfers the authentication request command received from the information providing computer 11 to the WWW browser 51 (S203). (4) The WWW browser 51 that received the authentication request command
The Mondex client program 52 is automatically activated to prepare for access to the Mondex perspective card 3 held by the user (step S204).

(5) The Mondex client program 52 locally collates the Mondex personal identification number set in the Mondex purse card 3 with the personal identification number input by the user. That is, personal authentication is performed (step S205). (6) The Mondex client program 52, if the personal authentication is successful, the Mondex perspective card 3
The information such as the Mondex card ID acquired from the computer is transmitted to the authentication computer 61 via the Internet 7 (step S20). (7) The authentication computer 61
Create one-time (one-time use) challenge data for determining card authentication (step S20)
7). (8) Then, the challenge data is transmitted to the Mondex client program 52 of the user computer 5 as an AuthReq message of the Mondex card specification (step 208). (9) Based on the challenge data, the Mondex client program 52 requests the Mondex purse card 3 to perform authentication information creation processing with an electronic signature (step 209). (10) The Mondex client program 52 is
Authentication information created by Mondex Perth Card 3 (AuthR
esp) to the authentication computer 61 (step S2)
10).

(11) Upon receiving the authentication information (AuthResp), the authentication computer 61 uses any one of the SV cards 63a to 63n to perform the card authentication process of the Mondex specification (step S211). (12) If the card authentication is successful, the authentication computer 61 sends an authentication result including the ID of the Mondex purse card 3 to the information providing computer 11 with an electronic signature (step S211). The transmission with an electronic signature is for ensuring the credibility of the authentication computer 61 itself.

(13) The information providing computer 11 uses the purse ID corresponding to the ID of the Mondex purse card 3.
Is registered, and if it is registered, it is further determined whether it is registered in the black list (list of users who want to refuse information provision) (step S213). (14) If the information providing computer 11 is not registered in the blacklist, the information providing computer 11 returns the check result and the URL of the member-only information home page to the authentication computer 61 (step S214). (15) The authentication computer 61 uses the member-specific information URL
Is transmitted to the Mondex client program 52 of the user computer 5 (step S215).

(16) The Mondex client program 52 passes the received member-only information URL to the WWW browser 51, and the member-only information UR is sent from the WWW browser 51.
The information providing computer 11 indicated by L is accessed (step S216). (17) The information providing computer 11 creates a member-only information home page in HTML format (step S21).
7). (18) Then, the information providing computer 11 sends the created member-only information to the user computer 5, and the WWW
It is provided to the client to be browsed by the browser 51 (step S218). (19) The information providing computer 11 performs a process of paying a fee for the authentication process by the authentication computer 61 from the Mondex purse card 13 owned by itself to one of the Mondex purse cards 64a to 64n of the settlement computer (step S218). ).

Information regarding authentication transmitted and received among the user computer 5, the information providing computer 11, and the authentication computer 61 is transmitted and received using SSL. Further, in step S210, a cookie indicating that the personal authentication and the card authentication have succeeded is transmitted to and retained by the user computer 5 for which the personal authentication and the card authentication have succeeded. The date and time of generation of the cookie is determined in step, and if the request is within a predetermined period from the date and time of generation, step S2
By omitting 02 to S216, it is possible to reduce the traffic, shorten the waiting time until the information is provided, and improve the service to the user.

FIG. 3 is a screen transition diagram showing the transition of a typical screen displayed on the user computer 5 in each of the above steps. First, the member information entrance screen 30.
1 is displayed, and then the insertion instruction screen 302 for the mondex perspective card 3 and the personal identification number input screen 303 for the mondex perspective card 3 are displayed. If the personal identification number input by the user on the personal identification number input screen 303 is different from the personal identification number registered in the Mondex Perth Card 3, an invalid number input warning screen 304 indicating an invalid personal identification number is displayed. Is displayed. Then, when the illegal input of the personal identification number reaches the prescribed number of times, a lockout screen 305 for disabling the use of the Mondex perspective card 3 is displayed. The mondex purse card 3 in the locked out state cannot be unlocked only by the management maintenance card (PPS card) possessed only by the administrator having special authority. If the personal identification number is correct, an in-authentication screen 306 indicating that the card authentication process is being performed by the authentication computer 61 is displayed. If the result of the authentication is an unauthorized Mondex purse card due to forgery or the like, an error screen 3 is displayed after the authentication failure screen 307 is displayed.
11 is displayed. When the card authentication process is successful, the authentication success screen 308 is displayed. After that, when the member information corresponding to the card ID of the successfully authenticated Mondex purse card 3 is registered in the registered member information DB 12, the member dedicated information screen 309 is displayed. If the member information is not registered, the information browsing refusal screen 310 is displayed.

FIG. 4 is a diagram showing an example of a member information entrance screen 301 serving as an entrance for providing the member-only information of the service provider 1, and an "Authentication Start" button 301.
When 0 is clicked, the authentication request command is received from the information providing computer 11 of the service provider 1 and the Mondex client program 52 is automatically started. FIG. 5 shows an example of the card insertion screen 302 for instructing to insert the Mondex perspective card 3 into the reading / writing device attached to the user computer 5.
Character information of the purpose such as "Please insert the Mondex purse card" is displayed. FIG. 6 shows an example of the Mondex personal identification number input screen 303 displayed when a Mondex personal identification number (Mondex Personal Code) is entered.
It is displayed in the personal identification number input field 3031. However, only the characters "*****" are displayed so that a third party cannot understand.

FIG. 7 shows an example of the in-authentication screen 306, in which the character information "in-authentication" is displayed. Figure 8
Shows an example of the authentication success screen 308, and the fact that the authentication processing has been successful is displayed in characters. FIG. 9 shows an example of the member-only information screen 309 displayed after the end of the authentication, and it is displayed that the information providing service screen by the Mondex authentication is displayed. FIG. 10 shows an example of the illegal number input warning screen 304 displayed when an invalid Mondex PIN number is input, and the characters such as "The PIN code is invalid and should be re-entered". Is displayed. When the OK button 3041 is clicked, the re-input screen is displayed. However, when the re-input operation reaches the specified number of times, the mondex purse card 3 becomes a state (lockout state) that cannot be used for the mondex transaction.

FIG. 11 shows an example of a lockout screen displayed when the mondex perspective card 3 is in a lockout state, and a character indicating that the lockout state has been displayed. FIG. 12 shows an authentication failure screen 3 that is displayed when the Mondex authentication fails due to the use of an unauthorized Mondex Perth card such as a counterfeit card.
In the example of No. 07, the fact that the authentication processing result has failed is displayed in characters. FIG. 13 shows an example of an error screen 311 provided by the information providing computer 11 when the mondex authentication has failed, and a character indicating that the mondex authentication has failed is displayed. FIG. 14 shows an example of the information browsing refusal screen 210 displayed when the purse ID of the Mondex purse card of the user checked by the information providing computer 11 is not registered, and the purse ID is registered. The message that there is no display is displayed.

As described above, according to this embodiment, the personal authentication and the card authentication by the Mondex card are used,
Since the access to the information browsing service provided by the service provider is controlled, it is possible to realize high-security personal authentication using Mondex on the Internet as compared with the conventional password authentication method. Further, since the Mondex purse card can be used for general transactions as electronic cash, there is no need to issue a new card exclusively for viewing information, and there is no cost for issuing a new authentication card. Also, the service provider does not need to add an authentication computer corresponding to the SV card or the Mondex SV card management server, but realizes the Mondex authentication only by modifying the information providing computer so that it can be connected to the authentication computer. Therefore, there is an advantage that the introduction cost of the service provider can be reduced.

Also, it is a message specific to Mondex.
Since it is necessary to check the Mondex PIN code to create the AuthResp message, even if the Mondex purse card is stolen, it is not possible for others to see the member-only information of the service provider unless the PIN code is stolen. Low. Further, in the unlikely event that the Mondex purse card is lost, if the fact that the Mondex purse card is lost is registered in the registered member information database 12, it is not necessary for others to eavesdrop on the member-only information. Furthermore, regarding security problems on the Internet, it is possible to prevent eavesdropping by encrypting the message itself flowing on the Internet by adopting SSL.
As a result, it becomes possible to easily realize a highly secure member information providing system using Mondex.

[0023]

As described above, according to the present invention, the introduction cost of the authentication processing function on the information providing service provider side is reduced, and the information held by the information providing service provider is safely provided only to a specific user. can do.

[Brief description of drawings]

FIG. 1 is a system configuration diagram showing an embodiment of the present invention.

FIG. 2 is a processing sequence diagram showing a processing procedure of an information providing service using Mondex authentication.

FIG. 3 is a screen transition diagram showing a transition of screens displayed on a user computer.

FIG. 4 is a diagram showing an example of a member information entrance screen.

FIG. 5 is a diagram showing an example of a card insertion screen.

FIG. 6 is a diagram showing an example of a Mondex security code input screen.

FIG. 7 is a diagram showing an example of an authenticating screen.

FIG. 8 is a diagram showing an example of an authentication success screen.

FIG. 9 is a diagram showing an example of a member-only information screen.

FIG. 10 is a diagram showing an example of an incorrect number input warning screen.

FIG. 11 is a diagram showing an example of a lockout screen.

FIG. 12 is a diagram showing an example of an authentication failure screen.

FIG. 13 is a diagram showing an example of an error screen.

FIG. 14 is a diagram showing an example of an information browsing refusal screen.

[Explanation of symbols]

1 ... Service Provider, 2 ... User, 3 ... Mondex Perth Card, 5 ... User Computer, 6 ... Certificate Authority, 7 ... Internet, 11 ... Information Providing Computer, 12 ... Registered Member Information Database, 13 ... Authentication Processing Fee Mondex Perth Card for payment, 51… WW
W browser, 52 ... Mondex client program, 61 ... Authentication computer, 62 ... Payment computer, 63a to 63n ... SV card for card authentication processing,
64a-64m ... Mondex purse card for receiving the authentication processing fee.

─────────────────────────────────────────────────── ─── Continuation of front page (51) Int.Cl. ⁷ Identification code FI theme code (reference) G06F 17/60 512 G06F 17/60 512 ZEC ZEC G06K 17/00 G06K 17/00 L 19/00 H04L 9 / 00 673A 19/10 673E H04L 9/32 G06K 19/00 QR (72) Inventor Kenichi Horiwaki 6-81 Onoue-cho, Naka-ku, Yokohama-shi, Kanagawa Hitachi Software Engineering Co., Ltd. Internal F-term (reference) 5B035 AA13 BB09 5B058 KA06 KA33 YA01 5J104 AA07 AA09 KA01 KA02 KA06 KA21 LA06 NA05 NA35 NA36 NA38 PA09 PA10

Claims (8)

[Claims] 1. A method of performing authentication processing using a Mondex purse card held by a user and providing information held by an information providing computer via the Internet, the information providing from the user computer to the information providing computer. In response to the request, the first step in which the information providing computer requests the user computer to perform the authentication process by the Mondex purse card, and the user authentication process is performed by the mondex purse card held by the user in the user computer to perform the personal authentication. If successful, the second step of requesting the card authentication processing to confirm the authenticity of the Mondex card authenticating computer to the Mondex card authenticating computer, and the Mondex card which the user holds in the Mondex card authenticating computer. Card of Authentication processing is performed, and if the card authentication is successful, the Mondex purse card identification information is transmitted to the information providing computer.
And the information providing computer, it is determined whether the user information corresponding to the Mondex purse card identification information received from the Mondex card authentication computer is registered, and if it is registered, the information is sent to the user computer. And a fourth step of permitting browsing of information held by the information providing computer. 2. A cookie indicating that the personal authentication and the card authentication have succeeded is transmitted to and retained by the user computer for which the personal authentication and the card authentication have succeeded in the second and third steps, and the subsequent cookie is executed again. In response to the information provision request of the
The information providing method using the mondex card according to claim 1, wherein the second and third steps are omitted if the request is made within the predetermined period from the generation date and time. . 3. The Mondex card according to claim 1, wherein in the third step, if the card authentication is unsuccessful, the information providing computer is notified that the card is an unauthorized card. Information provision method used. 4. The method according to claim 1, wherein in the fourth step, it is further determined whether or not the user is a blacklist registrant, and if the user is a blacklist registrant, the browsing is rejected. An information providing method using the Mondex card described in (1). 5. The information providing method using the Mondex card according to claim 1, wherein the information of the card authentication result in the third step is transmitted with an electronic signature. . 6. The Mondex purse card owned by the Mondex card payment computer and the Mondex purse card owned by the information providing computer charge an authentication processing fee according to the number of times the card authentication result is transmitted in the third step. The method for providing information using the Mondex card according to claim 1, further comprising a step of making a settlement between them. 7. A user computer, an information providing computer, and a Mondex card authenticating computer are provided, the authentication process is performed using a Mondex purse card held by the user, and the information held by the information providing computer is transferred via the Internet. A system for providing, wherein the information providing computer receives a request for providing information from a user computer and requests the user computer to perform an authentication process using a Mondex purse card, and a card received from the Mondex card authenticating computer. Upon receiving the authentication successful mondex purse card identification information, it is determined whether or not the user information corresponding to the mondex purse card identification information is registered. Hands that allow you to view the information you have With the door, the user computer, and means for transmitting the information providing request from the user to hold the Mondex card accepted, the information providing computer,
In response to the Mondex purse card authentication processing request from the information providing computer, communication is performed with the user's Mondex purse card to perform personal authentication processing, and if personal authentication is successful, the Mondex card authenticating computer is verified. And a means for requesting card authentication processing for confirming the authenticity of the Dex Perth card itself, wherein the Mondex card authentication computer responds to the card authentication processing request from the user computer,
An information providing system using a Mondex card, comprising means for performing card authentication processing and transmitting the Mondex purse card identification information to the information providing computer if the card authentication is successful. 8. The Mondex card authenticating computer further comprises means for requesting the information providing computer to pay an authentication processing fee according to the number of times the card authentication result is transmitted, and the information providing computer owns the Mondex purse card. The information providing system using the Mondex card according to claim 7, further comprising means for paying the authentication processing fee between the Mondex card payment computer and a Mondex purse card owned by the Mondex card payment computer.