JP2003317020A - Individual authentication system and individual authentication program used for the same - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent a card from illegally being used by a 3rd person even if the card user is unaware of losing the card. <P>SOLUTION: An individual authentication system 10 for settlement is equipped with a settlement terminal 14 and a settlement center 16 which are connected to each other through a network 12 and a mobile telephone set 20 that the user of the credit card 18 has. The settlement terminal 14 reads personal information recorded on the credit card 18 and sends it to the settlement center 16. The settlement center 16 receives the personal information from the settlement terminal 14 and sends data for individual authentication to the mobile telephone set 20. The mobile telephone set 20 receives the data for individual authentication from the settlement center 16 and outputs them to the settlement terminal 14. The settlement terminal 14 collates the individual authentication data inputted from the mobile telephone set 20 with the personal information read out of the credit card 18. <P>COPYRIGHT: (C)2004,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention comprises an authentication terminal and an authentication center connected to each other via a network,
The present invention relates to a personal authentication system and the like used for payment by credit card.

[0002]

2. Description of the Related Art In recent years, payment terminals for credit cards have become widespread. This payment terminal is installed in each store and connected to a payment center via a network.

When paying with a credit card, the consumer first gives the credit card to the clerk. When the clerk enters the information from the credit card using the payment terminal,
The information is immediately transmitted to the settlement center. At the payment center, the validity of the card is checked, the credit balance of the consumer is checked, and the result is transmitted to the payment terminal. Thus, the credit card can be used.

Therefore, if the credit card is lost, the fact that the credit card is lost can be notified to the settlement center to prevent unauthorized use of the credit card.

[0005]

However, many problems still remain in the security of credit card settlement terminals. For example, unless the owner of the credit card is aware of the loss of the credit card, unauthorized use by others cannot be prevented.

[0006]

SUMMARY OF THE INVENTION Therefore, an object of the present invention is to provide a personal authentication system or the like which can prevent unauthorized use of a card by another person without the card user being aware of the loss of the card.

[0007]

A personal authentication system according to a first aspect of the present invention comprises an authentication terminal and an authentication center connected to each other via a network, and a portable information device of a card user. The authentication terminal reads the personal information recorded on the card and transmits this personal information to the authentication center. The authentication center receives the personal information from the authentication terminal and transmits personal authentication data corresponding to the personal information to the portable information device. The portable information device receives the personal authentication data from the authentication center and outputs the personal authentication data to the authentication terminal. The authentication terminal collates the personal authentication data input from the portable information device with the personal information read from the card.

The above-mentioned "card" is a credit card, a debit card, an electronic money card or the like according to its use, and a magnetic stripe card, a contact type IC card, a non-contact type IC card or the like according to its function. The "mobile information device" is a mobile phone, PHS, PDA, or the like.

Here, it is assumed that the card user loses the card and does not notice it. At this time, in the conventional technique, there is a possibility that the person who acquired the card may illegally use the card. On the other hand, in the present invention, personal authentication is performed using the portable information device, and therefore it is impossible to illegally use the card only by another person acquiring the card.

The personal authentication system according to the second aspect comprises an authentication terminal and an authentication center connected to each other via a network, and a card user's portable information device.
The authentication terminal sends the personal information recorded on the card, the step of transmitting this personal information to the authentication center, and the personal authentication data corresponding to the personal information transmitted from the authentication center via the portable information device. And the step of inputting, and the step of collating the personal authentication data input from the portable information device with the personal information read from the card. The present claim is a specific paraphrase of claim 1.

The personal authentication system according to a third aspect of the present invention comprises an authentication terminal and an authentication center, which are connected to each other via a network, and a portable information device of a card user. The authentication center includes a database storing a large number of personal information and personal authentication data, and a step of receiving personal information recorded on a card from an authentication terminal, and personal authentication data corresponding to the personal information. From the database and send it to the mobile information device; receiving the verification result of the personal authentication data input from the mobile information device and the personal information read from the card from the authentication terminal; And recording steps. The present claim is a specific paraphrase of claim 1.

A personal authentication system according to a fourth aspect is the personal authentication system according to the third aspect, wherein the card is a credit card and the authentication terminal and the authentication center are for payment. The security problem can be solved by applying the personal authentication system of the present invention to credit card payment.

The personal authentication system according to claim 5 is the personal authentication system according to any one of claims 1 to 4, wherein the personal authentication data is a bar code image, the portable information device has a display screen, and the bar code is displayed on the display screen. An image is displayed, the authentication terminal has a barcode reader, and the barcode image displayed on the display screen of the portable information device is read by the barcode reader. The information output by the portable information device may be in any form such as voice, image, electricity (radio wave or voltage). However, voice is instantaneous and electricity requires special input / output means. On the other hand, the image is persistent, and if it is a barcode, the input operation is simple and reliable.

In the personal authentication system according to claim 6, in the personal authentication system according to claim 5, the authentication center transmits an electronic mail including the URL of the barcode image to the portable information device, and the portable information device receives the authentication center. The electronic mail is received, the URL described in the electronic mail is accessed, and the barcode image is downloaded. The authentication center does not send the barcode image unilaterally, but the barcode image cannot be received unless the portable information device can access the barcode image, so that the security is further improved.

In the personal authentication system according to claim 7, in the personal authentication system according to claim 5, the authentication center transmits to the settlement terminal that the barcode image is permitted to be downloaded, and the portable information device is preset. It is to access the URL and download the barcode image. In this case, the processing time is shorter than when the authentication center sends an electronic mail to the portable information device.

The personal authentication system according to claim 8 is the personal authentication system according to any one of claims 1 to 7, wherein the portable information device receives the personal authentication data from the authentication center only when a correct password is input. It will be possible. As a result, the personal authentication data cannot be acquired unless the correct password is entered, further improving security.

The personal authentication system according to claim 9 is the personal authentication system according to any one of claims 1 to 8, wherein the authentication terminal encrypts the personal information and transmits it to the authentication center. This can prevent leakage of personal information, further improving security.

The personal authentication program according to claims 10 and 11 is used in the personal authentication system according to the present invention, and corresponds to the configurations according to claims 2 and 3, respectively. The personal authentication program according to the present invention may also include the constituent elements described in claims 4 to 9.

In other words, the present invention prevents unauthorized use of a credit card by performing personal authentication using a widely used personal portable information device (terminal capable of browsing Internet contents). is there. The feature is that personal information is also provided to the portable information device in the credit card settlement. As a result, an overall personal authentication system using a payment terminal and a mobile information device was realized.

[0020]

1 is a block diagram showing an embodiment of a personal authentication system according to the present invention. Hereinafter, description will be given with reference to this drawing. However, "personal authentication system", "authentication terminal", "authentication center" in the claims
The "card" is embodied and is paraphrased as a personal authentication system for payment, a payment terminal, a payment center, and a credit card.

The payment personal authentication system 10 includes a payment terminal 14 and a payment center 16 which are connected to each other via a network 12, and a mobile phone 20 owned by the user of the credit card 18. Network 12
Is, for example, the Internet. The payment terminal 14 and the payment center 16 are mainly composed of a computer (not shown) having a communication function and its computer program. The payment terminal 14 is a card reader 141.
And a bar code reader 142. The mobile phone 20 includes a display screen 201 and a microcomputer (not shown).

The settlement terminal 14 reads the personal information recorded on the credit card 18 and transmits this personal information to the settlement center 16. The settlement center 16 includes the settlement terminal 14
The personal information is received from and the personal authentication data corresponding to the personal information is transmitted to the mobile phone 20. Mobile phone 2
0 receives the personal authentication data from the settlement center 16,
This personal authentication data is output to the payment terminal 14. The payment terminal 14 collates the personal authentication data input from the mobile phone 20 with the personal information read from the credit card 18.

Further, the settlement terminal 14 reads the personal information recorded on the credit card 18, transmits the personal information to the settlement center 16, and the individual corresponding to the personal information transmitted from the settlement center 16. The method comprises the steps of inputting the authentication data via the mobile phone 20, and the step of collating the personal authentication data input from the mobile phone 20 with the personal information read from the credit card 18.

The settlement center 16 includes a database (not shown) storing a large number of personal information and personal authentication data thereof, and a step of receiving the personal information recorded in the credit card 18 from the settlement terminal 14.
A step of searching the database for personal authentication data corresponding to the personal information, and transmitting the personal authentication data to the mobile phone 20;
The method comprises the steps of receiving from the settlement terminal 14 the verification result of the personal authentication data input from the mobile phone 20 and the personal information read from the credit card 18, and recording the verification result in a database.

Further, the personal authentication data is the bar code image 202. The mobile phone 20 displays the barcode image 202 on the display screen 201, and the payment terminal 14 displays the barcode image 20 displayed on the display screen 201 of the mobile phone 20.
2 is read by the barcode reader 142.

The settlement center 16 displays the bar code image 202.
The e-mail describing the URL is sent to the mobile phone 20. The mobile phone 20 receives the email from the settlement center 16, accesses the URL described in the email, and downloads the barcode image 202.

Here, it is assumed that the card user loses the credit card 18 and does not notice it. At this time, in the related art, there is a possibility that a person who has acquired the credit card 18 may illegally use the credit card 18. On the other hand, in the personal authentication system 10 for payment, personal authentication is performed using the mobile phone 20, and therefore it is impossible to illegally use the credit card 18 only by another person acquiring the credit card 18. This can solve the security problem peculiar to the payment by the credit card 18.

FIG. 2 is a sequence diagram showing a first example of the operation of the settlement individual authentication system 10. Hereinafter, description will be given with reference to FIGS. 1 and 2.

When paying with the credit card 18, the card user first gives the credit card 18 to the clerk. The card reader 141 of the settlement terminal 14 reads the personal information recorded on the credit card 18 by the operation of the store clerk (step 101). This personal information also includes usage time. Subsequently, the payment terminal 14 encrypts the personal information and immediately transmits it to the payment center 16 (step 102).

Subsequently, the settlement center 16 is connected to the settlement terminal 14
The personal information is received from (step 103), the data (bar code image) corresponding to the card user is searched in the database (step 104), a flag is set so that the card user can download, and the download becomes possible. Send the e-mail to the effect that the card user's mobile phone 20
(Step 105). In this email,
The URL of the barcode image is described.

Then, by the operation of the card user, the mobile phone 20 receives the electronic mail from the settlement center 16 (step 106) and accesses the home page (URL) designated by the settlement center 16 to access the barcode image. Download 202 (step 107) and display the barcode image 202 on the display screen 201 (step 1)
08). When the barcode image 202 is downloaded by the mobile phone 20, the flag returns to the original value at the settlement center 16 and the download becomes impossible. The UR
L is periodically changed to improve security.

Subsequently, the payment terminal 1 is operated by the clerk.
The barcode reader 142 of No. 4 reads the barcode image 202 of the mobile phone 20 (step 109). Next, the payment terminal 14 collates the data such as the card information and the usage time read from the credit card 18 with the data read from the barcode image 202 (step 110), encrypts the result, and clears the payment center 16. (Step 111). As a result, personal authentication is performed, and payment by the credit card 18 is possible.

On the other hand, the settlement center 16 receives the collation result from the settlement terminal 14 (step 112) and records the collation result in the database (step 113).

FIG. 3 is a sequence diagram showing a second example of the operation of the settlement personal authentication system 10. Hereinafter, description will be given with reference to FIGS. 1 and 3. However, the same parts as those in FIG.

In this example, the application program for self-certification is installed in the mobile phone 20 in advance. This application program has a function of transmitting the password set for each mobile phone 20 to the settlement center 16, and the owner of the mobile phone 20 cannot see the password. As a result, only the mobile phone 20 can access the URL of the barcode image 202. The details will be described below.

The settlement center 16 receives the personal information from the settlement terminal 14 (step 103), searches the database for data (bar code image) corresponding to the card user (step 104), and sends an e-mail for password entry. To the mobile phone 20 of the card user (step 2
01).

Then, by the operation of the card user, the mobile phone 20 receives the electronic mail from the settlement center 16 (step 202), inputs the password (step 203), and transmits the password to the settlement center 16. (Step 204). This password was entered by the card user.

Subsequently, the settlement center 16 uses the mobile telephone 2
If the password is correct, the flag is set so that the card user can download the barcode image corresponding to the card user, and an e-mail indicating that the download is possible is sent. It is transmitted to the mobile phone 20 of the card user (step 105). The URL of the barcode image is described in this e-mail. The following operation is the same as that of the first example, and therefore the illustration is omitted.

As described above, the mobile phone 20 can receive the barcode image 202 from the settlement center 16 only when the correct password is entered. That is, the bar code image 202 cannot be acquired unless the correct password is input, so the security is further improved.

FIG. 4 is a sequence diagram showing a third example of the operation of the settlement individual authentication system 10. Hereinafter, description will be given with reference to FIGS. 1 and 4. However, the same parts as those in FIG.

In this example, payment center 16 sends downloadable data to payment terminal 14 instead of mobile phone 20. Since it is displayed on the payment terminal 14 that the card can be downloaded, the card user confirms it and accesses the URL of the barcode image 202. According to this example, processing can be performed faster than in the first example. That is, the network 12
This is because the processing speed of is faster than that of the mobile phone 20. The URL in this case is fixed. The details will be described below.

The settlement center 16 receives the personal information from the settlement terminal 14 (step 103), searches the database for data (bar code image) corresponding to the card user (step 104), and the card user can download it. As described above, the e-mail indicating that the download is possible is transmitted to the settlement terminal 14 (step 30).
1). The URL of the barcode image is not described in this e-mail.

Subsequently, the settlement terminal 14 is connected to the settlement center 16
To receive an e-mail (step 302). By the operation of the card user who confirms this, the mobile phone 20 accesses the URL designated in advance and downloads the barcode image 202 (step 303).
The following operation is the same as in the first example.

[0044]

According to the personal authentication system and the like of the present invention, the authentication terminal reads the personal information from the card and transmits it to the authentication center, and the authentication center sends personal authentication data corresponding to the personal information to the portable information device. The mobile information device outputs the personal authentication data to the authentication terminal, and the authentication terminal collates the personal authentication data with the personal information. Therefore, even if the card user does not notice the loss of the card, it is possible to prevent unauthorized use of the card by another person.

According to the personal authentication system of the fourth aspect, by applying the personal authentication system of the present invention to credit card payment, the security problem peculiar to credit card payment can be solved.

According to the personal authentication system of claim 5, the portable information device displays the bar code image as the personal authentication data, and the authentication terminal reads the bar code image from the portable information device for personal authentication. Data can be entered easily and reliably.

According to the personal authentication system of the sixth aspect, the authentication center does not send the barcode image unilaterally, but the barcode image cannot be received unless the URL can be accessed by the portable information device. Can be improved.

According to the personal authentication system of claim 7, the authentication center transmits to the settlement terminal that the barcode image is permitted to be downloaded, and the portable information device accesses the preset URL to access the barcode image. By downloading, the processing time can be shortened as compared with the case where the authentication center sends an electronic mail to the portable information device.

According to the personal authentication system of the eighth aspect, the personal authentication data is received only when the portable information device inputs the correct password, that is, the personal authentication data cannot be obtained unless the correct password is input. Therefore, security can be further improved.

According to the personal authentication system of the ninth aspect, since the authentication terminal encrypts the personal information and sends it to the authentication center, leakage of the personal information can be prevented, so that the security can be further improved.

In other words, the first effect is that payment cannot be made only with the stolen card. The reason is,
This is because authentication using a mobile phone in addition to the network is required for payment. The second effect is that an authentication method can be added. The reason is that the personal authentication is separated from the payment terminal and provided to the portable information device, so that the authentication method can be added only by changing the software of the portable information device.

[Brief description of drawings]

FIG. 1 is a configuration diagram showing an embodiment of a personal authentication system according to the present invention.

FIG. 2 is a sequence diagram showing a first example of operation in the personal authentication system of FIG.

FIG. 3 is a sequence diagram showing a second example of operation in the personal authentication system of FIG.

FIG. 4 is a sequence diagram showing a third example of operation in the personal authentication system of FIG.

[Explanation of symbols]

10 Personal Authentication System for Payment (Personal Authentication System) 12 networks 14 Payment terminal (authentication terminal) 141 card reader 142 Bar Code Reader 16 Settlement Center (Authentication Center) 18 credit cards 20 Mobile phones (portable information devices) 201 display screen 202 barcode image

─────────────────────────────────────────────────── ─── Continuation of front page (51) Int.Cl. ⁷ Identification code FI theme code (reference) G07F 7/02 G07F 7/02 Z 7/12 7/08 BF term (reference) 2C005 HA03 HB20 JA15 JB31 LB34 LB52 MA04 MB10 NA02 NA06 SA11 SA30 TA21 TA22 TA40 3E044 AA20 BA04 BA05 CA04 CA10 DA05 DA06 DD01 DE01 5B058 KA31 KA37

Claims (11)

[Claims] 1. An authentication terminal and an authentication center, which are connected to each other via a network, and a portable information device of a card user, wherein the authentication terminal reads personal information recorded on a card and outputs the personal information. The personal information is transmitted to the authentication center, the personal information is received from the authentication terminal, personal authentication data corresponding to the personal information is transmitted to the portable information device, and the portable information device is connected to the authentication center. Receives personal authentication data from the personal authentication data, and outputs the personal authentication data to the authentication terminal, the authentication terminal collates the personal authentication data input from the portable information device with the personal information read from the card. Yes, personal authentication system. 2. An authentication terminal and an authentication center, which are connected to each other via a network, and a card user's portable information device, wherein the authentication terminal reads personal information recorded on a card, Transmitting information to the authentication center, inputting personal authentication data corresponding to the personal information transmitted from the authentication center via the portable information device, and inputting from the portable information device A personal authentication system comprising a step of collating personal authentication data with personal information read from the card. 3. An authentication terminal and an authentication center, which are connected to each other via a network, and a portable information device of a card user, wherein the authentication center stores a large number of personal information and personal authentication data thereof. And receiving personal information recorded on a card from the authentication terminal; searching personal authentication data corresponding to the personal information from the database and transmitting the personal authentication data to the portable information device; A personal authentication system comprising: a step of receiving a verification result of personal authentication data input from an information device and personal information read from the card from the authentication terminal; and a step of recording the verification result in the database. . 4. The card is a credit card, The authentication terminal and the authentication center are for payment, The personal authentication system according to claim 1. 5. The personal authentication data is a bar code image, the portable information device has a display screen, and displays the bar code image on the display screen, and the authentication terminal includes a bar code reader. Along with
The personal identification system according to claim 1, wherein the barcode image displayed on the display screen of the portable information device is read by the barcode reader. 6. The authentication center sends an electronic mail including the URL of the barcode image to the portable information device, the portable information device receives the electronic mail from the authentication center, and the electronic mail is sent. The personal authentication system according to claim 5, wherein the URL described in is accessed to download the barcode image. 7. The authentication center transmits permission to download the barcode image to the settlement terminal, and the portable information device accesses a preset URL to download the barcode image. The personal authentication system according to claim 5. 8. The personal authentication system according to claim 1, wherein the portable information device can receive the personal authentication data from the authentication center only when a correct password is input. 9. The personal authentication system according to claim 1, wherein the authentication terminal encrypts the personal information and transmits the encrypted personal information to the authentication center. 10. A personal authentication system comprising an authentication terminal and an authentication center, which are connected to each other via a network, and a card user's portable information device, and reading personal information recorded on a card. Transmitting the personal information to the authentication center; inputting personal authentication data corresponding to the personal information transmitted from the authentication center via the portable information device; A personal authentication program for causing the authentication terminal to execute the step of collating the input personal authentication data with the personal information read from the card. 11. An authentication center having a database storing a large number of personal information and personal authentication data thereof, an authentication terminal connected to the authentication center via a network, and a portable information device of a card user. Used in the personal authentication system, receiving personal information recorded on the card from the authentication terminal, and searching personal authentication data corresponding to the personal information from the database and transmitting the personal authentication data to the portable information device. Receiving the verification result of the personal authentication data input from the portable information device and the personal information read from the card from the authentication terminal; and recording the verification result in the database. Personal authentication program to be executed by the center.