JP2004094619A - Authentication method and system - Google Patents

Abstract

[PROBLEMS] An authentication method capable of correctly authenticating an individual even when performing electronic commerce settlement using a credit card, and performing business transactions without directly informing the store of card information. Methods and systems are provided.
SOLUTION: Information on a credit card holder is registered in a card holder information storage means 4a in advance. After the user terminal 1 accesses the store server 3 where the virtual store is established and selects a product to be purchased, and issues an instruction to perform authentication, the user terminal 1 is linked with the store server 3 The authentication server 4 is accessed. Here, when the card number and the expiration date are transmitted from the user terminal 1 to the authentication server 4, the authentication server 4 collates with the information stored in the card holder information storage means 4a to perform the personal authentication. If the authentication has been correctly performed, the authentication ID is transmitted to the user terminal 1 and the store server 3.
[Selection diagram] Fig. 1

Description

[0001]
[Industrial applications]
The present invention relates to a method and a system for authenticating a user when performing electronic commerce on the Internet or the like.
[0002]
[Prior art]
In recent years, with the increase in the use of the Internet, the use of so-called electronic commerce, which purchases goods via the Internet, has become active. In e-commerce, the sales side does not need to set up a store and labor costs can be reduced, which makes it possible to significantly reduce sales costs. It is possible to purchase products while staying at the same location. In electronic commerce on the Internet, it is common to pay for a purchase price with a credit card, and a credit card number and information on its expiration date are used as information for performing the payment.
[0003]
[Problems to be solved by the invention]
However, in the above-mentioned conventional electronic commerce, payment is performed only with the information of the credit card number and the expiration date displayed on the card, so for example, even if a person who picked up a credit card impersonates himself, There is a problem that can be purchased. Even if the person himself uses a credit card, many people still have strong resistance to telling the store the card number and the expiration date.
[0004]
In view of the above points, the present invention is capable of correctly authenticating the user even when performing e-commerce settlement using a credit card, and performing business transactions without directly informing the store side of the card information. An object of the present invention is to provide an authentication method and system capable of performing the authentication.
[0005]
[Means for Solving the Problems]
In order to solve the above problems, in the present invention, as a method of authenticating a person using a store server that is a server computer that has established a store site on the Internet and an authentication server that is a server computer that authenticates the person, Presenting a screen with a link to the authentication server to a user accessed by the store server, wherein the user uses the link of the screen presented by the store server to provide the authentication server with The step of accessing, the step of requesting the user who has accessed the authentication server for card information, which is information on a credit card, and a password, and transmitting the card information and the password input according to the request to the authentication server. Step, the authentication server performs authentication based on the received card information and the password, and Generating an authentication ID, presenting the authentication ID to the user and transmitting the authentication ID to the store server, wherein the store server uses the received authentication ID and the card information as customer information. The registration step is performed.
According to the present invention, when conducting e-commerce at a virtual store on the Internet, the user moves from the site where the virtual store is opened to the site of a card company having an authentication function and authenticates the user, and the authenticated evidence Is obtained and the authentication ID is sent to the virtual store, so that the user does not need to enter information such as a card number at the site of the virtual store, and can use the authentication ID only by using the authentication ID. Can do business. For this reason, it is possible to prevent a card obtained by an unauthorized means from impersonating the card holder and being illegally used. In addition, the customer does not need to unconditionally pass the card number and expiration date information to a store whose identity is unknown.
[0006]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
(1st Embodiment)
FIG. 1 is a configuration diagram showing a first embodiment of an authentication system according to the present invention. In FIG. 1, 1 is a user terminal, 2 is the Internet, 3 is a store server, 4 is an authentication server, 5 is a payment agent system, 3a is customer information storage means, and 4a is a card holder information storage means.
[0007]
In FIG. 1, a user terminal 1 is used by a purchaser, and is equipped with a WWW browser and can be connected to the Internet, such as a personal computer, a mobile phone, or a PDA (Personal Digital Assistant). It is realized by a terminal device. The store server 3 is a server computer which records a virtual store established on the Internet by a dealer, and performs a function as a WWW server for providing a Web service to a user via the Internet 2 and a process as a virtual store. It has a function as an application server. The authentication server 4 is a server computer for specializing authentication of a valid user of a credit card. In the present embodiment, the authentication server 4 has a function of authenticating a user in cooperation with a website of a card company. Having. The settlement agency system 5 is a system for specializing in settlement agency, and for example, a known settlement system such as a CAFIS (Credit And Finance Information System) can be used.
[0008]
Subsequently, a first embodiment of the authentication method according to the present invention will be described together with the processing operation of the authentication system shown in FIG. FIG. 2 is a flowchart showing an outline of the authentication method according to the present invention. First, the user accesses a shopping site established in the store server 3 from the user terminal 1, selects a product to be purchased, and gives an instruction to purchase (step S1). A specific instruction to purchase is performed by, for example, clicking a purchase button prepared on a Web page. Then, the store server 3 presents an authentication ID request screen as shown in FIG. If the user who has already authenticated himself enters the authentication ID in the authentication ID input field 31 and clicks the payment button 32, the purchase procedure will be completed. Here, the procedure for the identity verification of the user is performed. Specifically, the required information is entered in the personal information input field 33 and the authentication button 34 is clicked. When the authentication button 34 is clicked, the user terminal 1 accesses the authentication server 4 and transmits the personal information input in the personal information input field 33 and the URL of the own store server 3 (step S2). In practice, a script corresponding to the authentication button 34 is described when the authentication ID request screen as shown in FIG. 3 is created in HTML, and the authentication server 4 is accessed as the contents of the script. Then, a command for transmitting the personal information input in the personal information input field 33 and the URL of the own store server 3 may be described. When the authentication button 34 is clicked, the WWW browser of the user terminal 1 interprets and executes the command.
[0009]
When the user terminal 1 accesses the authentication server 4, the authentication server 4 displays an authentication screen as shown in FIG. 4 on the user terminal 1, and prompts for a card number and a password. The user inputs a card number, a password, a name, and a date of birth in a card number input field 41, a password input field 42, a name input field 43, and a date of birth input field 44, respectively, and clicks an authentication button 45. . When the authentication button 45 is clicked, the user terminal 1 transmits to the authentication server 4 information indicating that the authentication button 45 has been clicked, together with the input card number, personal identification number, name, and date of birth (step). S3). The authentication server 4 recognizes that the authentication button 45 has been clicked, searches the card holder information storage means 4a using the received card number, personal identification number, name, and date of birth, and finds the corresponding card holder. Authentication is performed as to whether or not there is (step S4).
[0010]
Here, an example of the cardholder information stored in the cardholder information storage means 4a is shown in FIG. As card holder information, personal information collected from customers when a credit card company issues a credit card is recorded. As shown in FIG. 5, as the card holder information, a personal identification number is recorded in addition to the (credit) card number, address, name, telephone, expiration date, date of birth, and the like. These items are mandatory and these items are never left blank. However, there is a blank for the item “authentication ID” shown at the right end in FIG. For example, in the example of FIG. 5, the first and third lines from the top are blank. This indicates that the authentication ID has not been issued. This is because the authentication ID is not issued to all credit card holders, but is obtained as a result of personal authentication for performing electronic commerce on the Internet.
[0011]
If there is a cardholder corresponding to the set of the received credit card number and password, the authentication server 4 determines that the user is a valid user. The user is determined not to be a valid user. If it is determined that the user is a valid user, the authentication server 4 generates an authentication ID (step S5). Specifically, based on the credit card number and the personal identification number, a predetermined operation is performed to generate a special number, which is used as an authentication ID. As the calculation for generating the authentication ID, for example, various operations such as directly calculating the values of the credit card number and the password or converting one of the values of the credit card number and the password with a predetermined function are available. Can be used. The created authentication ID is registered in the card holder information storage unit 4a.
[0012]
The generated authentication ID is transmitted to the user terminal 1 and displayed as an authentication result screen as shown in FIG. 6 (step S6). Such an authentication result screen allows the user to obtain his / her own authentication ID. On the other hand, the generated authentication ID is also transmitted to the store server 3 (step S7). In this case, the card information is also transmitted from the authentication server 4 to the store server 3 in addition to the authentication ID. Here, as the card information, information necessary for the settlement processing in the settlement agency system 5 is transmitted. In the present embodiment, the card information is the card number and the expiration date of the card. Then, the store server 3 associates the received authentication ID with the card information and the personal information input in step S2 and registers them in the customer information storage unit 3a. Here, an example of the customer information stored in the customer information storage means 3a is shown in FIG. As shown in FIG. 7, the customer information includes information on an authentication ID, an address, a name, a telephone, a card number, and an expiration date. The authentication ID, card number, and expiration date are transmitted from the authentication server 4. On the other hand, the address, name, and telephone are not transmitted from the authentication server 4 but are input on the screen shown in FIG. The reason why the address, name, and telephone are different between the cardholder information and the customer information is that the address and name in the customer information indicate the actual destination of the product, and do not necessarily need to be sent to the official address. The reason is that the phone can be a phone number that can be confirmed. Further, the card number and the expiration date of the customer information are required for the settlement processing with the settlement agency system. In a settlement agency system such as CAFIS, information on a card number and an expiration date is required, and it is handed over for that purpose. In the store server 3, if the authentication ID is basically correct, the merchandise is sold, so that the user is confirmed only by the authentication ID. Note that the processes in steps S6 and S7 are not necessarily performed in this order, and may be performed by hand. For example, they may be performed simultaneously, or step S7 may be performed first. When the user and the store server 3 acquire the authentication ID in this manner, the authentication ID can be handled as an authentication tag, which is a mark that has been authenticated, thereafter.
[0013]
If it is determined that the card is not a valid card holder as a result of the authentication in step S4, the user is notified that authentication has failed (step S8). Specifically, an authentication disapproval screen as shown in FIG. 8 is displayed on the user terminal 1. On the other hand, the authentication server 4 transmits an error code indicating that the user is not a valid card holder to the store server 3 (step S9). The store server 3 that has received the error code stops the registration process of the personal information input in step S2.
[0014]
When the user authentication is correctly performed, the user obtains the authentication ID, and the customer information is registered in the customer information storage unit 3a of the store server 3, the user thereafter performs the product purchase processing using only the authentication ID. Can be performed. Specifically, first, the user accesses the store server 3 to select a product and instructs the user to purchase the product. Then, the authentication ID request screen as shown in FIG. 3 is displayed as described above. Here, the authentication ID obtained as the authentication tag is input in the authentication ID input field 31 and the payment button 32 is clicked. Then, the store server 3 checks whether the input authentication ID matches the authentication ID registered in the customer information storage unit 3a. If the same information as the input authentication ID exists in the customer information storage means 3a, the store server 3 creates order data for shipping the selected product to the customer address corresponding to the authentication ID. At the same time, the card information corresponding to the authentication ID is transmitted to the settlement agency system 5 to execute the settlement processing.
[0015]
(Second embodiment)
Next, a second embodiment of the present invention will be described. FIG. 9 is a configuration diagram showing a second embodiment of the authentication system according to the present invention. The second embodiment is different from the first embodiment in that the authentication server 10 manages databases of a plurality of companies. In the first embodiment, the authentication server 10 is managed by each card company. However, in the second embodiment, the authentication server 10 is managed by an operating company entrusted to the card company. You will be acting for them. 9, the authentication server 10 has a company A database 10a, a company B database 10b, a company C database 10c, and a company D database 10d. These databases are equivalent to the card holder information storage means 4a shown in FIG. 1, but differ in that they are managed for each card company.
[0016]
Subsequently, an outline of the processing of the second embodiment will be described. The basic flow is the same as in the first embodiment, but the processing in step S3 is different. Specifically, when the user clicks the authentication button on the authentication ID request screen shown in FIG. 2 to access the authentication server 10, the authentication server 10 presents the user terminal 1 with an authentication screen as shown in FIG. On this screen, the user inputs a card number and a password, and then clicks a button corresponding to the card company. Then, the card company ID is transmitted from the user terminal 1 to the authentication server 4 together with the card number and the password. The authentication server 10 specifies a database to be searched based on the received card company ID, and performs authentication by searching the specified database using the received card number and password. The processing after authentication is basically the same as in the first embodiment.
[0017]
In both of the above embodiments, the information of the card number and the expiration date is transmitted from the authentication servers 4 and 10 to the store server 3, and even if the user does not input, the store server 3 ends up with the card number and the expiration date. You will get expiration information. However, a card company with strict screening requirements will approve it and send it to a pre-contracted store server, so it will not be sent to a store whose identity is unknown.
[0018]
【The invention's effect】
As described above, according to the present invention, the store server presents a screen with a link to the authentication server to the accessing user, and links the screen presented by the store server to the user. The authentication server is used to access the authentication server, and the authentication server requests card information and a password which are information regarding the credit card from the accessing user, and sends the card information and the password entered according to the request to the authentication server. The authentication server performs authentication based on the received card information and personal identification number, and when it is determined that the user is a valid user, generates an authentication ID and presents the authentication ID to the user. The user sends the information to the store server, and the store server registers the received authentication ID and card information as customer information. Since electronic commerce can be performed only by using the authentication ID without entering information such as a card number, it is necessary to prevent unauthorized use of a card obtained by unauthorized means by impersonating the card holder This has the effect that it becomes possible.
[Brief description of the drawings]
FIG. 1 is a configuration diagram showing a first embodiment of an authentication system according to the present invention.
FIG. 2 is a flowchart showing an outline of an authentication method according to the present invention.
FIG. 3 is a view showing an authentication ID request screen displayed on the user terminal 1;
FIG. 4 is a diagram showing an authentication screen displayed on the user terminal 1.
FIG. 5 is a diagram showing an example of cardholder information.
FIG. 6 is a diagram showing an authentication result screen displayed on the user terminal 1.
FIG. 7 is a diagram illustrating an example of customer information.
FIG. 8 is a diagram showing an authentication disapproval screen displayed on the user terminal 1.
FIG. 9 is a configuration diagram showing a second embodiment of the authentication system according to the present invention.
FIG. 10 is a diagram showing an authentication screen displayed on the user terminal 1.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 1 ... User terminal 2 ... Internet 3 ... Store server 4, 10 ... Authentication server 5 ... Payment agent system 10a-10d ... Database by card company

Claims (3)

A method of performing identity authentication using a store server that is a server computer that has established a store site on the Internet and an authentication server that is a server computer that performs identity authentication,
The shop server presenting a screen with a link to the authentication server to the accessing user;
The user accessing the authentication server using a link on the screen presented by the store server;
Wherein the authentication server requests card information and a personal identification number, which is information on a credit card, to the accessing user;
Transmitting card information and a password input according to the request to the authentication server;
The authentication server performs authentication based on the received card information and personal identification number, and when it is determined that the user is a valid user, generates an authentication ID, presents the authentication ID to the user, and sends the authentication ID to the store server. Sending,
The store server registers the received authentication ID and the card information as customer information;
An authentication method, comprising: An authentication system including a store server that is a server computer that has opened a store site, and an authentication server that is a server computer that authenticates the user,
The store server,
Screen presenting means for confirming whether or not the user has been authenticated, and presenting a screen having a link to the authentication server;
Authentication information receiving means for receiving the authentication ID and the card information transmitted from the authentication server,
Customer information storage means for registering the authentication information,
The authentication server,
Cardholder information storage means for storing information about the cardholder;
Card information requesting means for requesting card information and a password to a user terminal accessed using the link of the store server;
Authentication means for performing authentication by referring to the card holder information storage means based on the card information and the password transmitted from the user terminal in response to the request,
As a result of the authentication by the authentication unit, when it is determined that the user is a valid user, an authentication information transmission unit that generates an authentication ID and transmits the authentication ID to the store server;
An authentication system comprising: The authentication system according to claim 2, wherein the card holder information storage means of the authentication server is provided as a database for each card company.

Images