JP4857749B2 - IC card management system - Google Patents

Description

  The present invention relates to an IC card management system suitable for handling IC cards such as cash cards and credit cards.

Conventionally, when a financial institution issues a cash card using an IC card to a customer, an IC card manufacturing / issuing consignment company (hereinafter referred to as a card manufacturing company) such as a printing company entrusted by the financial institution Cards were manufactured and cash cards were sent to customers by registered mail.
The conventional procedure for issuing a cash card is as follows: When a customer applies for a cash card issue to a financial institution, personal information such as the customer's name and address, and an account such as an account number that can be used with the issued cash card Information is provided from a financial institution to a card manufacturer.

The card manufacturing company stores the bank information of the Zenginkyo cash card application and the account information such as the account number in the IC memory of the cash card and prepares the issued cash card, and then the customer's name, address, etc. Based on the information, the name and address are printed on a card mail mount to create a mailed item, and the cash card is sent to the customer by mail.
Therefore, in the conventional issuance of a cash card, it takes several weeks for the cash card to reach the customer after the customer applies for the cash card, and the customer cannot use the cash card immediately.

As a conventional technique for solving such a problem, a cash card issuing system has been proposed that can easily verify the identity of a customer and issue a cash card at the same time as applying for a cash card.
In this publicly known technology, on the spot where a cash card application was made, a customer keyed in a personal identification number by a personal identification number input means installed at a store of a financial institution, and was read out from the key input data and the customer data file. If the personal identification number matches, the account transaction data including the personal identification number is written to the cash card, and the cash card is issued (for example, Patent Document 1).

However, although the above-mentioned cash card issuing system can apply for cash card issuance at the store, it is necessary to write account transaction data including a PIN on the cash card. There was a problem that customers would be waiting at the store.
In addition, the financial institution needs to prepare a device for writing account transaction data including a personal identification number on a cash card, which causes a problem of increased equipment costs.
JP-A-8-315223

  Accordingly, the inventors of the present invention can immediately issue cash cards to customers on the spot at financial institutions, etc., and the financial institutions outsourced the production of cash cards to an external card manufacturing company. Even in this case, we have already filed an application for a method of issuing a cash card that can reduce the commission costs from financial institutions.

  The cash card issuance method is “a cash card issuance method comprising an IC card, in which account information is stored in advance in an IC memory of the cash card, and a cash card for issuance is prepared; When issuing a card to a customer, the method includes the step of registering the account information stored in the IC memory of the cash card and the customer information of the customer in the database in association with each other. Is.

  With this method, there is no need to write data to the cash card at the financial institution, and the cash card can be immediately issued to the customer on the spot at the store, etc. It is possible to reduce consignment costs, and furthermore, the information that the card manufacturer wants to keep secret can only be maintained at the financial institution, and can be avoided from being disclosed to the outside. There is an effect that it is possible to prevent leakage of information and highly confidential information.

However, with this method, cash cards that can be used in each store are stocked, and there are the following problems.
(1) Stocking a usable cash card in a store has a safety problem.
(2) Transporting a usable cash card has a security problem.
(3) Placing a usable cash card in the store may cause unauthorized use or cause an internal crime.
Accordingly, an object of the present invention is to provide an IC card management system capable of preventing unauthorized use and internal crimes and improving security and safety.

The present invention solves the above problems by the following means. In addition, in order to make an understanding easy, although the code | symbol corresponding to the Example of this invention is attached and demonstrated, it is not limited to this.
The invention of claim 1 comprises a store terminal (30) that communicates with an IC card (10) having a block / unblock function, and a center server (40) that communicates with the store terminal (30). An IC card management system (100) for handling the IC card (10) and unblocking the IC card (10) in a block state,
The center server (40) includes a key information database (43) storing a key for electronic signature,
The store terminal (30) authenticates a user who unblocks the IC card (10) with a user ID, and authenticates the user ID (31) to fetch the authenticated user ID, and the IC card (10). Reading means (32) for reading stored IC card information and permission used for making a permission request to the center server (40) based on the IC card information read by the reading means (32) Request transmitting means for transmitting a request for generating a request cipher to the IC card (10), and cipher receiving means for receiving a permission request cipher generated by the IC card (10) that has received the request transmitted by the request transmitting means. The permission request encryption received by the encryption receiving means, the IC card information read by the reading means (32), and the authentication means (31) Includes a user ID forme Ri, and ARQC transmitting means transmits the terminal number of the shop terminal (30) to said center server (40), a
The center server (40) receives the permission request encryption transmitted by the ARQC transmission unit, manages a user ID and a terminal number, a terminal determination unit that collates the received user ID and terminal number, When verified by the terminal determination means, an authorization response encryption is generated, an unblock script is generated based on the received IC card information, and the unblock script is stored in the key information database (43). An unblock command generation means (44) for adding an electronic signature generated using the electronic signature key that has been generated, and the permission response encryption and unblock script generated by the unblock command generation means (44) are transmitted. An ARPC transmission means,
The store terminal (30) includes an unblock script receiving unit that receives the unblock script transmitted by the ARPC transmission unit and a permission response cipher, and an electronic signature of the unblock script received by the unblock script receiving unit. An unblock script transmitting means for transmitting the unblock script and the permission response cipher to the IC card (10) when authentication is successful;
The IC card (10) further includes an unblock function unit that receives the authorization response cipher transmitted by the unblock script transmission unit, performs issuer authentication, and executes an unblock function by the received unblock script. A card management system (100).
The invention of claim 2 comprises a store terminal (30) that communicates with an IC card (10) having a block / unblock function, and a center server (40) that communicates with the store terminal (30). An IC card management system (100) for handling the IC card (10) and blocking the unblocked IC card (10),
The center server (40) includes a key information database (43) storing a key for electronic signature,
The store terminal (30) authenticates a user who blocks the IC card (10) with a user ID, and stores the authenticated user ID in the IC card (10). Reading means (32) for reading the IC card information read, and a permission request used for making a permission request to the center server (40) based on the IC card information read by the reading means (32) A request transmitting means for transmitting a request for generating a cipher to the IC card (10); a cipher receiving means for receiving a permission request cipher generated by the IC card (10) that has received the request transmitted by the request transmitting means; The permission request encryption received by the encryption receiving means, the IC card information read by the reading means (32), and the authentication means (31) Includes a user ID I, the ARQC transmitting means transmits the terminal number of the shop terminal (30) to said center server (40), a
The center server (40) receives the permission request encryption transmitted by the ARQC transmission unit, manages a user ID and a terminal number, a terminal determination unit that collates the received user ID and terminal number, When verified by the terminal determination means, an authorization response encryption is generated, a block script is generated based on the received IC card information, and the block script is stored in the key information database (43). A block command generation means (22) for adding an electronic signature generated using a digital signature key, and an ARPC transmission means for transmitting the permission response encryption and block script generated by the block command generation means (22); Further comprising
The store terminal (30) succeeds in authenticating the block script received by the ARPC transmitting means and the block script receiving means for receiving the permission response cipher and the electronic signature of the block script received by the block script receiving means. A block script transmission means for transmitting the block script and the permission response encryption to the IC card (10),
Said IC card (10), said block script transmission unit has received an authorization response cipher that sent Issuer authenticated, further comprising blocking means for performing a blocking function by the block script received, the IC card management system ( 100).

According to the present invention, the IC card can be blocked until it is used, and the IC card can be unblocked at the time of use, so that unauthorized use and internal crime can be prevented and security and safety can be improved. Can do.
Moreover, since the command generation means is provided in the server, security can be enhanced by separating it from the terminals arranged in each store or the like.
Furthermore, since a history management means for managing the history of the user who performs the block / unblock of the IC card is provided, it becomes clear when and who performed the block / unblock of the IC card, and the reliability of the system can be improved. it can.
On the other hand, since an unblocked IC card can be blocked, if an incorrect IC card is issued to a customer, the IC card can be used by blocking the IC card once unblocked. It can be impossible. Further, when the IC card is discarded, it is possible to prevent leakage of data from the discarded card by blocking the IC card. Furthermore, the IC card can be blocked without taking time and labor at the time of factory shipment.

  The present invention aims to provide an IC card management system capable of preventing unauthorized use and internal crimes and improving security and safety until an application in an IC cash card is applied until a customer makes an application. This is realized by unblocking the application immediately before handing it over to the customer.

Hereinafter, embodiments of the present invention will be described in more detail with reference to the drawings.
FIG. 1 is a diagram showing an embodiment of an IC card management system according to the present invention.
The IC card management system 100 of this embodiment includes an IC cash card 10, a factory terminal 20, a store terminal 30, a center server 40, and the like.

The IC cash card 10 is a Zenginkyo cash card application that has a block / unblock function (hereinafter referred to as the Zengin app. Zengin app; see the Zenginkyo IC cash card standard specifications, published in March 2001, first edition, first edition) Issued IC card with National Bank Association Business Department).
In addition, the IC cash card 10 is shipped in a state where the Zengin app is blocked in advance by the factory terminal 20 described later. In the memory of the IC cash card 10, IC card information such as an account number and shipping information is stored.

The factory terminal 20 is a terminal such as a personal computer, and includes a reading unit 21, a block command generation unit 22, and a block command execution unit 23.
The reading means 21 is a device that reads IC card information stored in the IC cash card 10, and is, for example, an IC card R / W (reader / writer).
The block command generation unit 22 is a part that generates a block script (block command; issuer script) based on the IC card information read by the reading unit 21.
The block command execution means 23 is a part that transmits the block script generated by the block command generation means 22 to the IC cash card 10 and causes the IC cash card 10 to execute the block script.

The store terminal 30 is a terminal such as a personal computer, and includes an authentication unit 31, a reading unit 32, a communication unit 33, and an unblock command execution unit 34.
The authentication means 31 is for authenticating a user who unblocks the IC cash card 10 using the store terminal 30, and for example, performs authentication based on a user ID.
The reading unit 32 is the same as the reading unit 21 of the factory terminal 20 and is a device that reads the IC card information stored in the IC cash card 10.
The communication unit 33 transmits the IC card information, the user ID, and the terminal number read by the reading unit 32 to the center server 40, and receives an unblock script (unblock command; issuer script) described later from the center server 40. It is a device to do.
The unblock command execution means 34 is a part that transmits the unblock script received by the communication means 33 to the IC cash card 10 and causes the IC cash card 10 to execute the unblock script.

The center server 40 is connected to the store terminal 30 via a network such as the Internet, and includes a communication unit 41, a history management unit 42, a key information database 43, and an unblock command generation unit 44.
The communication means 41 is an apparatus that receives IC card information, a user ID, and a terminal number from the store terminal 30 and transmits an unblock script to the store terminal 30.
The history management unit 42 is a part that stores and manages the user ID and terminal number received by the communication unit 41.
The key information database 43 is a database that stores a digital signature key.
The unblock command generation means 44 generates an unblock script based on the IC card information received from the store terminal 30, and uses the electronic signature key stored in the key information database 43 for the unblock script. This is the part to which the electronic signature generated in this way is added.
Each means (block command generation means 22, block command execution means 23, unblock command execution means 34, unblock command generation means 44) regarding the block / unblock is realized by a dedicated application or the like.

Next, the operation of the IC card management system 100 will be described.
FIG. 2 is a diagram for explaining the operation of the IC card management system 100.
First, as shown in FIG. 2A, an IC cash card 10 is issued at a factory. At this time, the Zengin app in the IC cash card 10 is in a blocked state, and the account number “992 1234” is stored in the memory of the IC cash card 10.
Next, as shown in FIG. 2B, the IC cash card 10 is transported from the factory to each store and stocked in the bank / branch. The Zengin app is still blocked.
Furthermore, as shown in FIG. 2C, when an application is made by a customer, the operator operates the store terminal 30 to unblock the Zengin app.

Here, the flow of unblocking the IC cash card 10 will be described.
FIG. 3 is a diagram for roughly explaining the flow of unblocking of the IC cash card 10, and FIG. 4 is a diagram for explaining the flow of unblocking of the IC cash card 10 in detail.
The flow of unblocking will be roughly described. As shown in FIG. 3, the store terminal 30 reads the IC card information from the IC cash card 10 [# 1], and displays the IC card information, the user ID, the terminal number, and the like. It transmits to the center server 40 [# 2].
The center server 40 generates an unblock script based on the received IC card information or the like [# 3], adds the electronic signature generated using the electronic signature key to the unblock script, and adds the electronic signature. The added unblock script is transmitted to the store terminal 30 [# 4].
When the store terminal 30 receives the unblock script and succeeds in authenticating the electronic signature, the store terminal 30 causes the IC cash card 10 to execute the unblock script and release the block of the IC cash card 10 [# 5].

To describe this flow in more detail, as shown in FIG. 4, first, the operator performs user authentication using the authentication means 31 of the store terminal 30 and logs in to the store terminal 30 [S1]. At this time, the user ID of the operator is taken into the store terminal 30.
Next, the operator operates the store terminal 30 to select a dedicated application for unblocking [S2]. Then, the AID (Application Identifier) of the selected application is transmitted to the IC cash card 10. The IC cash card 10 returns an AID response to the store terminal 30 [S3].
The store terminal 30 initializes the application [S4], and transmits AIP (Application Interchange Profile) and AFL (Application File Locator) to the IC cash card 10. The IC cash card 10 returns an AIP and AFL response to the store terminal 30 [S5].

  The store terminal 30 reads IC card information such as an account number from the IC cash card 10 [S6], and makes an ARQC (Authorization Request Cryptogram) request to the IC cash card 10 [S7]. The IC cash card 10 generates an AC (Application Cryptogram) and transmits it to the store terminal 30. Here, processing for ARQC and AAC (Application Authentication Cryptogram) is also performed [S8].

The store terminal 30 transmits ARQC to the center server 40 [S9]. The center server 40 compares the master that manages the user ID and the terminal number with the actual user ID and the terminal number while performing the terminal determination while storing the user ID and the terminal number in the history management unit 42 [S10].
Further, the center server 40 confirms the validity of the IC cash card 10 by the electronic message transmitted from the IC cash card 10 and performs IC card determination [S11].
If there is no problem in terminal determination and IC card determination, the center server 40 generates an ARPC (Authorization Response Cryptogram) and an issuer script, and transmits them to the store terminal 30 [S12].

The store terminal 30 disassembles the ARPC and the issuer script [S13], and transmits them to the IC cash card 10 [S14, S15].
The IC cash card 10 receives the ARPC and performs issuer authentication [S16], receives the issuer script, and executes unblocking with the issuer script [S17].
When the unblocking is completed, the IC cash card 10 transmits a completion notification to the store terminal 30 [S18], the store terminal 30 transmits a completion notification to the center server 40 [S19], and the center server 40 notifies the completion notification. Is received, the session with the store terminal 30 is terminated [S20].
With this series of flows, the Zengin app of the IC cash card 10 is unblocked. Even when the Zengin app is locked on the factory terminal 20, if the block script is generated in the same flow, the Zengin app can be locked without taking time and effort.

Then, as shown in FIG. 2D, UG printing (embossing) is performed on the IC cash card 10 in which the all silver application is unblocked to print the name and the like.
Finally, as shown in FIG. 2E, the IC cash card 10 is handed over to the customer who applied for the application.

Thus, according to the IC card management system 100 of the present embodiment, the following effects are obtained.
(1) By blocking the Zengin app on the IC cash card 10 until an application is received from the customer, and unblocking the Zengin app immediately before handing the IC cash card 10 to the customer, Crime can be prevented and security and safety during transportation and inventory can be improved.
(2) Since the key information database 43 and the unblock command generation means 44 are provided in the center server 40, the center server 40 can centrally manage the generation process of the digital signature key and unblock script, Security can be increased.
(3) Since the history management means 42 for managing the operation history of the operator is provided, history management can be performed by the center server 40, and it is clear when and where who has released the block of the IC cash card 10, thereby improving the reliability of the system. Can be increased.

(Modification)
The present invention is not limited to the embodiments described above, and various modifications and changes are possible, and these are also within the equivalent scope of the present invention.
(1) The IC card has been described as an example of an IC cash card, but may be an IC credit card. In this case, the credit number is used instead of the account number.
(2) The IC card may be a contact type or a non-contact type.
(3) The block history may be managed by providing the factory terminal 20 with the authentication unit 31.
(4) The IC cash card 10 in the unblocked state may be blocked again after FIG. In this way, when the wrong IC cash card 10 is issued to the customer, the IC cash card 10 can be made unusable. Further, when the IC cash card 10 is discarded, it is possible to prevent data from leaking from the discarded card.

It is a figure which shows the Example of the IC card management system by this invention. It is a figure explaining operation | movement of the IC card management system. 2 is a diagram for roughly explaining the flow of unblocking of the IC cash card 10. FIG. It is a figure explaining the flow of unblocking of the IC cash card 10 in detail.

Explanation of symbols

100 IC card management system 10 IC cash card (IC card)
20 Factory terminal (terminal)
21 Reading means 22 Block command generating means 23 Block command executing means 30 Store terminal (terminal)
31 Authentication means 32 Reading means 33 Communication means 34 Unblock command execution means 40 Center server (server)
41 Communication means 42 History management means 43 Key information database 44 Unblock command generation means

Claims (2)

An IC that includes a store terminal that communicates with an IC card having a block / unblock function and a center server that communicates with the store terminal, handles the IC card, and unblocks the IC card in a block state A card management system,
The center server is
A key information database storing a key for electronic signature,
The store terminal
An authentication unit that authenticates a user who performs unblocking of the IC card with a user ID, and captures the authenticated user ID;
Reading means for reading the IC card information stored in the IC card;
Request transmitting means for transmitting, to the IC card, a request for generating a permission request cipher used for making a permission request to the center server based on the IC card information read by the reading means;
A cipher receiving means for receiving a permission request cipher generated by the IC card that has received the request sent by the request sending means;
ARQC transmission means for transmitting the permission request encryption received by the encryption reception means, the IC card information read by the reading means, the user ID captured by the authentication means, and the terminal number of the store terminal to the center server And comprising
The center server is
Receiving a permission request encryption transmitted by the ARQC transmission means, managing a user ID and a terminal number, a terminal determination means for comparing the received user ID and terminal number;
When verified by the terminal determination means, an authorization response encryption is generated, and an unblock script is generated based on the received IC card information, and stored in the key information database in the unblock script. Unblock command generation means for adding an electronic signature generated using a key for electronic signature;
ARPC transmission means for transmitting the permission response encryption and unblock script generated by the unblock command generation means, and
The store terminal
Unblock script receiving means for receiving the unblock script transmitted by the ARPC transmission means and the permission response encryption;
An unblock script transmission unit that transmits the unblock script and the permission response cipher to the IC card when the authentication of the electronic signature of the unblock script received by the unblock script reception unit is successful. ,
The IC card is
An unblocking function unit configured to receive and authenticate the permission response cipher transmitted by the unblocking script transmission unit and to execute an unblocking function by the received unblocking script;
IC card management system. An IC that includes a store terminal that communicates with an IC card having a block / unblock function and a center server that communicates with the store terminal, handles the IC card, and blocks an unblocked IC card A card management system,
The center server is
A key information database storing a key for electronic signature,
The store terminal
An authentication unit that performs user authentication with a user ID for a user who blocks the IC card, and captures the authenticated user ID;
Reading means for reading the IC card information stored in the IC card;
Request transmitting means for transmitting, to the IC card, a request for generating a permission request cipher used for making a permission request to the center server based on the IC card information read by the reading means;
A cipher receiving means for receiving a permission request cipher generated by the IC card that has received the request sent by the request sending means;
ARQC transmission means for transmitting the permission request encryption received by the encryption reception means, the IC card information read by the reading means, the user ID captured by the authentication means, and the terminal number of the store terminal to the center server And comprising
The center server is
Receiving a permission request encryption transmitted by the ARQC transmission means, managing a user ID and a terminal number, a terminal determination means for comparing the received user ID and terminal number;
When it is verified by the terminal determination means, an authorization response encryption is generated, a block script is generated based on the received IC card information, and an electronic signature stored in the key information database is stored in the block script. A block command generating means for adding an electronic signature generated using a key for use;
ARPC transmission means for transmitting the permission response encryption and block script generated by the block command generation means,
The store terminal
A block script receiving means for receiving the block script transmitted by the ARPC transmitting means and the permission response encryption;
A block script transmitting means for transmitting the block script and the permission response cipher to the IC card when the authentication of the electronic signature of the block script received by the block script receiving means is successful;
The IC card is
It said block script transmission unit has received an authorization response cipher that sent Issuer authenticated, further comprising blocking means for performing a blocking function by the block script received,
IC card management system.

Images