JPH11212923A - Authentication method and system in financial transaction - Google Patents

Abstract

(57) [Summary] (Corrected) [Problem] In a financial transaction through a transmission path between a financial institution and an individual or a corporation, if a third party illegally obtains a password or the like for authenticating the transaction, the illegal transaction is performed. This prevents unauthorized use of contract information and transaction information of non-contact IC cards and the like held by third parties that are obtained. According to the authentication method and system in the financial transaction, a password is inputted at the time of conducting a transaction, and simultaneously, pressure pattern data corresponding to characters at the time of input is registered in advance by an input keyboard constituted by a pressure sensor such as a piezoelectric element. The above problem can be solved by checking the pattern data against the illegal transaction of a third party who has illegally acquired the password, and by transmitting a data erasing program to the IC card from outside through wireless or infrared rays and performing data erasing. Solve.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a pressure pattern applied to an input keyboard when a customer such as an individual or a corporation entering into a financial transaction contract with a financial institution inputs a character such as a password for authenticating the transaction when requesting a financial transaction. Using the data, in particular, regarding the transaction request through the financial transaction terminal, the relevant trader pre-registers or accumulates and refers to the pressure pattern data history when inputting in the past, and refers to the input keyboard at the time of the transaction request. Compared with the pressure pattern data, rejected the transaction request of the third party who attempted to conduct an illegal transaction, and furthermore, the contract information of the transaction contractor stored on the IC card medium which the third party illegally obtained and held Suitable for use in security management of over-the-counter transactions of financial institutions, home banking, farm banking, and electronic payment through transmission channels, which erase transaction information It is an authentication method and system in financial transactions.

[0002]

2. Description of the Related Art When conducting financial transactions by over-the-counter transactions, home banking, farm banking, and electronic payment through a transmission line of a financial institution, personal information for authenticating the transaction, contract information, and keywords are transmitted to the financial institution terminal of the financial institution. Alternatively, the connection is made by connecting a customer's financial transaction terminal to an open transmission line such as a public line, the Internet, or a personal computer. When conducting financial transactions through a financial transaction terminal of a financial institution and a network, the information system includes an ID number, a password, a line authentication, an electronic signature, an identity authentication, and the like as methods for preventing improper transactions by spoofing.

In a conventional method, a password can be used for each user in advance in a system including a plurality of terminal devices and a processing device, such as a data security method disclosed in Japanese Patent Publication No. 5-61832. When the usage right information indicating the business is registered and the user performs the business, it compares the password entered from the terminal with the usage right information and the registered contents, determines whether or not to accept the business processing request, and accepts it There is a method of performing a process corresponding to the business process request only when it is determined that

[0004] The conventional method comprises a plurality of linear contact electrodes formed on an electrode substrate, an electrode sheet, a pressure-sensitive sheet, and a counter electrode, as in the personal authentication system described in Japanese Patent Publication No. 7-85276. There has been a method of performing personal authentication by capturing the pressurized state of a finger as a change in resistance value and reading the contact resistance using a fingerprint input unit composed of:

[0005]

The above-mentioned prior art cannot prevent unauthorized transactions for those who can know a password for authenticating transactions during financial transactions. When a user himself / herself inputs a password, a third party may be able to obtain the password visually. Or, in order to prevent spoofing, there is no consideration for easy trading operations of traders, such as periodically changing passwords and requiring complicated input procedures to traders, and secure and easy transactions cannot be performed. there were. In addition, in the case of forcibly stealing a password or inquiring a person's body by referring to fingerprints or retinal information, there is a problem that a third party may injure a trader's body. Furthermore, if the non-contact IC card and the contract information, transaction information, etc. contained therein are stolen, it cannot be prevented that the information is held by a third party who intends to conduct unauthorized transactions and used for other purposes. Further, when a data erasing program is mounted on the IC card itself, there is a problem that data is erased due to malfunction.

[0006] It is an object of the present invention to associate a character data at the time of transaction input of a trader with pressure data for an input keyboard, and collate the data with pressure pattern data registered in advance to obtain a password by a third party. It is better to prevent illegal transactions. Further, the pressure pattern data for the input keyboard is difficult to obtain visually, and cannot be obtained by a third party illegally. Further, when it is determined that the transaction is illegal, the contract information and transaction information held by the illegal transaction are transmitted from outside to a medium such as a non-contact IC card, and the data is processed by a data processing unit on the IC card. By executing the erasing program, the information held by the fraudulent trader can be properly erased, and by transmitting the data erasing program from the outside to a medium such as an IC card, data erasure due to malfunction can be prevented.

[0007]

SUMMARY OF THE INVENTION In order to achieve the above object, the present invention provides an authentication method and system for financial transactions according to the present invention. The pressure data generated by the finger contacting the input keyboard is measured as a voltage value by a data measuring unit composed of a piezoelectric element, and the voltage value for the entire input keyboard is transmitted to the authentication system by the transmission / reception unit. An authentication unit for receiving voltage value data and comparing the pressure pattern data at the time of the transaction with the pressure pattern data corresponding to a character registered in advance is provided.

Further, in order to achieve the above object, the authentication method and system for financial transactions of the present invention provide a method for erasing contract information and transaction information stored in an IC card by using an IC card and a financial transaction terminal. A transmission / reception unit that transmits and receives a data erasure program by wireless or infrared communication means when it is determined that the transaction is illegal, a storage unit that stores the data erasure program, and a data processing unit that executes the data erasure program.

[0009] As an operation based on the above means, in a financial transaction terminal that conducts a transaction with a financial institution, a program for authenticating a transaction based on a plurality of pieces of information and erasing data held by an unauthorized trader is identified as an illegal transaction. By transmitting the information to a medium such as an IC card at the point in time, it is possible to prevent a third party from illegally obtaining personal authentication information, and to prevent illegal transactions by a third party during financial transactions. In this case, erasing the information on the IC card can prevent unauthorized use of the information by an unauthorized third party.

[0010]

Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is an overall conceptual diagram of an authentication method and system in a financial transaction showing one embodiment of the present invention, FIG. 2 is a block diagram of a financial transaction terminal as a main part thereof, and FIG. 3 is a block constituting an authentication system. Diagram,
FIG. 4 is a block diagram of the IC card.

In FIG. 1, 1 is used by an individual or a company that has a transaction with a financial institution, and transmits and receives contract information and transaction information for financial transactions through a store of the financial institution or through a network. Character data such as password entered for transaction authentication and pressure data at the time of character input are sent to the authentication system, and after receiving the authentication result from the authentication system, transaction execution or password re-entry accepted, registered input characters When the pattern data and the input pressure pattern data at the time of the transaction do not match with the input pressure pattern data, the authentication system determines that the transaction is an illegal transaction, sends an alarm to the financial transaction terminal, and when the financial transaction terminal receives the alarm, This is a financial transaction terminal that transmits a data erasure program to an IC card used as a transaction. 2 receives and manages data transmitted from the financial transaction terminal, generates pattern data based on the received character data, pressure data, and pre-registered data, performs collation processing, and authenticates transactions during financial transactions. Is an authentication system that returns an authentication result to a financial transaction terminal. Reference numeral 3 denotes a data storage medium such as an IC card used when a transaction requester transmits / receives transaction data to / from a financial transaction terminal. Reference numeral 4 denotes a transmission line including a dedicated line and an open network.

In FIG. 2, the financial transaction terminal 1 includes a control unit 11, an input unit 12, a display unit 13, a data processing unit 14, a data storage unit 15, a data measurement unit 16, a transmission / reception unit 17,
It comprises a C card interface 18. The overall control device 11 includes an overall control unit 111, a data control unit 112, and a communication control unit 113. In FIG. 3, the authentication system financial institution terminal 2 includes a control unit 2
1, an authentication unit 22, a data processing unit 23, a pattern data generation unit 24, an authentication data storage unit 25, a transmission / reception unit 26, and an alarm 27. Among them, the control unit 21
Comprises a general control unit 211, a data control unit 212, a communication control unit 213, and a data check unit 214. In FIG. 4, the IC card 3 includes a control unit 31, a storage unit 3
2. It is composed of a data processing unit 33 and a transmitting / receiving unit 34.
The control unit 31 includes an overall control unit 311, a storage control device 312, and a communication control unit 313. FIG.
Is a processing flow for receiving contract information of IC card data in response to a transaction request to a financial transaction terminal, measuring input character data and character input pressure data, and transmitting the measured data to an authentication system.

The financial transaction terminal 1 receives contract information stored in the IC card shown in FIG. 10 through the IC card interface 18 at the time of a transaction request from a transaction requester (step 101), and executes a transaction through the input unit 12. A password input for authentication is received (step 102). At this time, the data measuring unit 16 measures the voltage value data from the character input pressure of the finger of the trader with respect to the input keyboard and the attached piezoelectric element shown in FIG. 9 (step 103), and the authentication system shown in FIG. The entered input character data and input pressure data are transmitted (step 104). FIG. 6 shows a transaction request from the financial transaction terminal 1, contract information of the transaction requester, a password for receiving pressure data for character input and authenticating the transaction based on the contract information of the transaction requester registered in advance. The pressure pattern data is searched and collated, and the financial transaction terminal 1 authenticates the result (transaction permission, transaction rejection, illegal transaction determination).
Is a processing flow for sending back.

The authentication system 2 receives the input character data and the pressure pattern data transmitted from the financial transaction terminal 1 by the transmission / reception unit 26 (step 105). A table of the pre-registered password and the pressure pattern data generated by the pattern data generation unit 24 is searched (step 106). Next, the registered password and pressure pattern data of the retrieved trader are collated with the password and pressure pattern data at the time of the transaction request using the check table shown in FIG. 13 (step 107). At this time, a password check (step 108) and a pressure pattern check (step 109) are performed, and a pressure allowable data range for the input keyboard is set based on the pressure data at the time of the past transaction, and a data range check is performed. (Step 110). Further, in response to an input error at the time of a repeated transaction request from the same transaction requester, a transaction rejection authentication result is transmitted to the financial transaction terminal 1 of the transaction requester (step 114), and the number of transactions is reduced. Counting is performed using the error count table shown in FIG. 14 (step 112), and it is checked whether the error count has exceeded an arbitrary set count (step 113). Reply (Step 11
5). FIG. 7 shows an authentication result received from the authentication system 2, a transaction execution or transaction refusal message, and an instruction for re-password input displayed to the transaction requester. 5 is a processing flow for transmitting a program for erasing a.

The financial transaction terminal 1 receives the authentication result shown in FIG. 15 from the authentication system 2 (step 11).
6) Check whether the transaction is permitted based on the authentication result (step 117). If the transaction is permitted, execute the transaction of the transaction requester (step 118). If the transaction is not permitted, then check the unauthorized transaction based on the authentication result. Performing (Step 119), if the authentication result indicates that the transaction is rejected, a transaction rejection message is displayed (Step 120), a password re-input instruction is performed (Step 121), and the authentication result is an illegal transaction determination. If so, the data erasing program is transmitted to a medium such as an IC card (step 122). FIG.
Is a process flow in the IC card for receiving and storing the data erasing program from the financial transaction terminal 1 and executing the data erasing.

The IC card 3 receives the data erasure program from the financial transaction terminal by the transmission / reception unit 34 (step 123), temporarily stores it in the storage unit 32, and temporarily stores the data in the data processing unit 3.
In step 3, the contract data stored in the storage unit 32 and the transaction data shown in FIG. 16 are deleted (step 124).
Also, the data erasing program is stored in the authentication system,
Includes sending to financial transaction terminals and IC cards. FIG. 9 is an example showing the input unit and the input keyboard of the financial transaction terminal and the contact state of the input requester at the time of character input, and reference numeral 121 indicates a finger on the input key touching at the time of character input. It is a piezo element installed on the part. FIG. 17 shows an example in which the authentication system 2 sets a regression line based on time-series pressure data of past transaction data, and sets an allowable data range based on upper and lower limits arbitrarily set from the regression line. .

[0017]

According to the present invention, when a customer who performs a financial transaction such as transfer of money to a financial institution, deposit / withdrawal, settlement, etc. makes a transaction request to the financial institution, the password and the like and the authentication method are performed together. In addition, even if the customer's password is obtained illegally, illegal transactions can be prevented, and the contract information and transaction information of the IC card held by the third party who attempts the illegal transactions will be erased and this information will be illegal. It can be expected to prevent use.

[Brief description of the drawings]

FIG. 1 is an overall schematic diagram of a financial transaction authentication method and system of the present invention comprising a financial transaction terminal, an authentication system, a network, and an IC card.

FIG. 2 is a device configuration of the financial transaction terminal.

FIG. 3 is a device configuration of the authentication system.

FIG. 4 is an apparatus configuration of the IC card.

FIG. 5 is a process flow for receiving contract information of IC card data in response to a transaction request to a financial transaction terminal, measuring input character data and character input pressure data, and transmitting the measured data to an authentication system.

FIG. 6 is a password for receiving a transaction request from the financial transaction terminal 1, contract information of the transaction requester, pressure data for character input, and authenticating the transaction based on the contract information of the transaction requester registered in advance; It is a processing flow for searching and collating pressure pattern data and returning an authentication result (transaction permission, transaction rejection, illegal transaction determination) to the financial transaction terminal 1.

FIG. 7 receives an authentication result from the authentication system 2,
This is a processing flow in which a transaction execution or transaction refusal message and a password re-entry instruction are displayed to the transaction requester, and a program for erasing data stored in the IC card is transmitted when it is determined that the transaction is an unauthorized transaction.

FIG. 8 is a processing flow in a C card that receives and stores a data erasure program from the financial transaction terminal 1 and executes data erasure.

FIG. 9 is an example showing an input unit of the financial transaction terminal 1 and an input keyboard and a contact state at the time of character input of a transaction requester of the input keyboard.

FIG. 10 shows an example of contract information stored in the IC card 3 and transmitted to a financial institution terminal at the time of a transaction request, where the transaction requester contracts with the financial institution.

FIG. 11 is a diagram illustrating the operation of the authentication system 2 from the financial transaction terminal 1.
5 is an example of data of an input password and input pressure data at the time of a transaction request transmitted to the user.

FIG. 12 is an example of a registration source password and a pressure pattern data table registered in advance in the authentication system 2 for matching with transaction request data received from the financial transaction terminal 1.

FIG. 13 is an example of a transaction result data of a transaction request data received from the financial transaction terminal 1, a collation source password registered in advance, and a pressure pattern data table in the authentication system 2.

FIG. 14 is an example of an incorrect transaction determination error count table for counting the number of input errors in response to a repeated transaction request from the financial transaction terminal 1 in the authentication system 2;

FIG. 15 is an example of data of an authentication result returned from the authentication system 2 to the financial transaction terminal 1.

FIG. 16 is an example of a transaction data table in which data is erased by the data erasing program received from the financial transaction terminal in the IC card 3.

FIG. 17 shows an example in which the authentication system 2 sets a regression line based on time-series pressure data of past transaction data, and sets an allowable data range based on upper and lower limits arbitrarily set from the regression line. .

[Explanation of symbols]

1. Financial transaction terminal 2. Authentication system 3. IC
Card, 4 network, 11 control unit, 12 input unit, 12113 display unit, 14 data processing unit, 15 data storage unit, 16 data measurement unit, 17
... Transceiver, 18 ... IC card interface,
111: overall control unit, 112: data control unit, 113
... Communication control unit, 21 ... Control unit, 22 ... Authentication unit,
23: data processing unit, 24: pattern data generation unit,
25: authentication data storage unit, 26: transmission / reception unit, 27: alarm unit, 211: overall control unit, 2
12 data control unit, 213 communication control unit, 214
Data check unit, 31 control unit, 32 storage unit,
33: Data processing unit, 34: Transmission / reception unit, 311: Overall control unit, 312: Storage control unit, 313: Communication control unit.

Claims (4)

[Claims] 1. A character input unit of a financial transaction requester, a pressure data measuring unit for an input keyboard of the character input unit, data to an authentication system, a program transmitting / receiving unit, an IC card interface and an IC card at the time of unauthorized transaction by an IC card. A financial transaction terminal having a storage unit for a data erasure program to be transmitted to the financial transaction terminal is connected to a dedicated line, an open network, and the input character data transmitted from the financial transaction terminal, the transmission / reception unit of pressure data for the input keyboard and collation with the received pressure data In an authentication system having a pattern data generation unit based on pre-registered pressure data and a storage unit for authentication data, and having means for authenticating a transaction based on the pressure data, a transaction such as a password is authenticated to a financial transaction terminal. When a character to be input is input, the pressure data for the input character and the input keyboard is measured. The input character data and the pressure data for the input keyboard are transmitted to the authentication system through the transmission path, and the input character data and the pressure data for the input keyboard are stored to authenticate the transaction. Check the pressure pattern data,
An authentication method and system in a financial transaction that performs transaction authentication of a corresponding transaction when a transaction is requested. 2. A financial transaction terminal according to claim 1, wherein an allowable data range comprising a plurality of pressure data for said input keyboard is generated, and said input character pattern data for verification and a pressure pattern for said input keyboard. An authentication method and system in a financial transaction, comprising means for collating data. 3. The financial transaction terminal according to claim 1, further comprising a pressure sensor comprising a piezoelectric element as a means for measuring pressure data on the input keyboard. 4. The financial transaction terminal according to claim 1, wherein the contract information stored in the IC card of the financial transaction requester;
A program for erasing transaction information is stored in a storage device and has a data transmission / reception interface such as a wireless adapter.
An authentication method and system in a financial transaction for transmitting a program to a medium such as a C card and executing a program for erasing information stored in a medium such as an IC card.