JP2007172078A - Management method of access to computer - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a complicated security system without increased burden of a user. <P>SOLUTION: When a cash card or the like is used, a single user uses a plurality of PINs. The use ranges of the plurality of PINs are hierarchically differed. For example, for use of a higher level, a second PIN is more valid than a first PIN, and a third PIN, if present, is further more valid. Namely, the safety to unauthorized use is enhanced by using the PINs in the ascending order of layers. It is easier to store three sets of 4-digit PINs, compared with storage of one set of 12-digit PINs. Characters usable for PINs include alphabetic coded characters and Kanji characters as well as numeric characters. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention enhances the security of a personal identification number used for managing access to a bank host computer or the like.

  There are many cards on the market today called the card society. In addition to retailer's point cards, there are many cards related to the owner's property such as bank cash cards and credit cards of credit companies.

  Many of these cards write necessary information on the magnetic stripe provided on the front or back side, read the magnetic information from the magnetic stripe using an automatic machine or manual reader such as ATM (Automated Teller Machine), In many cases, when a user enters a PIN consisting of a 4-digit decimal number, it is determined whether or not the user is appropriate, and only the user who is determined to be appropriate is allowed to access the computer. is doing.

FIG. 1 shows an example of the current cash card processing flow.
(1) When a cardholder inserts a cash card into a card insertion slot of a terminal device such as an ATM, a sensor at the card insertion slot detects this and takes the card into the device.

(2) When taking in the card, the terminal device reads card information from the magnetic recording unit of the card.
In the case of a cash card, card information such as a bank code, a branch code, an account type, and an account number is read.
In the case of a credit card, the card identification number, expiration date, account type, and account number are recorded in the magnetic recording unit as card information.
In some cases, a personal identification number is recorded on a cash card or credit card. In this case, the personal identification number is also read.

  (3) The terminal device determines whether the inserted card is a card that can be handled by the terminal device.

  (4) If information indicating that handling is possible is not confirmed from the read card information, or if the card information cannot be read due to damage or damage even with a legitimate card, the terminal The device ejects the card as an improper card that cannot be handled.

  (5) If the card is legitimate and the information in the magnetic recording unit is correctly read, communication with the host computer is started.

  (6) A password input request is made from the host computer.

  (7) In response to a request from the host computer, the card user inputs a personal identification number composed of a 4-digit decimal number.

  (8) When a card user inputs a password in response to a request from the host computer, the host computer uses the input password as a password corresponding to the read card information stored in the host computer. Compare.

  (9) If the password does not match, record it in the magnetic recording section of the card, request the password again, and if the password entered again is valid, follow the procedure If the passwords do not match, the password is requested again in the same way. If the total number of incorrect passwords entered is 3, the card is invalidated and taken into the terminal device. .

  (10) If they match, the host computer determines that the card user is the correct card holder and requests input of the withdrawal amount.

  (11) The user inputs the withdrawal request amount.

  (12) If the withdrawal request amount is appropriate, the withdrawal amount is withdrawn, the cash card is ejected from the terminal device, the book entry or handling statement is issued to the transaction, and the transaction ends.

  If the password is recorded on the cash card, the transaction is performed assuming that the password is correct. Thereafter, the password is deleted from the magnetic recording unit.

Since information written on the magnetic stripe can be easily read using a device called a skimmer, a forged card is created, and often a forged card is used.

As a countermeasure, an IC card incorporating a semiconductor memory has been used, and banks and the like are becoming popular as an alternative to a magnetic card.

  However, even with this IC card, it is possible to read the information stored in the memory, and it cannot be said that it is absolutely safe if counterfeiting takes time. In addition, IC cards are very expensive compared to magnetic cards and cannot be expected to spread quickly.

  In the case of a bank cash card, it is only necessary to be able to use it in one country. Therefore, it is possible to improve safety by using an IC card of the original standard. Since it is necessary to be usable in all countries and regions, it is practically impossible to replace all the magnetic cards used around the world with a standardized IC card. I have to keep using.

  As a means for determining the suitability of a card user rather than preventing unauthorized use by preventing counterfeiting of a card, a password composed of four digits has been used so far. A number that can be inferred is often used for this password, and many damages have been caused so far. In recent years, not only analogy but also pinpointing of a personal identification number by means of voyeurism or the like has been carried out, and it has become extremely difficult to prevent unauthorized use of personal identification numbers.

  It is possible to reduce the damage caused by the use of stolen cards or counterfeit cards by increasing the number of digits of the PIN to 5 digits or more, but it is built on the assumption of the user's memory problem and the 4-digit PIN. From the viewpoint of compatibility with existing card systems, it is practically impossible to use a password with four or more digits.

  In order to minimize such damage even if it is not possible to prevent such damage, the usage content, for example, the amount of money used per time or per day is limited, and damage within that limit is covered by non-life insurance. Measures such as compensation are taken, but the limit on the usage amount is extremely inconvenient for the user.

In order to cope with such a situation, biometrics (biometrics) technology using pattern recognition technology has been partially adopted.
Typical biometric authentication technologies include iris authentication, fingerprint authentication, palm print authentication, finger vein authentication, palm vein authentication, and palmar vein authentication. Among these authentications, there are contact type and non-contact type authentication. However, in any case, it is necessary to register a pattern in advance, and it takes time to register the pattern, and it also takes time for authentication, which increases the operation cost.

  Therefore, even though biometric authentication technology can be used only for a small number of people, for example, in an entrance / exit management system for a facility under strict management, it cannot be put into practical use in a cash card system for a large number of people. Have difficulty. Moreover, since only partial authentication is performed in the authentication process, it cannot be said that it is perfect. In the case of the contact type, since it is necessary to directly touch the detection device, there is a problem of hygiene or physiological disgust.

  In addition, a biometric authentication system that can only be used by the cardholder itself is not possible even if you try to ask the agent to handle the card because the card usage time or card processing device is not familiar to you. This is also inconvenient for the user.

  In addition, since various standards for biometric authentication technology are prosperous, it is not possible to unify these standards so that they can be used in common among different operators, such as current cash cards or credit cards. It is virtually impossible.

  The present application provides an invention of a computer access management method capable of improving security without making a fundamental change to a conventionally used cash card or credit card.

  Therefore, in the invention according to the present application, a plurality of password numbers are used, and the plurality of password numbers are used as a hierarchical structure.

  Furthermore, as a personal identification number for enhancing safety, any character that can be processed by a computer such as alphanumeric characters, Japanese characters composed of kana and kanji, and universal code characters can be used in addition to four-digit numbers.

  With such a configuration, the password system can be complicated without increasing the burden on the user, the safety is increased, and the convenience for the user is significantly improved.

Hereinafter, the best mode for carrying out the invention will be described with reference to the drawings.
FIG. 2 shows a first embodiment according to the present invention using three sets of password numbers.
The number of passwords used in this embodiment is three sets, each consisting of a 4-digit decimal number.
As seen in the example of a telephone number, it is not difficult for a normal person to store a plurality of sets of four-digit decimal numbers. Some users do not feel any inconvenience.

  These three passwords have different functions and input timings. For example, the first password is input prior to the other passwords, and the upper limit of the withdrawal amount is 100,000 yen. The upper limit of the withdrawal amount is 500,000 yen.

  The second password is input after the first password, the upper limit of the withdrawal amount is 500,000 yen, and the upper limit of the daily withdrawal amount is 5 million yen.

  Further, the third password is input after the second password, and the upper limit of the withdrawal amount is 1 million yen, and there is no upper limit of the daily withdrawal amount.

  The reason why the upper limit of the withdrawal amount per operation is set to 1 million yen is that the amount that can be handled in one operation is usually 1 million yen due to the capacity of the processing apparatus. Is the upper limit, the upper limit amount need not be 1 million yen.

The processing flow of the first embodiment according to the present invention will be described with reference to FIGS.
(1) When a cardholder inserts a cash card into a card insertion slot of a terminal device such as an ATM, a sensor at the card insertion slot detects this and takes the card into the device.

(2) When taking in the card, the terminal device reads card information from the magnetic recording unit of the card.
In the case of a cash card, card information such as a bank code, a branch code, an account type, and an account number is read.
In the case of a credit card, the card identification number, expiration date, account type, and account number are recorded in the magnetic recording unit as card information.
In some cases, a personal identification number is recorded on a cash card or credit card. In this case, the personal identification number is also read.

  (3) The terminal device determines whether the inserted card is a card that can be handled by the terminal device.

  (4) If information indicating that handling is possible is not confirmed from the read card information, or if the card information cannot be read due to damage or damage even with a legitimate card, the terminal The device ejects the card as an improper card that cannot be handled.

  (5) If the card is legitimate and the information in the magnetic recording unit is correctly read, communication with the host computer is started.

  (6) The host computer requests the card user to input the first password.

  (7) In response to a request from the host computer, the card user inputs a first password consisting of a 4-digit decimal number.

  (8) When the card user inputs the first password in response to a request from the host computer, the host computer corresponds to the read card information stored in the host computer. Compare with the first password.

  (9) If they do not match, the fact is recorded in the magnetic recording section of the card, the input of the first password is requested again, and the re-entered first password is valid Performs the following procedure, and if it does not match, it again asks for the input of the first password again. If the total number of incorrect inputs of the first password is 3, the card is invalidated and the terminal device Dispose of it invalidally.

  (10) If they match, the host computer determines that the card user is the correct card holder and requests input of the withdrawal amount.

  (11) The user inputs the withdrawal request amount.

  (12) The host computer determines whether the input withdrawal request amount is 100,000 yen or less, which is the amount that can be used with the first personal identification number, and whether the withdrawal amount on that day is 500,000 yen or less.

  (13) If the entered withdrawal request amount is 100,000 yen or less and the withdrawal amount for the day is 500,000 yen or less, the withdrawal amount is withdrawn, the cash card is discharged from the terminal device, and the entry into the passbook Alternatively, a transaction statement is issued and the transaction ends.

  (14) If the input withdrawal request amount is 100,000 yen or more, or if the withdrawal amount for the day is 500,000 yen or more, the host computer requests the card user to input the second password.

  (16) In response to a request from the host computer, the card user inputs a second personal identification number composed of a 4-digit decimal number.

  (17) When the card user inputs the second password, the host computer compares the input second password with the second password corresponding to the read card information stored in the host computer.

  (18) If they do not match, the fact is recorded in the magnetic recording section of the card, the second password is requested again, and the second password entered again is valid If the two passwords are not matched, the second password is requested again, and if the total number of incorrect input of the second password is three times, the card is invalidated and the terminal device is inactivated. Dispose of it invalidally.

  (19) The host computer determines whether the input withdrawal request amount is 500,000 yen or less, which is the amount that can be used with the second personal identification number, and whether the withdrawal amount on that day is 1 million yen or less.

  (20) When the second personal identification number matches, the amount is withdrawn, the cash card is ejected from the terminal device, the book entry in the passbook or the handling statement is issued, and the transaction ends.

  (21) If the inputted withdrawal request amount is 1 million yen or more, or if the withdrawal amount for the day is 1 million yen or more, the host computer requests the card user to input the third password.

  (22) In response to a request from the host computer, the card user inputs a third password formed by a 4-digit decimal number.

  (23) When the card user inputs the third password, the host computer compares the input third password with the third password corresponding to the read card information stored in the host computer.

  (24) If they do not match, the fact is recorded in the magnetic recording section of the card, the input of the third password is requested again, and the re-entered third password is valid After that, if it does not match, it prompts for the input of the third password again, and if the total number of incorrect input of the third password is 3, the card is invalidated and the terminal device Dispose of it invalidally.

  (25) When the third password is matched, the amount is withdrawn, the cash card is ejected from the terminal device, the book is entered into the passbook or the handling statement is issued, and the transaction ends.

Each password used here is a 4-digit decimal number. However, by using a plurality of sets of four-digit decimal numbers, and in the case of the embodiment of FIGS. 2 and 3, three sets are used, so that a code number substantially consisting of 8-digit or 12-digit decimal numbers is obtained.
Accurately storing 8 or 12 decimal digits is usually very difficult for a person, but as seen in PINs, phone numbers, etc., 4-digit decimal numbers are easily and accurately stored by humans. It is a character string that can be.

  In addition, a user with a single withdrawal amount of less than 100,000 yen using a terminal device and a daily withdrawal amount of 500,000 yen may be used by a user with a PIN number consisting of a conventional 4-digit decimal number. One user can use up to 500,000 yen for one withdrawal, and 1 million yen for one day of withdrawal can be used by users who want a one-digit withdrawal number. A user who needs to use a set and needs a withdrawal amount more than that uses another set of personal identification numbers composed of four-digit decimal numbers.

  Also, each personal identification number is 4 decimal digits as before, and it is not 8 digits or 12 digits, so there is no need to change the configuration of the terminal device including the display unit, and the capacity of the personal identification number storage unit of the host computer. In order to cope with the use of a plurality of passwords, the present invention can be implemented only by slightly changing the program, and the cost for reconfiguring the system is not great.

  In addition, since it is considered that there are not so many cases of inputting a decimal number of 8 digits or 12 digits, it is unlikely that damage will be caused by snooping such a password.

  Also, unlike a biometric authentication system that can only be used by the cardholder himself, it can be used by an agent.

  In addition, since the use of a 4-digit decimal number is common not only in Japan but also in the world, a common system can be configured without various standards being disturbed as in biometric authentication technology.

  In addition, biometrics technologies such as fingerprint authentication, palmprint authentication, finger vein authentication, palm vein authentication, and palmar vein authentication can be used to directly touch the detection device with contact type authentication. There is no problem of feeling.

  In addition, it cannot be overemphasized that the restriction | limiting of the amount of withdrawal shown in this Example and the number of sets of PIN numbers are only illustrations, and these can be set arbitrarily.

FIG. 4 shows an example of three sets of personal identification numbers composed of 4-digit decimal numbers.
The code number set shown in this example is composed of first to third five first code numbers [0-1-2-3] and second code numbers [4-5-6] each consisting of four decimal numbers. 7] and the third password [8-9-0-1].

As another embodiment, a password not based on a decimal number will be described.
A password composed of four decimal digits is composed of numbers from “0-0-0-1” to “9-9-9-9”, and the total number is 10,000.
When the decimal number 10000 is directly compared with the binary number, 213 = 8192 <10000 <16384 = 214
It is.

  In ATM, characters other than arithmetic numbers are displayed for message transmission to the user. In addition, when performing procedures such as remittance, characters other than numbers can be input in order to designate a remittance destination. By utilizing this fact, it is possible to use passwords other than decimal numbers.

<< Hexadecimal >>
A computer or the like basically operates in a binary number (binary). Since the number of digits in the binary number becomes too large for humans, a hexadecimal number of 24 is used. Hexadecimal numbers are composed of Arabic numerals from 0 to 9 and alphabets from A to F. Four-digit hexadecimal numbers are expressed as 0000 to FFFF, and the number of combinations is 164 = 65,536 in decimal. It is a big number.
A 4-digit hexadecimal number can be stored without much difference from a 4-digit decimal number.
Of course, it is also possible to use a plurality of 4-digit hexadecimal numbers.
FIG. 5 shows an example of a security code number in hexadecimal.

In addition, by adding English letters 20 from G to Z and using a total of 36 characters, not only 364 = 1,679,616 pairs of passwords can be used, but also all English letters By making it available, the word can be used for password.
FIG. 6 shows an example of a PIN code using English characters.

Turning to Japanese, the available double-byte characters specified in the JIS Level 1 characters are 158 for Hiragana, Katakana for a total of 158, 166 for English, Greek and Russian for uppercase and lowercase. There are 2965 kanji and 3390 second level kanji.
FIG. 7 shows an example of the PIN code in the first level kanji.

  As is apparent from the embodiments shown in FIGS. 4, 5, and 6, even if the number of used characters increases, it does not become difficult to store. Designation of characters in terminal devices such as ATM can be easily executed by adopting single character conversion.

When this 4-digit decimal number is expressed by double-byte characters used in data communication and computer processing, double-byte characters are expressed by 2-byte codes in JIS code or shift JIS code or shift code, so 2 bytes x 4 characters = 8 bytes = 64 bits. Since an encryption key used in a common common key encryption system DES (Data Encryption System) is 56 bits, a 64-bit password expressed by four full-width characters is more complicated than a DES encryption key. It can be a key.
A 64-bit, that is, 64-digit binary number exceeds 19 digits when expressed in decimal.
If you turn this over, you can get a 19-digit password by using four full-width characters.

Since a plurality of passwords have a hierarchical structure, as a result, a password with a large number of digits is required for use of the upper layer, and it is extremely difficult to steal the password.
In addition, storing a plurality of 4-digit password numbers as password numbers is much easier than storing a set of password numbers having a large number of digits. Absent. .
By using English letters, kanji characters, etc. in addition to numbers as passwords, and using word phrases, etc., safety is improved and convenience is not reduced.

  Since the present invention uses a personal identification number composed of the same four-digit decimal number in addition to the conventional personal identification number composed of a four-digit decimal number, a new one like biometric authentication is used. It can be realized by simply changing a computer program without requiring an apparatus, and effective authentication can be realized without the user having a hygienic or physiological aversion.

  The present invention is useful in the fields such as hierarchization of entrance facilities and hierarchization of usage authority even in a system where PIN code or biometric authentication is used for admission management, authority authentication, etc. in addition to cash cards and credit cards. It is.

The flowchart of the conventional PIN code process. The flowchart of the PIN code process of this invention. FIG. 3 is a flowchart of the personal identification number process of the present invention, which is a continuation of FIG. 2. An example of a personal identification number in the embodiment of the present invention. An example of a security code in hexadecimal. An example of a PIN code using English characters. An example of a PIN code in Kanji. The flowchart of the character code processing of this invention.

Claims (3)

An access management method that enables access to a computer by inputting a password consisting of a character string of several digits, the access management method comprising:
An access management method that uses characters other than numbers as a secret code. An access management method that enables access to a computer by inputting a set of PINs consisting of several decimal digits, the access management method comprising:
In addition, use a set of PINs consisting of several decimal digits;
An access management method in which access to the computer is different by sequentially using the several sets of passwords. An access management method that enables access to a computer by inputting a password consisting of a character string of several digits, the access management method comprising:
In addition, use several sets of secrets consisting of several digit strings;
An access management method in which access to the computer is different by sequentially using the several sets of passwords.

Images