JP2009211120A - Authentication method in online settlement system and online settlement system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent such a situation that authentication becomes impossible due to system failure or the like in an online settlement system or the like. <P>SOLUTION: An online settlement system in which an affiliated store server 2 which receives a request for settlement from a customer PC1 performs the authentication of the customer by using a network, and settles a request from the customer PC1 based on the result includes a monitoring server 6 for monitoring the defects of an access control server 3 and a directory server 4 through the network, and the affiliated store server 2 includes an authentication system switching part 42 for switching a plurality of authentication systems, and further the affiliated store server 2 is configured to, when any defect is detected in the network by the monitoring server 6, switch the authentication system to that not using the network, and to perform the authentication of the customer. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an online payment system on the Internet using a credit card.

2. Description of the Related Art An online payment system on the Internet using a credit card performs personal authentication by allowing a cardholder to enter a password at a card issuer website. As a result, member stores can be protected from the risk of unauthorized use due to impersonation. When a customer tries to make a payment at a member store's site, the customer is jumped to the card issuer's site and asked for a password. If you enter the correct password here, payment will be executed, but if you enter the wrong password, payment will be rejected.
Special table 2007-523405 gazette

  However, the conventional online payment system has a problem that authentication may not be possible due to a system failure or the like. That is, in the online payment system, when authentication is not possible, the member store has only the option of executing payment unconditionally or rejecting payment entirely. In the former case, the merchant must bear the amount of fraudulent use, and in the latter case, there is a possibility of missing a sales opportunity due to the inability to settle.

  In particular, online payment on the Internet has the property that customers can easily stop shopping. For system failures, other payment methods such as cash can be used for transactions at ordinary stores, but in online payments on the Internet, transactions are highly likely to be interrupted, and system failures remain unchanged. It tends to lead to a decrease in sales.

  Furthermore, since the failure of the online payment system discovered by the customer becomes apparent for the first time at the stage of payment, even if the customer makes an inquiry to the credit card company or the store, the cause cannot be immediately identified. There was a problem that could lead to distrust.

  Therefore, the problem to be solved by the present invention is that the online payment system eliminates the situation where authentication cannot be performed due to a system failure or the like, so that the member store must bear the amount of fraudulent use. The object is to provide an online payment system that prevents the situation that the sales opportunity is missed by preventing the payment and further making the payment impossible. At the same time, it is to provide an online payment system that gains customer's trust by eliminating the interruption of the transaction itself.

In order to solve the above-mentioned problem, the invention according to claim 1 is based on a result of a payment server receiving a payment request from a customer terminal authenticating the customer using a network. In the online payment system in which a request from the customer terminal is settled, the payment server has an authentication method switching unit for switching a plurality of authentication methods, and further, authentication by the first authentication method among the authentications using the network If there is an error, the control unit switches to the second authentication method using the network and controls to perform the customer authentication.

Furthermore, in the invention according to claim 4 of the claim, the payment server has a success information storage unit for storing information that has been successfully authenticated using the network, and an authentication method that does not use the network is: The present invention is in an online payment system that authenticates based on information about the customer stored in the success information storage unit.

  As a result, the present invention eliminates a situation in which authentication cannot be performed due to a system failure or the like in an online payment system, thereby preventing a situation in which a member store must bear the illegally used money and further making payment. It is possible to prevent a situation where the sales opportunity is missed by disappearing. At the same time, it is possible to provide an online payment system that gains customer trust by eliminating the interruption of the transaction itself.

FIG. 1 is an overall configuration diagram of an online payment system according to the present embodiment.
Reference numeral 1 denotes a customer personal computer (hereinafter referred to as a PC) operated by a customer as a card holder. 2 is a merchant server that sells goods or services to customers online, receives a request for payment from the customer's PC 1, requests authentication of the customer from an authentication server, which will be described later, and performs authentication. Based on this, it functions as a settlement server that settles the request from the PC 1 of the customer.
An access control server 3 permits the customer's PC 1 to access the online payment system. Further, 4 is a directory server that stores various information related to customers, and has a database that executes a search in response to an inquiry from the access control server 3, and the access control server 3 and the directory server 4 are the member store server. 2 functions as an authentication server for authenticating the customer in response to the request from 2.
5 is a settlement gateway, and 6 is a monitoring server that monitors the access control server 3 and the directory server 4 on-line for failure and notifies the member store server 2 when a failure is detected. That is, when there is a failure detection 16 from the access control server 3 and a failure detection 17 from the directory server 4, the monitoring server 6 transmits a failure information notification 18 to the member store server 2.

  Typical authentication methods in the online payment system include 3D secure authentication and one-time password authentication. 3D secure authentication is a method in which a password is entered from the customer's PC 1 in addition to entering a credit card number and an expiration date. One-time password authentication is a method that uses a disposable password that is valid only once for authentication.

  For the 3D secure authentication, the access control server 3 and the directory server 4 are used. In order to complete the settlement, between the customer PC 1 and the member store server 2 (11 in FIG. 1), between the customer PC 1 and the access control server 3 (12 in FIG. 1), between the directory server 4 and the access control server 3 (FIG. 13), communication between the member store server 2 and the settlement gateway 5 (15 in FIG. 1) is performed.

  FIG. 2 is a configuration diagram of the member store server 2 according to the present embodiment. The member store server 2 includes a member store Web application 21, an authentication method selection unit 22, an authentication method database 23, a 3D secure authentication unit 24, a one-time password authentication unit 25, a risk-based authentication unit 26, a setting It consists of a file 27.

  The member store Web application 21 is an interface between the customer PC 1 and the payment gateway 5, and exchanges messages with the authentication method selection unit 22. In other words, the exchange of this message means that the member store Web application 21 receives the settlement request 11-1 from the customer's PC 1 and returns a settlement completion response 11-2 to the customer's PC 1. Further, the member store Web application 21 transmits an authentication request 31-1 to the authentication method selection unit 22, and receives an authentication response 31-2 as a response. Further, the member store Web application 21 transmits an authorization request 15-1 that is a collation with the credit balance of the customer's credit card to the settlement gateway 5, and receives an authorization response 15-2 that is a result of the collation. .

  On the other hand, the authentication method selection unit 22 exchanges messages with the authentication method database 23, the 3D secure authentication unit 24, the one-time password authentication unit 25, and the risk-based authentication unit 26. That is, the message exchange in this case means that the authentication method selection unit 22 transmits the credit card number information 36-1 to the authentication method database 23 and receives the usable authentication method information 36-2 from the authentication method database 23. To do. Here, the usable authentication method information 36-2 is 3D secure authentication, one-time password authentication, and risk-based authentication.

Further, the authentication method selection unit 22 makes an authentication request 32-1 to the 3D secure authentication unit 24, and the 3D secure authentication unit 24 makes an authentication response 32-2. Similarly, the authentication method selection unit 22 makes an authentication request 34-1 to the one-time password authentication unit 25, and the one-time password authentication unit 25 makes an authentication response 34-2. Similarly, the authentication method selection unit 22 makes an authentication request 38-1 to the risk-based authentication unit 26, and the risk-based authentication unit 26 makes an authentication response 38-2. Further, in the case of unconditional authentication described later, the authentication method selection unit 22 performs an unconditional authentication permission inquiry 37-1 on the setting file 27 and receives the unconditional authentication permission permission 37-2 from the setting file 27. . Further, the authentication method selection unit 22 receives the failure information notification 18 from the monitoring server 6.

  FIG. 3 is a functional block diagram of the authentication method selection unit 22 of the member store server 2. The authentication method switching unit 42 connects to the authentication method database 23, receives the available authentication method information 36-2 that is an authentication method that can be used by the customer based on the card number of the customer, and switches it. Specifically, switching is performed from the 3D secure authentication method that is an authentication method using a network to the one-time password authentication method, and further to the risk-based authentication method that is an authentication method that does not use the network. The failure information receiving unit 43 receives the failure information notification 18 from the monitoring server 6.

  The success information accumulating unit 44 accumulates information when customer authentication is successful by 3D secure authentication or one-time password authentication, which is an authentication method using a network. Whether or not to perform risk-based authentication this time for the customer based on the past success record for the customer stored in the success information storage unit 44 at the time of risk-based authentication, which is an authentication method that does not use a network Or determine whether risk-based authentication is successful. The control unit 41 controls these, and requests authentications (32-1, 34-1 and 38-1) from the 3D secure authentication unit 24, the one-time password authentication unit 25, and the risk-based authentication unit 26. ) And the authentication response (32-2, 34-2, 38-2) is received. The success information storage unit 44 may be stored in an external server as a database.

  Next, the operation of this embodiment will be described. FIG. 4 is a flowchart showing the operation of the authentication method selection unit 22 of the member store server 2. First, the customer uses the Web browser on the customer's PC 1 to access the member store Web application 21 of the member store server 2 and inputs a credit card number to make a settlement request 11-1. The member store Web application 21 sends the authentication request 31-1 together with the credit card number to the authentication method selection unit 22, and the authentication method selection unit 22 receives the authentication request 31-1 (S101).

  The authentication method selection unit 22 makes an inquiry to the authentication method database 23 using the credit card number information 36-1, and obtains usable authentication method information 36-2 that can be used by the credit card as a response (S102). Here, the authentication method database 23 returns two authentication methods using the network and one authentication method not using the network. In this embodiment, “3D secure authentication” and “one-time password authentication” are returned to the former, and “risk-based authentication” is returned to the latter.

  At this time, it is determined whether there is a failure information notification 18 from the monitoring server 6 (S103). When there is no failure information notification 18 from the monitoring server 6, that is, when authentication using the network is possible, the former is executed in order, and when there is the failure information notification 18, that is, the authentication server cannot be accessed and authentication using the network is not possible. In this case, the latter is executed once.

  If there is no failure information notification 18, the authentication method selection unit 22 sends an authentication request 32-1 to the 3D secure authentication unit 24. First, the 3D secure authentication unit 24 transmits an authentication execution permission request 14-1 to the access control server 3 through the directory server 4 (S104).

  In the case of a positive response 14-2, a redirect response to the access control server 3 is sent to the Web browser, and an authentication request 33-1 is sent to the access control server 3 via the customer PC1. The customer inputs the password on the password input screen displayed by the access control server 3. The access control server 3 verifies the password, and sends the authentication permission / inhibition 33-2 to the 3D secure authentication unit 24 via the browser.

  If no error has occurred during 3D secure authentication (S105), the successful information storage unit 44 stores the date and time for each customer ID (credit card number) and the IP address of the customer's PC1. (S108). Thereafter, the authentication method selection unit 22 returns an authentication response 31-2 to the member store Web application 21 (S114).

  FIG. 5 is an explanatory view showing success information stored in the success information storage unit 44. For the success information, for each customer ID (credit card number), the date of successful date and the IP address of the customer's PC 1 are stored as information. In the example shown in the figure, a customer with a card number “1234 5678 9009 8765” has a customer PC1 with an IP address “123.456.XY.” The fact that authentication has been successful twice at 15:30 on March 2 indicates that it has been accumulated.

  On the other hand, if an error occurs during 3D secure authentication and the authentication response 32-2 is not returned, the authentication method selection unit 22 sends an authentication request 34-1 to the next-time password authentication unit 25 specified next. send. The control flow of one-time password authentication is the same as that of 3D secure authentication. That is, the one-time password authentication unit 25 first transmits an authentication execution permission request 14-1 to the access control server 3 through the directory server 4 (S106).

  In the case of a positive response 14-2, a redirect response to the access control server 3 is sent to the Web browser, and an authentication request 35-1 is sent to the access control server 3 via the customer PC1. The customer inputs the password on the password input screen displayed by the access control server 3. The access control server 3 verifies the password, and sends an authentication propriety 35-2 to the one-time password authentication unit 25 via the browser.

  If no error has occurred during the one-time password authentication, the date and time for each customer ID (credit card number) and the IP address of the customer's PC 1 are stored in the success information storage unit 44 (S108). ). Thereafter, the authentication method selection unit 22 returns an authentication response 31-2 to the member store Web application 21 (S114).

On the other hand, when there is a failure information notification 18 from the monitoring server 6 (S103) and when all of the authentication methods using the network are errors (S105, S107), the authentication method selection unit 22 It is determined whether there is an authentication method that does not use the network (S109). The authentication method selection unit 22 sends an authentication request 38-1 to the risk-based authentication unit 26 designated as the authentication method not using the network (S110).
If the network is available and all authentication methods using the network are errors, the risk-based authentication may not be performed and the transaction may be deemed impossible because the authentication has failed.

  The risk-based authentication unit 26 does not communicate with the remote host, but determines whether or not the current authentication can be executed based on the success information stored in the success information storage unit 44, and sends an authentication response 38-2 to the authentication A reply is sent to the method selection unit 22. The authentication method selection unit 22 returns an authentication response 31-2 to the member store Web application 21 (S114).

  If no authentication method is specified in S109, the authentication method selection unit 22 makes an unconditional authentication permission inquiry 37-1 for the setting file 27, and the setting file 27 The unconditional authentication permission permission 37-2 is received from, and it is determined whether or not the member store permits unconditional authentication (S111). If permitted, unconditional authentication is returned to the member store Web application 21 (S114).

  When the authentication response 31-2 is successful, the member store Web application 21 sends an authorization request 15-1 to the payment gateway 5, and when the authorization response 15-2 is received, the payment result is displayed on the Web browser of the customer PC 1. To do. On the other hand, if the authentication response 31-2 is an authentication rejection, the fact is displayed on the Web browser of the customer's PC1.

  FIG. 6 is a block diagram showing an outline of the risk-based authentication unit 26. The risk-based authentication unit 26 includes a success information search unit 63 that searches for information stored in the success information storage unit 44, a payment amount reception unit 64 that receives the payment amount for the current authentication, and a control unit that controls them. 61.

  FIG. 7 is a flowchart showing a part of the operation of the risk-based authentication unit 26. As shown in FIG. 4, when there is a failure information notification 18 from the monitoring server 6 (S103), and when all authentication methods using the network are errors (S105, S107), the network It is determined whether there is an authentication method that does not use (S109). In S109, when there is an authentication method that does not use the network, the authentication method selection unit 22 makes an authentication request 38-1 to the risk-based authentication unit 26. Therefore, the success information search unit 63 of the risk-based authentication unit 26 searches the success information storage unit 44, and the control unit 61 determines whether there has been a case where authentication has succeeded with the same customer ID (credit card number) in the past ( S201). If there is no successful authentication with the same customer ID in the past, the authentication is rejected.

  In S201, when there is authentication success with the same number in the past, the success information search unit 63 further searches the success information storage unit 44, and the control unit 61 uses the same customer ID in the past for a certain number of times (for example, twice). It is determined whether there is a successful case as described above (S202). If the customer ID has not been successful more than a certain number of times in the past, the authentication is rejected.

  In S202, when there is a certain number of successes, the control unit 61 looks at the state of the payment amount receiving unit 64 that has received the current payment amount, and the current payment amount is less than a predetermined amount (for example, 10,000 yen). Whether or not (S203). If the current payment amount is not less than a certain amount, that is, if the payment amount is high, the authentication is rejected.

In this way, the risk-based authentication unit 26 performs risk-based authentication based on the information stored in the success information storage unit 44 that stores information that has been successfully authenticated. Here, in the above description, whether there is a case of successful authentication with the same customer ID in the past (S201) or whether there is a successful case more than a certain number of times with the same customer ID in the past (S202). ), It has been explained that the determination in three steps of whether the current payment amount is less than a certain amount (S203), but not limited to this, other determination items may be increased, and conversely the steps may be decreased. . For example, the determination item may include a case where terminal information about the customer, that is, the IP address of the PC used by the customer matches. Alternatively, information related to other customers, for example, customer certificate information may be stored and compared as a determination item.

  According to the present embodiment, the monitoring server 6 constantly monitors the access control server 3 and the directory server 4 and continues to transmit the failure information to the member store server 2, so that the user is almost unaware of the occurrence of the failure. Can be completed and payment can be made. Compared to the case where payment is interrupted by the conventional method, the credibility of the member store is increased, and the risk of loss of sales opportunity is reduced.

  In this embodiment, 3D secure authentication, one-time password authentication, and risk-based authentication are applied as authentication methods. However, various other authentication methods can be used by replacing or adding an authentication unit. . Further, the function of switching from authentication using a network at the time of failure to continue authentication is applicable not only to credit card payment but also as a user authentication method in other applications.

1 is an overall configuration diagram of an online payment system according to an embodiment. It is a block diagram of the member store server regarding this Embodiment. It is a functional block diagram of an authentication method selection part. It is a flowchart which shows operation | movement of an authentication system selection part. It is explanatory drawing which shows the success information accumulate | stored in the success information storage part. It is a block diagram which shows an outline to a risk-based authentication part. It is a flowchart which shows a part of operation | movement of a risk-based authentication part.

Explanation of symbols

1 Customer PC
2 Merchant Server 3 Access Control Server 4 Directory Server 5 Settlement Gateway 6 Monitoring Server 21 Merchant Web Application 22 Authentication Method Selection Unit

Claims (19)

In an online payment system in which a payment server that receives a payment request from a customer terminal performs authentication of the customer using a network and pays the request from the customer terminal based on the result,
The settlement server includes an authentication method switching unit that switches a plurality of authentication methods,
Furthermore, when there is an error in the authentication by the first authentication method among the authentications using the network, the control unit switches to the second authentication method using the network and performs control to perform the customer authentication. An online payment system characterized by that. In an online payment system in which a payment server that receives a payment request from a customer terminal performs authentication of the customer using a network and pays the request from the customer terminal based on the result,
The settlement server includes an authentication method switching unit that switches a plurality of authentication methods,
The online payment system further comprising a control unit that controls to perform authentication of the customer by switching to an authentication method that does not use the network when authentication using the network is not possible. 3. The online payment system according to claim 2, wherein the network includes an authentication server that authenticates the customer in response to a request from the payment server,
The case where the authentication using the network is impossible is a case where there is an error in the authentication by the authentication server. 3. The online payment system according to claim 2, wherein the network includes an authentication server that authenticates the customer in response to a request from the payment server;
Having a monitoring server for monitoring a failure of the authentication server via the network;
The case where authentication using the network is not possible is a case where a failure is detected in the authentication server by the monitoring server or a case where connection to the authentication server is impossible. The online payment system according to any one of claims 2 to 4,
Further, the payment server has a success information storage unit for storing information on successful authentication using the network,
The online payment system, wherein the authentication method that does not use the network is a risk-based authentication method that performs authentication based on information about the customer stored in the success information storage unit. The online payment system according to claim 5,
The online settlement system, wherein the risk-based authentication method is based on the presence or absence of past successful cases for the customer. The online payment system according to claim 5,
The online payment system, wherein the risk-based authentication method is the presence / absence of past successful cases with respect to the customer and the payment amount in the current authentication. The online payment system according to claim 5,
In the online settlement system, the risk-based authentication method is based on the number of past successful cases for the customer. The online payment system according to claim 5,
The online payment system, wherein the risk-based authentication method is the number of past successful cases and the payment amount in the current authentication for the customer. The online payment system according to claim 5,
The online settlement system, wherein the risk-based authentication method is terminal information of past successful cases and terminal information in the current authentication for the customer. In an authentication method in an online payment system in which a payment server that receives a payment request from a customer terminal performs authentication of the customer using a network and pays the request from the customer terminal based on the result.
An authentication method in an online payment system, comprising: a switching step of switching to an authentication method that does not use a network when authentication using a network is not possible; and an authentication step of performing authentication that does not use the network. The authentication method in the online payment system according to claim 11,
An authentication method in an online payment system, wherein the case where authentication using the network is not possible is a case where there is an error in authentication by an authentication server that authenticates the customer in response to a request from the payment server. The authentication method in the online payment system according to claim 11,
The case where the authentication using the network is not possible is a case where a failure is detected in the authentication server that receives the request from the settlement server and authenticates the customer or a case where the authentication server cannot be connected. Authentication method for online payment system. In the authentication method in the online payment system according to any one of claims 11 to 13,
And a success information accumulating step for accumulating information on successful authentication using the network,
An authentication method in an online payment system, wherein the authentication step of performing authentication without using the network includes a risk-based authentication step of authenticating based on information about the customer accumulated in the success information accumulation step. The authentication method in the online payment system according to claim 14,
An authentication method in an online payment system, wherein the risk-based authentication method is based on the presence or absence of past successful cases for the customer. The authentication method in the online payment system according to claim 14,
An authentication method in an online payment system, wherein the risk-based authentication method is the presence / absence of a past successful case regarding the customer and the payment amount in the current authentication. The authentication method in the online payment system according to claim 14,
The risk-based authentication method is an authentication method in an online payment system, characterized in that the number of past successful cases for the customer is a reference. The authentication method in the online payment system according to claim 14,
An authentication method in an online payment system, wherein the risk-based authentication method is the number of past successful cases and the payment amount in the current authentication for the customer. The authentication method in the online payment system according to claim 14,
An authentication method in an online payment system, wherein the risk-based authentication method is terminal information of a past successful case regarding the customer and terminal information in the current authentication.

Images