JPWO2016013048A1 - Method and system for generating a sign code used to securely transfer money - Google Patents

Abstract

A method of generating a sign code used to securely transfer money includes generating a first part of a signature code based on a total amount of money transfer, a business value, an amount of detailed data of money transfer data, A hash value is generated using one or more data items selected from the total amount of remittance, time information generated at a predetermined timing, and recipient information, and predetermined for the generated hash value Generating the sign code by combining the first part of the sign code and the second part of the sign code by performing the conversion process and the arithmetic process performed Prepare to do.

Description

  The present invention relates to a method and system for generating a signature code used to securely transfer money. More particularly, the present invention relates to a method and system for securely transferring money by using an authorization password generated based on a sign code.

  Companies and individuals can request money transfers from financial institutions such as banks. The bank that has received the request for remittance sends the designated amount to the recipient designated by the client. In recent years, techniques for performing remittance safely are known. As an example, a bank increases the security of the remittance process by using a “one-time password (OTP)” generated by the token when remittance. “One-time password” is an authentication method that overcomes the weaknesses of conventional password authentication methods by generating a password that can be used only once.

  FIG. 1 illustrates a remittance method using a one-time password in the Internet banking system 20. The sender can access the Internet banking system 20 using the client device 10, and then input the recipient 11, the amount of money 12, and the OTP 13 on the screen and press the OK button 14 to send the money. The sender inputs the OTP generated by the token 16 for generating the OTP into the OTP field 13.

  The token 16 is a small device for performing digital authentication on a computer network (see Patent Document 1). The token is sometimes called an authentication token or a security token. Even if the password generated by the token 16 is stolen, the password is changed depending on the time and the valid time is limited. Therefore, the remittance method using the token 16 is known as a method with relatively high security strength. .

  The remittance request including the payee 11, the remittance amount 12 and the OTP 13 is transmitted via the network 30 and received by the server of the Internet banking system 20. The internet banking system 20 includes an OTP generation unit 21 and an OTP collation unit 22. The OTP generation unit 21 can generate the verification OTP 23 in synchronization with the token 16. The OTP collation unit 22 collates the received OTP 13 and the generated collation OTP 23 (24), thereby determining whether the received remittance request is correct. When it is determined that the remittance request is correct, the internet banking system 20 can perform a remittance process based on the remittance request.

  In recent years, it is known that various cyber crimes (for example, unauthorized access, online fraud, computer viruses, etc.) have occurred. When the Internet banking system 20 is infected with a specific computer virus, there are cases where the remittance request information is falsified, and it is known that the conventional OTP using the token 16 may not prevent cybercrime. Yes.

JP 2011-044017 A

  In view of such a situation, an object of the present invention is to provide a remittance method and a remittance device that are relatively safer than conventional remittance methods and remittance systems using tokens.

  According to one aspect of the present invention, there is provided a method for generating a sign code used for secure remittance, generating a first part of a sign code based on a total amount of remittance, a business value, and remittance. Generates a hash value using one or more data items selected from the amount of data detail data, the total amount of remittance, time information generated at a predetermined timing, and recipient information Generating a second part of the sign code by performing a predetermined conversion process and arithmetic process on the hash value, and a first part of the sign code and a second part of the sign code To generate the sign code.

  As another aspect of the present invention, a remittance system for generating a sign code used for safely performing remittance is a screen control unit that controls display of a screen in response to occurrence of a specific event, Time information is stored in the storage when one of the specific events occurs, and in response to the occurrence of one of the specific events, a sign code number based on the total amount of remittance. 1 part is generated, and a hash value is generated using one or a plurality of data items selected from the business value, the detailed data amount of the remittance data, the total amount of the remittance, the time information, and the recipient information. Then, by performing a predetermined conversion process and calculation process on the generated hash value, a second part of the sign code is generated, and the first part and the previous part of the sign code are generated. By combining a second portion of the sign code comprises a sign code generator configured to generate the signature code.

  According to the present invention, by generating a sign code and using a one-time password generated using the sign code, it is possible to realize a transaction with higher safety than a conventional one-time password. The sign code of the present invention is composed of a first part and a second part. The first part of the sign code is generated based on the total amount of remittance. The second part of the sign code generates and generates a hash value using one or more data items selected from the business value, detailed amount of remittance, total amount of remittance, time information, and recipient information The hash value is generated by performing a predetermined conversion process and calculation process on the hash value.

  A detailed understanding of the embodiments disclosed herein can be obtained from the following description, illustrated with reference to the accompanying drawings.

FIG. 1 illustrates a remittance method using a one-time password in an Internet banking system. FIG. 2 is an overall view of an exemplary system configuration according to the present invention. FIG. 3 shows a system configuration of the Internet banking system. FIG. 4 shows an example of screen transition of an application provided by the Internet banking system. FIG. 5 shows an exemplary login menu for the Internet banking system. FIG. 6 shows an exemplary screen for transferring a single currency displayed on the display of the client device. FIG. 7 shows an exemplary screen for transferring multiple currencies displayed on the display of the client device. FIG. 8 is a processing flow for generating a one-time password based on a sign code. FIG. 9 shows a remittance processing flow executed in the Internet banking system. FIG. 10 is a functional block diagram of the Internet banking system.

  In this specification, the term “client device” includes, for example, a personal computer, a laptop, a tablet computer, a personal digital assistant (PDA), a user equipment (UE), a mobile station, a cellular phone, a smartphone, or wired or wireless. Any other type of device operable in the environment may be included, but is not limited to these.

  As used herein, the term “remittance system” can include, but is not limited to, one or more servers and computing devices of an internet banking system. The remittance system can display a predetermined application screen on the display of the client device, and can receive and process a remittance request transmitted from the client device.

  Some embodiments of the present invention provide a method and system for generating a sign code used to securely transfer money, and an authorization password (PW) generated based on the sign code (hereinafter “authorization PW”). A method and system for securely transferring money by using a) is described. The authorization PW is a one-time password (OTP) generated according to the process described in this specification.

  FIG. 2 is an overall view of an exemplary system configuration according to the present invention. The system includes a client device 100, a token 110, a network 200, and an internet banking system 300. The client device 100 and the internet banking system 300 are connected via a network 200 so that they can communicate with each other.

  The client device 100 can access the internet banking system 300 via the network 200 and display an application screen for remittance in response to communication with the internet banking system 300. When the remittance information is input to the application screen and the OK button is pressed, a remittance request is transmitted from the client device 100 to the Internet banking system 300. The remittance request includes a user identifier and an approval PW in addition to the payee account information and the remittance amount. A part of the approval PW is generated by inputting a signature code generated according to a predetermined algorithm to the token 110.

  The internet banking system 300 can determine whether the approval PW included in the received remittance request is a correct password. As a result of the determination, when it is determined that the approved PW is the correct password, the internet banking system 300 performs a remittance process based on the received remittance request.

  FIG. 3 shows a system configuration of the internet banking system 300. The internet banking system 300 includes a CPU 301, a RAM 302, a ROM 303, a storage 304, a connection interface 305 and a network interface 306. The components 301 to 306 are communicably connected to each other via the bus 310.

  The CPU 301 controls each device and circuit, and performs calculations and data processing. A RAM 302 is a temporary storage area and is used when the CPU 301 executes an operation. The ROM 303 is a storage area for storing various programs. The storage 304 includes, for example, an HDD (Hard Disk Drive), an SSD (Solid State Drive), and the like, and stores various data. Based on the control of the CPU 301, data is read from the storage 304 and data is written to the storage 304.

  The connection interface 305 is an interface for connecting various devices to the Internet banking system 300. For example, a display, a keyboard, a mouse, an external storage device, and the like can be connected to the Internet banking system 300 via the connection interface 305.

  The network interface 306 is connected to the network 200 through a communication line. The network interface 306 controls data input / output between the network 200 and the Internet banking system 300 based on the control of the CPU 301. The connection between the network interface 306 and the network 200 may be either a wired connection or a wireless connection.

  FIG. 4 shows an example of screen transition of an application provided by the Internet banking system 300.

  When the client device 100 accesses the Internet banking system 300 in S401, the login menu 500 is displayed on the display of the client device 100 in response to this access. FIG. 5 shows an exemplary login menu 500 of the internet banking system 300. The login menu 500 includes a company ID 501, a user ID 502, and a server password (PW) 503. The user inputs his company ID, user ID, and server PW in the fields 501, 502 and 503, and presses the login button 503. When the login button 503 is pressed, user authentication is performed, and the user can log in to the Internet banking system 300. When the clear button 504 is pressed, the input data is cleared.

  In S <b> 402, communication between the client apparatus 100 and the Internet banking system 300 is performed in response to pressing of the login button 503, and a job selection menu is displayed on the display of the client apparatus 100. The user selects a desired job (for example, “money transfer”) from the jobs provided by the Internet banking system 300. The selected business information is communicated to the Internet banking system 300.

  In step S <b> 403, a screen for inputting remittance information is displayed on the display of the client device 100 in response to the selection of the “remittance” operation. The user enters the payee information (name, bank code, account number, etc.), one or more currency types and one or more remittance amounts. If the next screen button is pressed after these pieces of information are input, the process proceeds to S404.

  In S404, a screen for executing remittance is displayed on the display of client device 100. An example of a screen for executing remittance is shown in FIGS. Since the number of currency types is determined in S403, the screen 600 is displayed when the currency type is one, and the screen 700 is displayed when the currency type is plural.

  In the above embodiment, an example in which the creator of the remittance data and the approver are the same user has been described, but an embodiment in which the creator of the remittance data and the approver are different users may be executed. In such a case, the creator of the remittance data performs the operations of S401 to S403, and thereafter, the approver having a predetermined authority performs the operations of S401, S402, and S404. Therefore, it should be noted that the embodiment of the present invention is not particularly limited to the example shown in FIG.

  FIG. 6 shows an exemplary screen 600 for transferring a single currency displayed on the display of the client device 100.

  The screen 600 includes a user ID 601, an approval PW 602, an OK button 603, a cancel button 604, remittance data 605, and a sign code 606. The user ID 601 displays the user ID 502 used for user authentication in the login menu 500.

  The approval PW 602 includes a first approval PW 602-1 and a second approval PW 602-2. The first approval PW 602-1 is a field for inputting an identifier (PIN: personal identification number) predetermined for each user. The first approval PW 602-1 is associated with each user and stored in the storage 304. The second approval PW 602-2 is a field for inputting a one-time password (OTP). A one-time password (OTP) is generated based on the sign code 606. A method for generating a one-time password (OTP) will be described later with reference to FIG.

  When the OK button 603 is pressed, a remittance request is transmitted to the Internet banking system 300. When the cancel button 604 is pressed, the remittance request is not transmitted and the screen returns to the previous screen. The remittance data 605 is data including the number of detail data, the type of currency to be remittance, and the total amount. “No. of Env.” In the remittance data 605 indicates a sequence number, and “No. of Inst.” In the remittance data 605 indicates the number of detailed data. Since FIG. 6 shows an example of remittance of a single currency, the remittance data 605 shows only one currency type.

  When a screen for executing remittance (screen 600) is displayed, the sign code 606 is calculated and displayed based on a predetermined algorithm. In the example of FIG. 6, the sign code 606 is “03331234”. In one embodiment of the present invention, the first portion (“0333”) of the sign code 606 is generated based on the total amount of remittance data 605. The total amount of remittance data 605 is calculated when the screen 600 is displayed.

The second portion of sign code 606 (“1234”) can be generated by the following procedure when screen 600 is displayed.
(1) From business value, total amount of remittance data 605, amount of detailed data of remittance data 605, time (millisecond), recipient information (name, bank code, account number, etc.) and other arbitrary data items A hash value is generated based on the selected one or more data items. The business value is a value determined in advance for each type of business such as remittance (for example, “remittance” = 1). The time (millisecond) may be the time when the screen 600 is displayed. Alternatively, the time (millisecond) may be the time (millisecond) when the next screen button is pressed in S403. The time (milliseconds) can be stored in the storage 304 together with the user information every time the screen 600 is displayed or every time the next screen button is pressed in S403.
(2) The generated hash value (message digest) is converted according to one or a plurality of predetermined conversion processes.
(3) The converted numerical value is calculated based on a predetermined algorithm, and the second part (“1234”) of the sign code 606 is generated.

  FIG. 7 shows an exemplary screen 700 for transferring multiple currencies displayed on the display of the client device 100.

  The screen 700 includes a user ID 701, an approval PW 702, an OK button 703, a cancel button 704, a plurality of remittance data 705, a total 706, and a sign code 707. The user ID 701 displays the user ID 502 used at the time of user authentication.

  The approval PW 702 includes a first approval PW 702-1 and a second approval PW 702-2. The first approval PW702-1 is a field for inputting an identifier (PIN) predetermined for each user. The first approval PW 702-1 is associated with each user and stored in the storage 304. The second approval PW702-2 is a field for inputting a one-time password (OTP). The one-time password (OTP) is generated based on the sign code 707. A method for generating a one-time password (OTP) will be described later with reference to FIG.

  When the OK button 703 is pressed, a remittance request is transmitted to the Internet banking system 300. When the cancel button 704 is pressed, the remittance request is not transmitted and the screen returns to the previous screen. The remittance data 705 is data including the number of detailed data for each type of a plurality of currencies, the type of currency for remittance, and the total amount for each currency. “No. of Env.” In the remittance data 705 indicates a sequence number, and “No. of Inst.” In the remittance data 705 indicates the number of detailed data. In the example of FIG. 7, “2” is displayed in the “No. of Inst.” Field of the Japanese yen (JPY), so the number of remittance data of the Japanese yen (JPY) is two. Since FIG. 7 shows an example of remittance of a plurality of currencies, the remittance data 705 can indicate a plurality of types of currencies.

  When a screen for executing remittance (screen 700) is displayed, the sign code 707 is calculated and displayed based on a predetermined algorithm. In the example of FIG. 7, the sign code 707 is “24391234”. In one embodiment of the present invention, a first portion (“2439”) of sign code 707 is generated based on grand total 706. The grand total 706 is calculated based on the exchange rate at a particular point in time when the screen 700 is displayed.

  In the example of FIG. 7, the total 706 is displayed in US dollars. In one embodiment of the present invention, the currency type of the total 706 may be determined based on the company ID 501. In one embodiment of the present invention, the company ID 501 can indicate the name of the country in which the contract company is located by a partial character string. In another embodiment of the present invention, the types of currencies that can be used in advance as the total 706 currency are registered in the Internet banking system 300, and the user can register the registered currency types before remittance. You can select one currency type.

Referring again to FIG. 7, the second portion of the sign code 707 (“1234”) can be generated by the following procedure when the screen 700 is displayed.
(1) Selected from business value, detailed data amount of remittance data 705, total 706, time (milliseconds), payee information (name, bank code, account number, etc.) and any other data items A hash value is generated based on one or more data items. The business value is a value determined in advance for each type of business such as remittance (for example, “remittance” = 1). The time (millisecond) may be a time when the screen 700 is displayed. Alternatively, the time (millisecond) may be the time (millisecond) when the next screen button is pressed in S403. The time (milliseconds) is stored in the storage 304 together with the user information every time the screen 700 is displayed or every time the next screen button is pressed in S403.
(2) The generated hash value (message digest) is converted according to one or a plurality of predetermined conversion processes.
(3) The converted numerical value is calculated based on a predetermined algorithm, and the second portion (“1234”) of the sign code 706 is generated.

  FIG. 8 is a processing flow for generating a one-time password (OTP) based on the sign code 606 or the sign code 707. In this generation process, the token 110 is used.

  When the start key of the token 110 is pressed in S801, the token 110 is switched to the OTP generation mode. The start key may be a predetermined key of the token 110 keys. In S802, the sign code 606 or the sign code 707 is input using the key of the token 110.

  In S803, when the generation key for the token 110 is pressed, the token 110 generates an OTP based on the input sign code. The algorithm for generating the OTP is predetermined for each token 110 used. That is, even if the tokens are from the same manufacturer, each token 110 used by a different user has a different generation algorithm. A generation algorithm corresponding to the token 110 distributed to the user is stored in the Internet banking system 300 in association with each user.

  Referring again to FIG. 6 and FIG. 7, the generated OTP is input to the second approval PW 602-2 field or the second approval PW 702-2 field. When an OK button 603 or 703 is pressed after inputting the approval PW (a combination of the first approval PW and the second approval PW), a remittance request is transmitted from the client device 100 to the Internet banking system 300.

  FIG. 9 shows a remittance processing flow executed in the Internet banking system 300.

  In step S <b> 901, the internet banking system 300 receives a remittance request from the client device 100. The data format of the remittance request includes company ID 501, user ID 502, approval PWs 602, 702, recipient information (name, bank code, account number, etc.), remittance data 605, 705 (including detailed data), total 706, and signature Codes 606, 707 can be included.

  In S902, the internet banking system 300 accesses the storage 304 based on the company ID 501 and the user ID 502, and reads the first approval PW and time (milliseconds) associated with the company ID 501 and the user ID 502. As described above, the time information is stored in the storage 304 together with the user information every time the screens 600 and 700 are displayed or every time the next screen button is pressed in S403.

  In S903, the internet banking system 300 generates the first part of the sign code and the second part of the sign code according to the algorithm described with reference to FIG. 6 and FIG. The first part of the sign code is generated based on the received remittance data 605 or grand total 706. The second part of the sign code is generated by the internet banking system 300 according to the procedures (1) to (3) described above with reference to FIGS.

  The internet banking system 300 has an OTP generation algorithm associated with each user ID 502. As described above, a different token 110 is associated with each user, and each token 110 has a different OTP generation algorithm. The OTP generation algorithm generates a second verification approval PW from the first part of the generated sign code and the second part of the generated sign code. The generated second verification approval PW is combined with the first verification approval PW read from the storage 304 to generate a verification approval PW.

  The internet banking system 300 determines whether or not the received remittance request is a correct request by comparing the approval PW received from the client device 100 with the verification approval PW generated in the internet banking system 300. To do. The conventional OTP is an OTP generated by the token 16, but the OTP (that is, the approved PW) of the present invention is the business value, the amount of detailed data of the remittance data 605 and 705, the total amount 706, and a predetermined timing. To be generated with a predetermined algorithm based on one or more data items selected from time information, recipient information (name, bank code, account number, etc.) and any other data item It is possible to maintain a relatively high safety.

  If it is determined in S904 that the request is correct, the Internet banking system 300 executes a remittance process according to the received remittance request.

  FIG. 10 is a functional block diagram of the internet banking system 300. The internet banking system 300 includes a screen control unit 1001, a sign code generation unit 1002, a verification unit 1003, a remittance processing unit 1004, and a storage 304.

  The screen control unit 1001 can control the display of the screen in response to the occurrence of a specific event, and can receive a remittance request from the client device 100. As described with reference to FIG. 4, the screen control unit can display a specific screen when a specific event (for example, pressing of a button) occurs. As described above, the time information (milliseconds) is stored in the storage 304 when one of the specific events occurs, that is, when the next screen button is pressed on the remittance information input screen (S403).

  When the next screen button is pressed on the remittance information input screen (S403), the sign code generation unit 1002 receives the first sign code based on the total amount of remittance (remittance data 605 or total 706) included in the remittance request. Can be generated. The sign code generation unit 1002 generates and generates a hash value using one or a plurality of data items selected from the business value, the amount of detailed remittance data, the total amount of remittance, time information, and recipient information. The second part of the sign code can be generated by performing a predetermined conversion process and calculation process on the hash value thus determined. Furthermore, the sign code generation unit 1002 can generate a sign code by combining the first part of the sign code and the second part of the sign code.

  The collation unit 1003 collates by combining the first part of the approved PW stored in advance in the storage 304 and the second part of the approved PW generated from the sign code according to the algorithm defined for each user. Approval PW can be generated. The collation unit 1003 can determine whether the remittance request is a correct request by collating the approval PW included in the remittance request with the approval PW for collation.

  The remittance processing unit 1004 can execute remittance based on the remittance request when the collation unit 1003 determines that the remittance request is a correct request.

  Although the principle of the present invention has been described above with reference to exemplary embodiments, those skilled in the art will appreciate that various embodiments that change in configuration and details can be realized without departing from the spirit of the present invention. Will understand. That is, the present invention can take an embodiment as, for example, a system, apparatus, method, program, or storage medium.

Claims (9)

A method of generating a sign code used to securely transfer money,
The method
Generating a first part of a sign code based on the total amount of remittance;
Generate a hash value using one or more data items selected from the business value, detailed data amount of remittance data, total amount of remittance, time information generated at a predetermined timing, and recipient information Generating a second part of the sign code by performing predetermined conversion processing and arithmetic processing on the generated hash value;
Combining the first part of the sign code and the second part of the sign code to generate the sign code. The sign code is used to create an authorization password generated according to an algorithm defined for each user,
The method of claim 1, wherein the authorization password is included in a remittance request.   When the approval password included in the remittance request and the approval password for verification generated by the remittance system are collated to determine whether the remittance request is a correct request, and when it is determined to be a correct request, The method of claim 2, wherein a remittance is performed.   The remittance system includes: an identifier predetermined for each user stored in the remittance system; and a one-time password derived from the generated sign code according to the algorithm defined for each user. 4. The method of claim 3, wherein the verification approval password is generated in combination.   The time information indicates when a screen for executing remittance is displayed or when a remittance information is input and a predetermined button is pressed, and the screen for executing remittance is displayed. The method of claim 1, wherein the degree or remittance information is entered and stored in the remittance system each time a predetermined button is pressed.   The method of claim 1, wherein the total amount of remittance is indicated by a national currency based on the sender's identifier. A remittance system that generates a sign code that can be used to securely transfer money,
A screen control unit that controls display of a screen in response to the occurrence of a specific event, wherein the time information is stored in a storage when one of the specific events occurs;
In response to one of the specific events occurring,
Generate a first part of the sign code based on the total amount of remittance,
Generate a hash value using one or more data items selected from the business value, detailed data amount of remittance data, total amount of remittance, time information, recipient information, and the generated hash value Generating a second part of the sign code by performing predetermined conversion processing and arithmetic processing on
A remittance system comprising: a sign code generation unit configured to generate the sign code by combining the first part of the sign code and the second part of the sign code. The screen control unit receives a remittance request including an approval password from the client device, and the approval password is generated from the sign code according to an algorithm defined for each user,
The remittance system is
A collation unit that determines whether the remittance request is a correct request by collating the approval password included in the remittance request with an approval password for verification generated by the remittance system;
8. The remittance system according to claim 7, wherein remittance is executed by a remittance processing unit when the remittance request is determined to be a correct request.   The verification unit includes a first portion of the verification approval password stored in the storage and the verification approval password generated from the generated signature code according to the algorithm defined for each user. 9. The remittance system according to claim 8, wherein the verification approval password is generated in combination with a second part.

Images