JP2001052068A - Method and system for individual authentication for electronic commercial transaction - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve the security in electronic commercial transactions by efficiently deciding the reliability of a user, who accesses a selling site on the internet, with a relatively simple mechanism. SOLUTION: When a person 16 requesting purchase inputs personal information and card information in order to purchase a commodity, information related to the terminal of the person 16 such as a remote host name and a remote IP are automatically detected by an authentication server of an online service provider 13 and are collated with a personal information data base 151. Since personal information of individual users and information related to terminals of users or the like are preliminarily held in the personal information data base 151 in relation to each other, authentication processing to find out a user, who actually accessed the server, in accordance with information related to a terminal or to decide the reliability of the user is easily performed.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to a personal authentication system and a personal authentication method applied to electronic commerce using the Internet.

[0002]

2. Description of the Related Art In recent years, electronic commerce (EC) using the Internet has been developed.
Is attracting attention. EC is a system for buying and selling goods and services online using the Internet.
The services that have been used in store sales and mail order sales can be provided online on the Internet. By using this EC, end customers such as general consumers can purchase contents such as software, images, and music data and articles on the Internet without going to an actual store. By establishing a virtual shop (tenant) on the Internet, service providers can start business without actually opening a store. 2) Efficient marketing by searching catalogs on the Internet. Can do, and so on.

[0003]

[0005] Payment for purchases at ECs usually uses a credit card or a debit card, and the user only needs to input a card number and a name. However, in EC, since the actual purchaser's face cannot be seen and no signature is required, there is a risk that the identity cannot be confirmed. For example, in spite of the fact that the person himself / herself has purchased it, a false offer of "not purchasing" or "used by another person" may be made at the stage of withdrawal and payment of the purchase price .
Under such circumstances, there is a problem that sound sales services on the Internet are hindered.

[0004] The present invention has been made in view of such circumstances, and enables the reliability of a user who has accessed a sales site on the Internet to be efficiently determined by a relatively simple mechanism. An object of the present invention is to provide a personal authentication system and a personal authentication method capable of improving security in commercial transactions.

[0005]

SUMMARY OF THE INVENTION In order to solve the above-mentioned problems, the present invention relates to a personal authentication system applied to electronic commerce for selling services or goods on the Internet. Detecting means for detecting information on the user's terminal in response to access from a user who wants to purchase the service or goods being provided, and associating at least the personal information and the information on the terminal for each user. A personal information database for storing and storing the information, and the user can be authenticated by comparing the input information from the user and the information on the terminal detected by the detection means with the personal information database. It is characterized by.

In this personal authentication system, when a user accesses a homepage for selling services or goods, for example, a remote host name or remote IP
Is automatically detected and compared with the personal information database. In the personal information database, the personal information and the information on the user's terminal are stored in association with each user in advance, so that the user who actually accessed the server from the information on the terminal, It is possible to easily perform an authentication process such as determining the reliability of a user.

The personal information database detects information on the terminal of the user when the user accesses a server of a prize site or a free service site, for example, and inputs the information on the detected terminal and the input from the user. It can be created by associating the given personal information.

In addition, by leaving a personal information database including information on a user terminal such as a remote host name and a remote IP as an access history of the user,
It can be used as evidence of access.

[0009]

Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 shows a configuration of a personal authentication system for electronic commerce according to an embodiment of the present invention.

This personal authentication system is an electronic commerce (E) for buying and selling services and goods on the Internet 10.
C). As shown in the figure, the Internet 10 includes a tenant server 11 and an online service provider (Internet service provider) for connecting a purchaser 16 who wants to purchase a service or a product from the tenant server 11 to the Internet 10.
Provider: ISP) 12, an online service provider 13 that operates an authentication system 13, a certification authority 14,
An online service provider 15 that operates a prize homepage and the like is connected.

The tenant server 11 is connected to the Internet 1
0 is a web server of a virtual shop (tenant) that sells contents such as software, images, and music data and various articles. This tenant server 11
Is the W operated by the tenant server 11 creator.
In the case where it is realized by an EB server, and in the case where the tenant server 11 is realized on a recording area of an Internet service provider (ISP) with which the tenant server 11 is registered as a member (the Internet service provider provides WEB Outsourcing hosting).

Online Service Provider 13
Is for providing services such as authentication and settlement to the tenant server 11 online, and is usually realized by a server different from the tenant server 11. Note that the online service provider 13 itself may have a function as an Internet service provider (ISP).

The services provided by the online service provider 13 to the tenant server 11 include management of credit card authentication, personal authentication, resale of contents and goods, settlement, customer personal information, purchase contents, service use limitation, and the like. Yes, these processes are executed by the online service provider 13 on behalf of the tenant server 11.

Online service provider 13
Is communicably connected to a certification institution 14 such as cyber cash operated and managed by a third party. The online service provider 13 connects to the certification institution 14 for processing such as credit card authentication and settlement. ,
This is done by inquiring. Personal authentication by the online service provider 13 is performed using the personal information database 151. The personal information database 151 may be constructed and managed by the online service provider 13, but as shown in FIG.
It may be provided on the provider 15.

The purchaser 16 is a user who uses various services provided on the Internet 10, and accesses the tenant server 11 through a WWW browser executed on a terminal such as a personal computer, thereby obtaining the tenant server 11. 11 allows the user to perform a procedure for purchasing the contents or goods for which the sales service is provided online.

Here, the principle of the personal authentication system will be described.

The present system uses a credit card number (debit card number) entered by a purchaser 16 who has accessed a homepage for selling services and products provided by the tenant server 11 at the time of purchase.
Terminal information (such as "remote IP address", "remote host name", and "browser type") automatically detected from the terminal of the purchaser 16 together with information such as the card name and address are included in the personal authentication database 151. This is a system that creates a database and, if it is already registered, performs identity verification by collating it with the personal authentication database 151. This personal authentication database 1
51 can be used as proof of access when a false declaration is made, and can also be used to prevent fraud by creating a fraudulent user list (black list). Conventionally, systems for identity verification are mostly based on, for example, collation of inputted card information with the address of the card user, and in many cases, if there is an input mistake, etc., accurate determination cannot be performed. This hindered the smooth purchase of products.

In this system, a database is constructed based on terminal information such as "remote IP address" and "remote host name", and when accessed by a user, personal information is obtained based on automatically detected terminal information. By inquiring the information database 151, the user can perform personal authentication using physical information other than his / her own input information, whereby more reliable personal identification can be automatically performed. . Also, by leaving the personal information database 151 as a user's access history, it can be used as evidence of access in the case of false declaration. Further, since the detected "remote IP address" and "remote host name" are accompanied by information such as the country of the user's access source and the access time, the supplementary information can be used for marketing.

This system comprises an authentication system built on an authentication server of the online service provider 13 and a personal information database 151. When the purchaser 16 purchases a service or product sold on the tenant server 11 with a credit card, a debit card, or the like, the purchaser 16 makes a financial request such as a card number, a card expiration date, and a card name. In addition to related information, enter personal information such as name, address, phone number,
The authentication of the validity is received by the authentication server of the online service provider 13. At this time, the authentication server of the online service provider 13 transmits the “remote IP address” or “remote host” from the terminal of the purchaser 16. Automatically obtains terminal information such as "remote IP address" and "remote host name".
The personal information database 151 is constructed and collation with the personal information database 151 is performed based on the information.

FIG. 2 shows an example of the personal information database 151.
Shown in As described above, personal information such as a card number, a name, an address, and a telephone number, as well as terminal information such as a “remote IP address” and a “remote host name” are associated with the personal information database 151 for each user. Managed. Usually, the “remote IP address” and “remote host name” are assigned from the server of the online service provider 12 each time the purchaser 16 makes a dial-up Internet connection. Therefore, as shown in FIG. 2, a plurality of pieces of personal information are registered for one “remote IP address” and “remote host name”. In this case, the network address in the high-order bit part of the “remote IP address” is the address of the online service provider used for the Internet connection. The “remote host name” is the host name of the online service provider used for Internet connection. Therefore, "remote IP address",
Detecting the “remote host name” also means detecting the access site used by the user to access the tenant server 11 or the like.

Further, the personal information database 151 includes:
A history field is provided to indicate whether or not a person has committed fraud in the past, such as illegally using another person's card or making a false declaration that another person has used it while accessing it. When the fact is confirmed, an “X” mark is registered in the corresponding history field by the administrator or the like.

The constructed personal information database 151
Can be used as a security system before and after the authentication operation, by using identity verification when fraud occurs and using the history of fraud as a so-called blacklist. In addition, it is possible to receive an inquiry from an online service provider performing the same authentication work. In addition, by referring to the personal information database before actually performing the authentication work using the credit card number, unnecessary card authentication for unauthorized users can be prevented, and as a result, authentication fee It also leads to a reduction in emissions. Since the detected “remote IP address” and “remote host name” have additional information corresponding to the user's access source country, access time, etc., as described above, use them for marketing. Can also.

The personal information database 151 only needs to be connected online with the authentication server of the online service provider 13, and may be located at a different location from the authentication server as described above. In FIG.
A personal information database 151 on another online service provider 15 that operates a prize homepage or the like.
Is illustrated. In this case, the online service provider 15 performs a service such as a sweepstakes homepage or a free service page that makes the user actively want to input personal information. The personal information entered,
At the same time, the personal information database 151 is constructed by storing the automatically detected terminal information in association with it. In this case, the personal information input by the user is information such as a name, an address, a telephone number, and a birthday, and information such as a credit card number is often not input. Therefore, the personal information database 15 is provided by the online service provider 15 which operates a prize homepage or the like.
In the case of constructing No. 1, personal information such as a name, an address, a telephone number, and a birthday is associated with a "remote IP address" and a "remote host name" for each user, and information such as a credit card number is provided. Is not registered.

The authentication server of the online service provider 13 connects to the online service provider 15 via the Internet 10 and makes an inquiry to the personal information database 151 every time the authentication process is performed. For unregistered users, the user's personal information (including credit card number), "remote IP address",
The “remote host name” is additionally registered in the personal information database 151. In the unlikely event that there is a history of fraud, the purchase of the product can be stopped in advance.

Next, the flow of a series of processing will be described with reference to FIGS.

(1) When the purchaser 16 accesses a prize homepage or the like operated by the online service provider 15, the online service provider 15 presents a personal information input screen as shown in FIG. It is displayed on the screen by the purchaser's 16 browser. The purchase applicant 16 displays personal information (B1: personal name, B2: personal address, B3: personal birth date, B4: personal telephone number or e-mail address) on the personal information input screen.
Is input, the personal information (B1 to B4) is sent to the online service provider 15 and registered in the personal information database 151. At this time, the online service provider 15 refers to the environment variable of the terminal for the information of the terminal of the purchaser 16 (C1: remote IP address, C2: remote host name, C3: browser type, C4: access source). Automatically detect
The personal information is registered in the personal information database 151 in association with the input personal information. The information of the automatically detected terminal is used not only for inquiries of unauthorized users, but also for the purchaser 16 who uses the homepage from any region and under any environment, and is hyperlinked from what homepage. It can also be used for future marketing, such as whether you came.

(2) Purchaser 16 is Tenant Server 1
When the user accesses the service 1 and selects a service or a product to be purchased, the online service provider 13 automatically displays a personal information input screen and a card information input screen as shown in FIG. It is displayed on the screen by the purchaser's 16 browser. The purchase applicant 16 can use card information such as a credit card or a debit card (A1: credit card number, A2: credit card expiration date, A3: credit card name),
By inputting personal information (B1 to B4), an attempt is made to authenticate the card information. At this time, the information (C1 to C4) of the terminal of the purchaser is automatically detected by the authentication server of the online service provider 13.

(3) The personal information input to the authentication server of the online service provider 13 and the information of the terminal of the purchaser are transmitted online through the Internet 10.
Service Provider 15 Personal Information Database 151
Then, the reliability of the purchaser based on the relationship between the personal information and the information of the terminal is determined, the user is confirmed from the history whether the user is an unauthorized user, or a process of adding to the database is performed.

(4) If the personal information queried based on the information of the terminal of the purchase applicant 16 has no history of unauthorized use, card authentication is performed online through the authentication organization 14. If there is a history of unauthorized use before, the card authentication is not executed, and the process ends here. In addition, the relationship between personal information and terminal information is stored in the personal information database 151.
When the reliability of the purchaser is low, such as in the case of inconsistency with the contents of the above, the user who actually accessed the server can be determined from the terminal information. In this case, the processing is terminated without executing the card authentication, or the purchase applicant 1
Processing such as re-entering the personal information in 6 may be performed.

The online service provider 1
The authentication server of No. 3 may periodically read the contents of the personal information database 151 from the online service provider 15 and may not be connected to the online service provider 15 during actual authentication. Thereby, the authentication process can be performed more efficiently. When the personal information database 151 is managed on the authentication server side of the online service provider 13, credit card information can be managed together with personal information and terminal information. Can be.

Since all of the above procedures can be realized by software, if a computer program including the procedures is recorded in a recording medium,
The same effect as in the present embodiment can be obtained only by introducing the computer program into the computer through the recording medium.

[0032]

As described above, according to the present invention,
By automatically detecting terminal information when accessed by users, the reliability of users who have accessed a sales site on the Internet can be efficiently determined with a relatively simple mechanism, and e-commerce Security can be improved.

[Brief description of the drawings]

FIG. 1 is a block diagram illustrating a configuration of a personal authentication system according to an embodiment of the present invention.

FIG. 2 is an exemplary view showing an example of a personal information database used in the system of the embodiment.

FIG. 3 is an exemplary view for explaining the flow of processing in the embodiment.

FIG. 4 is an exemplary view showing an example of a screen displayed on a user terminal in the system of the embodiment.

[Explanation of symbols]

10 ... Internet, 11 ... Tenant server, 12 ...
Online service provider for Internet connection, 13 Online service provider constituting authentication system, 14 Authority, 15 Online service provider operating a prize homepage, etc. 151 Personal information database .

 ────────────────────────────────────────────────── ─── Continuation of the front page (72) Gen Saito 14-5, Kodenmacho, Nihonbashi, Chuo-ku, Tokyo Big Bang Technology Co., Ltd. F-term (reference) 5B049 AA05 BB11 CC03 CC08 CC39 EE22 EE23 FF07 GG02 GG04 GG07 5B085 AE02 AE04 AE23

Claims (9)

[Claims] 1. An individual authentication system applied to electronic commerce for selling services or goods on the Internet, wherein an access from a user who wants to purchase a service or goods sold on the Internet is provided. In response, detection means for detecting information about the terminal of the user, a personal information database that holds at least the personal information and information about the terminal in association with each user, and input information from the user and A personal authentication system, wherein the user can be authenticated by comparing the personal information database with information on the terminal detected by the detection means. 2. The method according to claim 1, wherein the detecting unit obtains, from the terminal of the user, a remote host name or a remote IP address used by the terminal of the user to connect to the Internet, and obtains the remote host name or the remote IP address. 2. The personal authentication system according to claim 1, wherein the information is detected as information related to the personal authentication. 3. A detecting means for detecting information relating to a terminal of the user when a predetermined server established on the Internet is accessed by the user; personal information input from the user; Means for creating a personal information database for authentication, using the information on the terminal detected by the means and holding the personal information and the information on the terminal for each user in association with each other. Personal authentication system. 4. An individual authentication system applied to electronic commerce for selling services or goods on the Internet, wherein the personal authentication system is used for access from a user who wants to purchase services or goods sold on the Internet. Responding, detecting means for detecting information relating to the terminal of the user, associating personal information input from the user with information relating to the terminal detected by the detecting means, and using the information as an access history of the user. A personal authentication system, comprising: a storage unit. 5. An individual authentication method applied to electronic commerce for selling services or goods on the Internet, wherein the personal authentication method is used for access from a user who wants to purchase a service or goods sold on the Internet. In response, detecting information on the user's terminal, using input information from the user and information on the terminal detected by the detecting means, for each user, at least the personal information and information on the terminal A personal information database in which the user can be authenticated by collating with a personal information database that holds the user in association with the user. 6. A remote host name or a remote IP address used by the user terminal to connect to the Internet is obtained from the user terminal, and detected as information on the user terminal. 6. The personal authentication method according to claim 5, wherein: 7. When a predetermined server established on the Internet is accessed by a user, detection for detecting information related to the terminal of the user is performed, and personal information input from the user is detected. A personal authentication method for creating a personal information database for authentication, which stores personal information and information about a terminal for each user in association with each other using information about the terminal detected by the personal computer. 8. A personal authentication method applied to electronic commerce for selling services or goods on the Internet, wherein the personal authentication method is used for access from a user who wants to purchase a service or goods sold on the Internet. Responding, detecting and detecting information relating to the terminal of the user, associating the personal information input from the user with the information relating to the detected terminal, and storing it as an access history of the user. Characterized personal authentication system. 9. A recording medium on which a computer program for personal authentication applied to electronic commerce for selling services or goods on the Internet is recorded, wherein the computer program is sold on the Internet. A procedure for detecting information on the terminal of the user in response to an access from a user who desires to purchase a service or an article, and information on the terminal input by the user and information on the terminal detected by the detection unit. A procedure for performing a collation with a personal information database that holds at least personal information and information about a terminal in association with each other by using each user.