JP2001306517A - Authentication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To construct a high security authentication system. SOLUTION: When a password number, shopping amount or store number is inputted for authenticating a user, a radio terminal 100 accesses an identity authentication station 260 while using an ID number (telephone number) or the like applied to the radio terminal. Between the radio terminal 100 and the identity authentication station 260, processing for authentication is performed, while using a personal feature (facial image, for example), for specifying a person. When the identity authentication is completed between the radio terminal 100 and the identity authentication station 260, transfer processing for a charge price from the account of the user to a store side account is requested from the identity authentication station 260 to a bank system 284 of the user. The bank system 284 performs transfer processing, and when it is finished, the transfer end is reported to the identity authentication station. The identity authentication station reports the safe end of transfer processing to the radio terminal and this is reported to a POS terminal 232 by a bar code. Thus, transfer processing is completed.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a system for guaranteeing an identity, and more particularly to an authentication system for a business transaction system using communication.

[0002]

BACKGROUND OF THE INVENTION As electronic commerce using communications has become popular, security systems have become increasingly important. In general, communication security is performed by encrypting information. As the encryption method, various methods such as a scrambler method, a secret key encryption method, a public key encryption method, and a digital signature are used, but it is not necessarily safe. For example, in the case of a credit card, fraud is performed by various means such as leaking a number, being stolen during communication, and being falsified.
For this reason, it is difficult to conduct a commercial transaction safely using communication. However, commerce transactions by communication tend to increase, and a system for ensuring reliable security is required.

[0003]

SUMMARY OF THE INVENTION It is an object of the present invention to provide a system which can authenticate a user and thereby increase security in, for example, business transactions.

[0004]

In order to achieve the above object, the present invention provides an authentication system comprising a terminal system connected by a communication line and an identification system, wherein the terminal system comprises user information. User information acquisition means for acquiring the identification data, identification data storage means for storing the encrypted identification data, identification data acquisition means for acquiring the identification data, and decryption for restoring the stored encrypted identification data Encoding means, identification data decrypted by the decrypting means, coincidence detecting means for detecting coincidence of the identification data from the identification data obtaining means, and a communication means for communicating with the identity recognition system The identification system comprises at least a database storing data for performing identification, and communication means for communicating with the terminal system. The terminal system transmits the obtained user information to the identification system, and the identification system searches the database according to the transmitted user information and decrypts the encrypted identification data. The terminal system retrieves the certification number to be transmitted to the terminal system, and the terminal system decrypts the identification data encrypted with the certification number received from the identity certification system, and matches the acquired identification data with the identification data. Is detected, and when they match, it is determined that the user is authenticated. By using the authentication system having such a configuration, the security of the system can be enhanced.

[0005] The terminal system includes a user information obtaining means for obtaining user information, an identification data storage means for storing encrypted identification data, an identification data obtaining means for obtaining identification data, and a stored encryption data. Decoding means for restoring the encoded identification data, match detection means for detecting a match between the identification data decoded by the decoding means and the identification data from the identification data obtaining means, and the identity recognition system. And communication means for communicating with, transmitting the acquired user information to the identity recognition system,
Using the certification number received from the identity certification system,
The encrypted identification data is decrypted, a match with the obtained identification data is detected, and when the match is found, it is determined that the authentication has been made. Communication means for performing communication with the identification system may use wireless communication.

The terminal system includes an IC card reading means for reading user information and encrypted identification data from an IC card, an identification data obtaining means for obtaining identification data, and a recovery of the read and encrypted identification data. A decryption unit, a match detection unit that detects a match between the identification data decrypted by the decryption unit and the identification data from the identification data acquisition unit, and a communication unit that performs communication with the identity recognition system. Transmitting the read user information to the identification system, decrypting the encrypted identification data using the identification number received from the identification system, and matching with the obtained identification data. Is detected, and when they match, it is determined that the user is authenticated.

[0007] The identification data is a face image, and the coincidence detecting means can extract a feature from the face image to detect coincidence. By performing a transfer process between accounts after the authentication, a highly secure transfer process can be performed. The present invention also includes a recording medium storing a program that allows a computer system to construct the functions of these systems.

[0008]

Embodiments of the present invention will be described in detail with reference to the drawings.

<First Embodiment> FIGS. 1 to 4 are views showing a system according to a first embodiment of the present invention. The first embodiment shown in these figures shows an example in which the authentication system of the present invention is applied to a transfer system (transfer system). By using this system, when a user makes a purchase at a store affiliated with this system, it is possible to transfer the payment from his / her own bank account to the store account. FIG. 1 shows a configuration diagram of this transfer system (transfer system).

In FIG. 1, the system includes a wireless terminal 100 owned by a user, a wireless station 200 such as a portable telephone for communicating with the wireless terminal, and a POS terminal 232 installed in a store where the user performs shopping. And POS terminal 23
2, a member store network system 230 composed of a POS host system 236 connected to the POS system 2, an identity certification authority 260 for verifying the identity of the user, and a financial institution network system 280, and a communication network connecting these. 270. The system 28 of the financial institution network
0 is, for example, the financial institution system network 282
, Etc., which are connected to each other via a bank system 284. In this system, when a user inputs a personal identification number, a shopping amount, a store number, and the like to the wireless terminal 100, the wireless terminal 100 sends an ID assigned to the wireless terminal to the identity certification authority 260 in order to authenticate the user. Access by number (telephone number), etc. A process for authentication using a personal feature (for example, a face image) for identifying a person is performed between the wireless terminal 100 and the identity recognition station 260. This authentication processing will be described later in detail. Wireless terminal 1
When the identity verification is completed between 00 and the identity certification authority 260, the identity certification authority 260 requests the user's bank system 284 to perform a transfer process for the price of shopping from the user's account to the store's account. . The banking system 284
The transfer process is performed via the financial institution system network 282, and when the transfer is completed, the completion of the transfer is notified to the identity certification authority 260. The identity certification station 260 notifies the wireless terminal and the member store network 230 that the transfer processing has been completed successfully. In this way, the money is transferred from the user's account to the store's account, and the notification is sent to both sides,
The payment processing (debit processing) by this system ends. By using this system, the identity of the terminal user is guaranteed, so that the transfer process can be performed safely.

In such a system, in order to perform authentication processing between the wireless terminal 100 and the identity certification authority 260, it is necessary to first register a user who uses the wireless terminal 100 with the server of the identity certification authority. . This identity registration process will be described with reference to the sequence diagram of FIG. A case where a face image of a user is used for authentication will be described below.
In order to acquire a face image, the wireless terminal 100 is equipped with a digital camera, and the face image of the user can be acquired in the terminal by the camera. In FIG. 2, first, when the authentication registration process is started in the wireless terminal 100, the wireless terminal 100 issues an authentication registration request to the identity certification authority 260 (S310). The identity certification authority 260 starts the authentication registration process for the terminal 100 in response to the authentication registration request from the terminal 100 (S331), and the terminal 1
00, a preparation OK message is returned (S31).
2). The terminal 100 obtains a face image using the provided digital camera, obtains personal information necessary for registration, and sends it to the identity certification authority 260 (S314).
The personal information includes, for example, name, address, telephone number, date of birth, bank account number, bank account password, and the like. When sending these face images or personal data, the data can be compressed and sent.

Since the terminal 100 is a wireless terminal in this embodiment, it also sends a terminal ID, which is a telephone number of a mobile phone or the like, to the identification authority 260 together with the face image and personal information.
The identity certification authority performs a registration process (S332). In this registration process (S332), the sent face image and personal information are registered in an identity certification database in the identity certification authority 260, and the bank system is accessed to send the registered bank account. Also check the registrant's name and password. When these processes are performed normally, the identity certification authority 260 generates a personal identification number and a unique certification number for authenticating the individual.
The certification number is a number that is not revealed to the user, and the password is a number that the user memorizes and uses when performing the identity certification. When such registration processing is completed, the identity certification authority 260 sends the personal identification number and the face image encrypted with the certification number and the personal identification number to the terminal 100 (S316). At this time, compression processing may be performed, and the data may be transmitted as being compressed. The terminal 100 displays the received personal identification number and stores the encrypted face image in the recording device in the terminal 100 (S32).
4). When this processing is completed, the terminal 100 notifies the identity certification authority 260 that the processing has been normally completed (S31).
8), end the registration process. Upon receiving the normal end notification, the identity certification authority 260 ends the registration processing for the terminal 100 (S336).

[0013] At the time of the registration process, the identity certification authority 260 can also transmit to the terminal 100 information on the member stores that can use the transfer system.
After the registration, the operator can confirm whether the registered information is correct, for example, by calling the input telephone number or the like by the operator. In the above description, the password is generated by the system. However, the password may be changed by the user later, or may be specified by the user during the registration process. Furthermore, the registered information can be discarded unless the registration information is updated within the validity period by defining the validity period.

[0014] In this way, the data for the identification is stored in the identification authority 260 and the terminal 100. The authentication processing in the above-described transfer processing performed using these data will be described in detail with reference to the authentication sequence diagram shown in FIG. In FIG. 3, when a user who has completed shopping at a member store uses the wireless terminal 100 to complete payment by transfer from his / her account, first, the user terminal 100 starts a transfer process, and A number is input (S342). The terminal 100
The entered password and your own terminal number (terminal ID:
An authentication request is transmitted to the identity certification authority 260 using the (phone number) (S352). Upon receiving the authentication request, the identity certification authority 260 starts the authentication process, and searches the database in the identity certification authority 260 for an authorization number based on the transmitted personal identification number and terminal number (S362). The searched certification number is sent to the terminal 100 (S354).

After inputting the personal identification number, the terminal 100 inputs the user's face image using the installed digital camera (S344). Then, the terminal 10 is identified by the certification number sent from the identity certification authority and the entered password.
The face image is restored from the encrypted face image file stored in the recording device 0 (S345), and the matching process between the face image captured by the camera and the restored face image is performed (S346). This matching process is performed, for example, by detecting a feature of each face image and checking whether the features match.
When a match is detected, it is known that the user is indeed a registered user, so in order to perform the transfer process next,
Sends an authentication OK message to the identity certification authority 260 (S3
56). As a result, the identity is recognized by the identity certification authority 260 (S364).

[0016] As a result of the transfer, it becomes possible to pay for the shopping, so that the amount and the store code of the member store are input (S347), and a transfer request is made to the identity certification authority 260 (S357). . The identity certification authority 260 specifies the transfer destination account (bank, account number) from the store code, and requests a transfer process to the bank where the user's account is located (S366). When the bank notifies the end of the transfer process from the user's account to the store's account (S368), it notifies the user's terminal 100 that the transfer has been completed (S358). When the transfer is completed, the terminal 100 displays a barcode representing management information, payment price, and the like (S34).
8) Therefore, by reading the bar code reader 234 attached to the POS terminal 232 of the store,
Payment is complete. This completes the transfer processing using the terminal 100. The POS terminal 232 may read a barcode printed by the user terminal 100.

The wireless terminal 1 used in these processes
FIG. 4 shows an example of the configuration of 00. In FIG. 4, the lid 110
Inside, an antenna for wireless communication is built in. Further, a liquid crystal display (LCD) 120, a numeric keypad 130 for inputting numbers, function keys 102 to 109 for selecting functions, and the like are provided. Numeric keypad 130
Can input not only numbers, but also hiragana, English characters, etc., and can input kanji characters by kana-kanji conversion. Further, a CCD camera (digital camera) 140 for inputting a face image is also provided. An image captured by the CCD camera can be displayed on the liquid crystal display device 120. The liquid crystal display device 120 can also recognize the written character by writing with a pen or the like.
For the transfer process, a transfer key 102 for starting the transfer process, a registration key 105 for registering a face image, and a store code key 1 for selecting a store code are used as function keys.
03, amount key 104 for inputting the amount of payment, correction key 1
06, a function key 107, a cancel key 108, an OK key, and the like. In this terminal, a recording device capable of storing a face image and a wireless system such as a mobile phone are incorporated. This terminal can be used as a mobile phone or the like by using the earphone 142 or the microphone 144. Note that an earphone with a built-in microphone may be used for both transmission and reception. Further, a printing machine may be provided so that a barcode or the like can be printed.

The terminal 100 can be used by a plurality of users. Each user performs a registration process individually, and each user can be distinguished by a password for each user. In the above-described system, the certification number and the password are used as keys for encrypting the face image. However, only the certification number may be used. By using the face image registered in advance using the terminal 100 and the identity certification authority 260 described above, it is ensured that the user is the user himself / herself.
High security can be maintained. For this reason, even if transfer processing etc. are performed, a transaction can be performed safely. Moreover, in the present system, it is not necessary to communicate face image data having a large data amount in the authentication process.
A low communication speed can be used for the communication between 00 and the identity certification authority 260.

<Second Embodiment> An authentication system similar to the above-described system is replaced with an IC capable of storing data.
It can also be built using cards. An example of a system using an IC card will be described with reference to FIGS.

FIG. 5 is a diagram showing an example of the configuration of a transfer system for performing authentication using an IC card and paying, for example, a purchase price by transferring it from its own account. The system includes a card issuing machine 510 and a POS terminal 2 in each store.
And a POS host 246 to which the POS terminal 242 is connected.
40, an identity certification authority 260 that performs identity authentication, a financial institution network system 280 that performs settlement processing such as transfer between financial institutions,
It is constituted by a communication network 270 connecting the respective systems. The card 520 for performing authentication is issued by the card issuing machine 510. Each POS terminal 242 has
An IC card issued by the card issuing machine 510 can be read. Card 5 issued by the card issuing machine 510
The IC 522 stores an encrypted face image of the user who uses the card. When you go shopping and pay the price, you can use this card at the POS terminal 24
2 and the POS terminal 242 captures the user's face image by photographing the user's face with a digital camera, and uses this to perform an authentication process with the identity certification authority 260 via the POS host 246. I do. When the identity is assured by the authentication, the identity certification authority 260 requests the bank system 284 having the user's account from the user's account to the store's account via the financial institution network system 280 to perform a transfer process of the price. . When the transfer process is completed, a termination notification is transmitted from the bank system 284 to the identity certification authority 260 via the financial system network 282. Upon receiving the end notification, the identity certification station 260 notifies the POS terminal 242 of the transfer end via the POS host 246. As a result, the purchase price is transferred from the user's account to the account of the shop where the purchase was made and paid.

The card issuing process performed by the card issuing machine 510 will be described in detail with reference to the card issuing sequence shown in FIG. In FIG. 6, when issuing a card,
The user starts the card issuing process in the card issuing machine 510 by, for example, pressing a specific button. When the card issuing machine 510 starts the issuance process, the identity certification authority 260
The authentication registration request message is sent to (S412). The identity certification authority 260 starts registration processing for the card issuing machine 510 (S432). When the preparation is completed, a message for starting the processing is transmitted to the card issuing machine (S413).

The card issuing machine 510 captures a user's face image using a digital camera provided therein, and also has personal data (eg, name, address, date of birth, account information, etc.) provided by the card issuing machine 510. It is acquired from a keyboard or the like (S422). The acquired face image data and personal data are transmitted to the identity certification authority 260 (S414). The certification authority 260 performs registration processing based on the face image data and the personal data that have received the registration processing. In the registration process (S434), the received data is stored in the database, and the bank having the user's account is accessed via the financial institution network system 280 to check whether the user's account exists. After these processes, a unique certification number and a card number for identifying the card are generated. After the registration process, the image data is encrypted using the generated certification number as a key (S436). Then, the encrypted image data and the card number are transmitted to the card issuing machine 510 using the certification number as a key (S416). The card issuing machine 510 creates the card 520 with the received card number and writes the encrypted image data into the IC 522 in the card using the certification number as a key (S424).
When these card issuing processes are completed, the card issuing machine 5
10 notifies the identity certification authority 260 of the processing completion message (S418), and ends the processing for issuing the card.

In the above description, the user operates the card issuing machine. However, the operator may operate the card issuing machine based on the card issuance application submitted by the user. In addition, confirmation of an account from a bank may be performed on documents instead of online. In the above-described example, the description has been given assuming that the face image is encrypted by the identity certification authority 260. However, the encryption processing may be performed by the card issuing machine 510. In this case, if the face image is not stored in the database of the identity certification authority 260,
It is not necessary to transmit a face image to.

Now, regarding the process of performing authentication using the IC card thus issued and paying the purchase price by transfer, the communication between the POS terminal 242 shown in FIG. Will be described with reference to the sequence diagram of FIG. Referring to FIG. 7, in a store where a card can be used, when the purchase price is transferred using a card by using a transfer process (debit process), first, a POS terminal 24 is used.
2. The card number and the encrypted image are read by the attached card reader (S442). POS terminal 242
Sends the read card number to the identity certification authority 260 via the host 246 (S452). As a result, the identity certification authority 260 starts the process for authentication, and searches the database for the certification number from the sent card number (S462). The identity certification authority 260 sends the certification number obtained as a result of the search to the POS terminal 242 via the host 246.
(S453).

The POS terminal 242 acquires a face image from a digital camera provided in the POS terminal 242 (S443), and uses the certification number sent from the identity certification authority 260 to read the face image from the card. The image data is decoded (S444). The two face image data are matched (S445), and if they match, the next process, ie, the transfer process, is performed (S446). The transfer process (S446) is performed by the POS terminal 242 to the host 246.
, Information for performing the debit transfer (amount, information for specifying a store (store number), etc.) is sent to the identity certification authority 260 (S
464). The identity certification authority 260 specifies the transfer destination account (bank, account number) from the store code, and requests a transfer process to the bank where the user's account is located (S466). When the bank notifies the end of the transfer process from the user's account to the store's account (S468), the bank notifies the POS terminal 242 via the host 246 that the transfer has been completed (S456). This allows the payment to be made by fund transfer.

As described above, by using the IC card storing the encrypted face image, the payment by the account transfer process can be safely performed. Although an example in which a personal identification number is not used for card use is described above, a personal identification number may be used in combination when performing authentication. At this time, both the certification number and the password may be used as a key for encrypting the image.

In the above-described system, a face image is used to identify the identity, but a similar process can be performed using other data that can be individually identified. Examples of data that can be individually identified include fingerprint data, voiceprint data, and iris data. Although a digital camera was used to acquire face image data as described above, in order to acquire data such as fingerprints, voiceprints, and irises, it is necessary to use a device for acquiring each data (such as a fingerprint scanner). There is. Encrypting and storing these data is the same as the above-described face image. Also, in the above description, the payment by transfer has been described as an example, but the authentication system of the present invention can be used for other application systems.

The functions of the present invention can be realized by reading and executing the program from a storage medium storing the program according to the present invention by the system. This recording medium includes a floppy (registered trademark) disk,
There are a CD-ROM, a magnetic tape, a ROM cassette and the like.

[0029]

The security of the system can be enhanced by using the authentication system of the present invention. For example, by applying the present invention to a system such as an account transfer, it is possible to increase the security of transactions.

[Brief description of the drawings]

FIG. 1 is a diagram showing a configuration of a system using a wireless terminal.

FIG. 2 is a sequence diagram illustrating a sequence of a registration process.

FIG. 3 is a sequence diagram showing a sequence for performing authentication.

FIG. 4 is a diagram illustrating an example of a configuration of a wireless terminal.

FIG. 5 is a diagram showing a configuration of a system using an IC card.

FIG. 6 is a sequence diagram showing a sequence for issuing a card.

FIG. 7 is a sequence diagram showing a sequence for performing authentication.

[Description of Signs] 100 Wireless terminal 102 to 109 Function key 102 Transfer key 105 Registration key 120 Liquid crystal display device 130 Numeric keypad 142 Earphone 144 Microphone 200 Wireless station 230,240 Member store network 232,242 POS terminal 236,246 POS host System 260 Identity Authority 270 Communication Network 280 Financial Institution Network 282 Financial Institution System Network 284 Banking System 510 Card Issuer 520 IC Card

Continued on the front page (51) Int.Cl. ⁷ Identification code FI Theme coat II (Reference) H04L 9/32 H04L 9/00 673A 673D 673E F term (Reference) 3E044 CA06 DA05 5B049 BB11 CC00 EE05 EE08 EE23 GG03 GG06 GG10 5B055 CB09 EE03 EE13 EE17 HA12 HB04 KK05 5B085 AA08 AE02 AE29 5J104 AA07 KA01 KA16 NA35 NA38 PA10

Claims (7)

[Claims] 1. An authentication system comprising: a terminal system connected by a communication line; and an identity authentication system, wherein the terminal system obtains user information and obtains user information; Identification data storage means for storing, identification data acquisition means for acquiring identification data, decryption means for restoring the stored and encrypted identification data, and identification data decrypted by the decryption means. A match detecting unit that detects a match with the identification data from the identification data obtaining unit; and a communication unit that communicates with the identification system. The identification system includes at least data for performing identification. And a communication unit for communicating with the terminal system, wherein the terminal system is configured to receive the acquired user information. It was sent to the identity certification system, the identity certification system, the user information sent,
The database is searched, a certification number for decrypting the encrypted identification data is extracted and transmitted to the terminal system, and the terminal system encrypts with the certification number received from the identity certification system. Decrypts the obtained identification data, detects a match with the obtained identification data, and when there is a match,
An authentication system characterized by being authenticated. 2. A terminal system in an authentication system comprising a terminal system connected by a communication line and an identification system, wherein said terminal system comprises: user information acquisition means for acquiring user information; Identification data storage means for storing identification data; identification data acquisition means for acquiring identification data; decryption means for restoring the stored encrypted identification data; and decryption means for decrypting the identification data. Identification data, matching detection means for detecting a match between the identification data from the identification data acquisition means, and communication means for communicating with the identity authentication system, the acquired user information in the identity authentication system Using the certification number received from the identity certification system,
A terminal system, wherein the encrypted identification data is decrypted, a match with the obtained identification data is detected, and when the match is found, the terminal system is determined to be authenticated. 3. The authentication system or the terminal according to claim 1, wherein the communication means for communicating with the identification system uses wireless communication. system. 4. A terminal system in an authentication system comprising a terminal system connected by a communication line and an identity authentication system, wherein the terminal system reads user information and encrypted identification data from an IC card. Card reading means, identification data acquiring means for acquiring identification data, decryption means for restoring the read and encrypted identification data, identification data decrypted by the decryption means, and identification data acquisition A match detecting means for detecting a match with the identification data from the means, and a communication means for communicating with the identity recognition system, transmitting the read user information to the identity recognition system, Using the certification number received from
A terminal system, wherein the encrypted identification data is decrypted, a match with the obtained identification data is detected, and when the match is found, the terminal system is determined to be authenticated. 5. The authentication system according to claim 1, wherein the identification data is a face image, and the coincidence detecting unit extracts a feature from the face image. An authentication system or a terminal system for detecting a match. 6. The authentication system according to any one of claims 1, 3 and 5, or the terminal system according to any one of claims 2 to 5, wherein a transfer process between accounts is performed after being authenticated. Authentication system or terminal system. 7. A recording medium storing a program that allows a computer system to build the functions of the authentication system according to claim 1, or the terminal system according to claim 2.