JP2001344546A - Method for preventing unauthorized use of portable information terminal and recording medium - Google Patents

Abstract

PROBLEM TO BE SOLVED: To prevent the unauthorized use of a portable information terminal by making it possible to specify whether the user of the portable information terminal is the legal user. SOLUTION: When an Internet service provider terminal 20 performs an information providing service in response to a request from a user, a security service provider terminal 30 refers to user information and a password about the user from a subscriber database 31, and allows the information providing service only when the user is confirmed to be the normal user. When the information providing service requires settlement, an associated bank terminal 40 refers to information showing the bank account balance of the user from an account information database 41 and gives the information to the terminal 30.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a portable information terminal such as a portable telephone or a notebook personal computer, which determines whether or not the user is a legitimate user to prevent unauthorized use or settle payments such as online shopping. The present invention relates to a method for preventing unauthorized use of a portable information terminal and a recording medium.

[0002]

2. Description of the Related Art In recent years, portable information terminals such as portable telephones and notebook personal computers have become widespread. These not only do not specify the place where they are used, but also make it possible to use the Internet easily, for example. Furthermore, settlement of online shopping using the Internet is also easily performed.

[0003]

By the way, with the spread of portable information terminals such as the above-mentioned portable telephones and notebook personal computers, the occurrence of loss or theft has increased. These portable information terminals such as mobile phones and notebook personal computers can be prevented from being used by a third party by performing a key lock operation using, for example, a password.

However, from the point of view of usability, there are few cases where a key lock operation is performed using a password or the like, and even if the key lock operation is performed, unauthorized use may occur due to decoding of the password or the like. In this way, if the user is illegally used, it is predicted that, for example, payment for online shopping is also performed by a third party, and a legitimate user may be damaged.

[0005] For this reason, there is a demand for the development of a system capable of reliably preventing unauthorized use of a portable information terminal such as a mobile phone or a notebook personal computer.

The present invention has been made in view of such a situation, and it is possible to prevent unauthorized use by specifying whether a user of a portable information terminal is a legitimate user. An object of the present invention is to provide a method for preventing unauthorized use of a portable information terminal and a recording medium.

[0007]

According to a first aspect of the present invention, there is provided a method for preventing unauthorized use of a portable information terminal, comprising: a first step in which a user receives an information providing service using the portable information terminal; A second step of providing an information providing service in response to a request from the portable information terminal, and a request from the Internet service provider side terminal, the security service provider side terminal obtains user information and a password relating to the user from the subscriber database. Referrals, and only if they are verified as legitimate users,
A third step of permitting the information service provided by the Internet service provider terminal; and, when the information service is accompanied by settlement, the partner bank terminal requests the balance of the user's bank account upon request from the security service provider terminal. And providing the security service provider terminal with reference to the account information database from the account information database. In the first step, a fifth step of transmitting user information and a password for registration in the subscriber database, and when receiving an information providing service with settlement, transmitting the user information and the password The second step includes a seventh step of receiving the user information and the password and transmitting the information to the security service provider side terminal, and a third step of receiving the user information and the password. Step 8 includes the step of immediately checking the balance of the bank account when the user is confirmed to be a legitimate user, and notifying the user via the terminal of the Internet service provider whether the debit is possible. Can be made. In the third step,
The data collating unit includes a ninth step of notifying the Internet service provider side terminal that the user is not a legitimate user when the data referred to from the subscriber database does not match, and the second step includes a legitimate user If a notification that the user is not received is received, a tenth step of denying the user access can be included. In the ninth step, the access count acquisition unit holds the number of user access denials and the user information of the user, and notifies the Internet service provider terminal when the access denial of a certain number or more occurs. An eleventh step can be included. In addition, the first step includes a twelfth step of transmitting the intention of settlement to the Internet service provider side terminal after confirming that the user is a legitimate user, and the second step includes: A thirteenth step of transmitting the intention of settlement from the security service provider side terminal is included, and the third step includes:
The account confirmation unit includes a fourteenth step of making a request to the partner bank terminal to confirm whether or not the payment from the user's bank account can be withdrawn. The fourth step includes whether the withdrawal is possible. A fifteenth step of transmitting the result of the check to the security service provider terminal may be included. In the twelfth step, when the withdrawal is possible, a final confirmation of the settlement is sent to the Internet service provider side terminal.
The thirteenth step includes a first step of notifying the security service provider terminal of a request for withdrawal.
The fourteenth step includes an eighteenth step of notifying the partner bank terminal of a request for debit,
The fifteenth step may include a nineteenth step of notifying the security service provider terminal of the completion of the debit. In the eighteenth step,
A twentieth step of notifying the Internet service provider terminal of the completion of the withdrawal is included, and the seventeenth step includes a twenty-first step of notifying the portable information terminal of the completion of the withdrawal.
Step can be included. Further, the user information can be the name, address, age, telephone number, customer management number, and bank account number of the user. Further, the user information can be a specific character string. A recording medium according to a tenth aspect is characterized by recording a program capable of executing the method for preventing unauthorized use of the portable information terminal according to any one of the first to ninth aspects. A program according to claim 11 causes a computer to execute first to fourth steps. Claim 1
The program according to 2 is executed by a computer in the first step to
The twenty-first step is performed. In the method and the recording medium for preventing unauthorized use of the portable information terminal according to the present invention, when the Internet service provider side terminal performs an information providing service in response to a request from the user, the security service provider side terminal and the user information related to the user. The password and the password are referenced from the subscriber database, and the information service is permitted only when it is confirmed that the user is a legitimate user.When the information service involves payment, the partner bank terminal checks the user's bank account Information indicating the balance is referred to the account information database and is provided to the security service provider terminal.

[0008]

Embodiments of the present invention will be described below. FIG. 1 is a diagram showing an outline of an unauthorized use prevention system according to an embodiment of a method for preventing unauthorized use of a portable information terminal according to the present invention, and FIG. 2 is a diagram showing an unauthorized use of the portable information terminal in the unauthorized use prevention system of FIG. FIGS. 3 and 4 are flowcharts for explaining a method of preventing unauthorized use of a portable information terminal in the unauthorized use prevention system of FIG. 1, and FIGS. 5 to 10 are diagrams of FIG. It is a figure for explaining the illegal use prevention method of the personal digital assistant in a use prevention system.

The system for preventing unauthorized use shown in FIG. 1 includes a portable information terminal 10, an Internet service provider side terminal 20, a security service provider side terminal 30, and a partner bank side terminal 40 which are used by general users. It is possible to communicate with each other via 50.

The portable information terminal 10 is, for example, a mobile phone,
It is a portable communication means such as a notebook personal computer or a PDA (personal information terminal). The portable information terminal 10 includes a key input receiving unit 11, a display control unit 12, a communication control unit 13, and a function stop control unit 14. The key input receiving unit 11 receives an input from a key of the portable information terminal 10.

The display controller 12 controls the display of information on the display 15. The communication control unit 13 controls communication via the Internet 50. When the access denial occurs more than a certain number of times, the function suspension control unit 14 sets the security service provider side terminal 3
The function is stopped by control from 0, the details of which will be described later.

Internet service provider terminal 20
Provides services such as online shopping. Security service provider terminal 30
Is for preventing unauthorized use of the portable information terminal 10, and includes a subscriber database 31, an information reception unit 32, an information registration unit 33, a data search unit 34, a data collation unit 35,
An access number obtaining unit 36, an access rejection notification unit 37, and an account confirmation unit 38 are provided.

In the subscriber database 31, user information and a password of the portable information terminal 10 are registered. Here, the user information includes a general user's name, address, age, telephone number, customer management number, bank account number, and the like. In addition to the above information, for example, a specific character string specified by the user can be used as the user information. Here, the specific character string may be, for example, a favorite word, a lyric, a lyrics, or a content having some meaning. In any case, it suffices that only the individual user can know.

The information receiving unit 32 receives user information, a password, and the like from the portable information terminal 10.
The information registration unit 33 registers the received user information, password, and the like in the subscriber database 31.

The data search section 34 searches for data registered in the subscriber database 31 in response to access from the portable information terminal 10. Data collation unit 3
Reference numeral 5 is for collating the data retrieved by the data retrieval unit 34. If the data collations match, it is determined that the user is a legitimate user. Access frequency acquisition unit 3
Numeral 6 is for acquiring the number of times of access from the portable information terminal 10 in accordance with the mismatch of data collation by the data collation unit 35.

The access rejection notifying unit 37 transmits a control signal for stopping the function to the portable information terminal 10 when the number of times of the data collation mismatch by the access number acquiring unit 36 is equal to or more than a certain number. At this time, in the portable information terminal 10, the communication function is stopped by the function stop control unit 14. When the function of the mobile information terminal 10 is to be stopped, a control signal for stopping the function is transmitted to the Internet service provider terminal 20 to stop the transmission of the communication carrier from the Internet service provider terminal 20. You can also do so. The account confirmation unit 38
When a request for payment is made from the mobile information terminal 10, the balance of the account of the partner bank terminal 40 is checked to confirm whether or not the payment can be made. Partner bank terminal 40
Has an account information database 41. The account information database 41 manages the balance of the user's bank account and the like.

Next, an outline of a method for preventing unauthorized use of a portable information terminal in such an unauthorized use prevention system will be described.

First, (1) in FIG. 2 shows that a user accesses an Internet site that provides a service that requires payment, such as online shopping, for example, purchases goods, and conveys the will of payment. Indicates that At the time of this access, the subscriber database 3
1. Enter the user information and password registered in 1.

Thus, since the user information is unique, there is no duplicate number, and the password is information that can be known only by the user himself / herself, it is possible to determine whether the accessing person is an authorized user. .

(2) in FIG. 2 indicates that the Internet service provider transmits the user information and the password input in (1) to the security service provider. (3) in FIG. 2 shows that the security service provider searches the pre-registered subscriber database 31 using the data received in (2), performs collation, and compares the result with the Internet service provider. To be transmitted.

(4) in FIG. 2 indicates that the Internet service provider transmits the data received in (3) to the user who accessed in (1). In other words, here, if you are a legitimate user, your registered name,
The address, age, phone number, and bank account number are displayed and can be confirmed. If the user is not a legitimate user, a message indicating that access is denied is displayed, and the payment process is stopped.

At this time, the security service provider records the information of the user whose access is denied and the number of times, and if the access is rejected a certain number of times or more,
The user information can be made unusable, and the security is enhanced. At the same time, it is possible to inform the registered name and address that the user information cannot be used by mail.

(5) in FIG. 2 indicates that the intention of settlement is transmitted to the Internet service provider again because it is confirmed that the user is a legitimate user. (6) in FIG. 2 indicates that the Internet service provider transmits the data received in (5) to the security service provider.

(7) in FIG. 2 shows that the security service provider checks with the partner bank whether it is possible to withdraw the money from the pre-registered bank account of the user authenticated in (4). Show. (8) in FIG.
Indicates that the result of checking whether the debit is possible is transmitted from the partner bank to the security service provider.

(9) in FIG. 2 indicates that the information of (8) is transmitted from the security service provider to the Internet service provider. (10) in FIG. 2 indicates that the result of (8) is transmitted from the Internet service provider to the user. In other words, if the withdrawal is possible, the process can proceed to the next step. If debiting is not possible, a message to that effect will be displayed,
The settlement process is stopped.

(11) in FIG. 2 indicates that the payment can be debited, so that the payment is finally confirmed and the intention of the user's payment is transmitted to the Internet service provider. (12) in FIG. 2 indicates that the Internet service provider transmits a debit request to the security service provider.

(13) in FIG. 2 indicates that the security service provider transmits a request for withdrawal to the partner bank. (14) in FIG. 2 indicates that the partner bank sends a completion of debit to the security service provider. (15) in FIG. 2 indicates that the security service provider sends a debit completion to the Internet service provider. (16) in FIG. 2 indicates that the Internet service provider sends a completion notification to the user.

In all the processes, if the information passing through the Internet 50 is encrypted, the security is further improved. After the process (2) in FIG. 2, the security service provider checks the balance of the partner bank account immediately after confirming that the user is a legitimate user, and confirms whether the account can be debited. Alternatively, the process may return to the process (9) in FIG. Further, when the withdrawal is completed, the process may return to the process (15) in FIG.

Next, a method of preventing unauthorized use of a portable information terminal in such an unauthorized use prevention system will be described.

First, the user of the portable information terminal 10 registers his / her information in the subscriber database 31 of the security service provider 30 in advance. The information registered in the subscriber database 31 includes the user's name, address, age, telephone number, customer management number, password, bank account number, and the like described above. Also, as mentioned above,
For example, a specific character string specified by the user can be registered.

First, as shown in FIG. 3, the user accesses an Internet site that provides a service that requires settlement such as online shopping (step 201: (1) in FIG. 2). Here, at the time of access to purchase goods and convey the intention of settlement, user information and a password registered in the subscriber database 31 in advance are input.

At this time, the contents shown in FIG. 5, for example, are displayed on the display 15 of the portable information terminal 10. Here, input of user information and a password is prompted. Here, when the user inputs the user information and the password and operates “Next”, the information is transmitted to the Internet service provider terminal 20.

When the user information and the password have been input (step 202), the Internet service provider 20 transmits the user information and the password input in (1) of FIG. 2 to the security service provider. Terminal 3
0 (step 203: (2) in FIG. 2).

The data search unit 34 of the security service provider terminal 30 receiving the user information and the password
Accordingly, when the pre-registered subscriber database 31 is searched using the data received in (2) in FIG. 2, the collation is performed by the data collation unit 35, and when the collation matches, the result is It is transmitted to the Internet service provider terminal 20 (step 204: (3) in FIG. 2).

The Internet service provider side terminal 20 receiving the result transmits the data received in (3) in FIG. 2 to the user who accessed in (1) in FIG. 2 (step 205: FIG. 2). (4) in). That is, if the user is a legitimate user (step 206), the registered name, address, age, telephone number, bank account number and specific character string can be displayed and confirmed. On the other hand, if the comparison by the data matching unit 35 does not match, a message indicating that access is denied is displayed on the display 15 of the portable information terminal 10 because the user is not a legitimate user (step 207), and the settlement process is performed. Aborted.

At this time, when it is confirmed that the user is a legitimate user, the contents of the portable information terminal 10 are displayed on the screen as shown in FIG. 6, for example. Step. If the user is not a legitimate user, the screen of the portable information terminal 10
For example, the content as shown in FIG. 7 is displayed.

At this time, the access number acquisition unit 36 of the security service provider side terminal 30 retains the information of the user whose access has been rejected and the number of times of access rejection. By 37, a control signal for stopping the function is transmitted to the portable information terminal 10 side. At this time, in the portable information terminal 10, the communication function is stopped by the function stop control unit 14. When the function of the mobile information terminal 10 is to be stopped, a control signal for stopping the function is transmitted to the Internet service provider terminal 20 to stop the transmission of the communication carrier from the Internet service provider terminal 20. You can also do so.

As a result, the use of the portable information terminal 10 becomes impossible, so that the security is enhanced. At the same time, it is possible to inform the registered name and address that the user information cannot be used by mail.

Next, since the user is confirmed to be a legitimate user, the user transmits the intention of settlement to the Internet service provider side terminal 20 again (step 2).
08: (5) in FIG. 2). The Internet service provider side terminal 20 that has received the intention of settlement transmits the data received in (5) in FIG. 2 to the security service provider side terminal 30 (step 209: (6) in FIG. 2).

The security service provider terminal 30 having received the data can transfer the money from the pre-registered bank account of the user authenticated in (4) in FIG. 2 to the partner bank terminal 40? It is confirmed whether or not it is (Step 210: (7) in FIG. 2). The partner bank-side terminal 40 transmits the result of checking whether the withdrawal is possible to the security service provider-side terminal 30 (step 211: (8) in FIG. 2).

The security service provider terminal 30 receiving the result as to whether or not debit is possible transmits the information (8) in FIG. 2 to the Internet service provider terminal 20 (step 212: FIG. 2). (9)). The Internet service provider terminal 20 transmits the result of (8) in FIG. 2 to the user (step 213: (10) in FIG. 2).

That is, here, if the withdrawal is possible, the process can proceed to the next step. If withdrawal is not possible, a message to that effect is displayed and the settlement process is stopped (steps 214 and 215).

At this time, if the withdrawal is possible, the display 15 of the portable information terminal 10 is displayed, for example, as shown in FIG.
Is displayed, and the user can proceed to the next step by operating "Next" on the screen. If the withdrawal is not possible, the contents shown in FIG. 9 are displayed on the display 15 of the portable information terminal 10, for example.

Next, as shown in FIG. 4, if the debit is possible, the user's willingness to make payment is confirmed by the Internet service provider terminal 20 in order to make a final confirmation of the payment.
(Step 301: (11) in FIG. 2). The Internet service provider side terminal 20 transmits a request for withdrawal to the security service provider side terminal 30 (step 302: (12) in FIG. 2). The account confirmation unit 38 of the security service provider 30 transmits a request for withdrawal to the partner bank 40 (step 30).
3: (13) in FIG. 2). The partner bank side terminal 40 transmits the completion of the withdrawal to the security service provider side terminal 30 (step 304: (14) in FIG. 2).

Security service provider terminal 30
Transmits the completion of the debit to the Internet service provider side terminal 20 (step 305: (1) in FIG. 2).
5)). The Internet service provider terminal 20
Send completion of debit to user (step 30)
6: (16) in FIG. At this time, the portable information terminal 10
The display 15, for example, displays the contents as shown in FIG.

As described above, in this embodiment, when the Internet service provider side terminal 20 performs an information providing service in response to a request from a user, the security service provider side terminal 30 transmits the user information and password related to the user. Referring to the subscriber database 31,
Only when it is confirmed that the user is a legitimate user, the information providing service is permitted. When the information providing service involves settlement, the partner bank terminal 40 stores information indicating the balance of the user's bank account in the account information database 41. To the security service provider side terminal 30, it is possible to specify whether the user of the portable information terminal 10 is a legitimate user, and to prevent unauthorized use. .

In this embodiment, the case of confirming whether or not the user is the identity in the case of settlement of online shopping has been described. However, the present invention is not limited to this example. Immediately after, for example, it is possible to confirm whether the user is the same person.

Further, the security service provider side terminal 30 transmits the information to the portable information terminal 10 through the communication carrier when the inquiry which is not the information of the authorized registrant frequently occurs.
A warning (notification) can be issued to the registered holder of. At the same time, in the communication carrier, the portable information terminal 10
You can also stop using it.

In all the processes, if the information passing through the Internet 50 is encrypted, the security is further improved. After the process (2) in FIG. 2, the security service provider terminal 30 checks the balance of the account of the partner bank terminal 40 immediately after confirming that the user is a legitimate user. It is also possible to confirm whether it is possible and return to the process (9) in FIG. Further, when the withdrawal is completed, the process may return to the process (15) in FIG.

[0050]

As described above, according to the method for preventing unauthorized use of a portable information terminal and the recording medium according to the present invention, when an Internet service provider side terminal performs an information providing service in response to a request from a user, a security service provider is provided. The terminal refers to the user information and password related to the user from the subscriber database, and permits the information providing service only when it is confirmed that the user is a legitimate user. Since the bank terminal refers to the information indicating the balance of the user's bank account from the account information database and gives it to the security service provider terminal, whether the user of the portable information terminal is a legitimate user Can be specified, and unauthorized use can be prevented.

[Brief description of the drawings]

FIG. 1 is a diagram showing an outline of an unauthorized use prevention system according to an embodiment of a method for preventing unauthorized use of a portable information terminal according to the present invention.

FIG. 2 is a diagram showing an outline of the unauthorized use prevention system of FIG. 1;

FIG. 3 is a flowchart illustrating a method for preventing unauthorized use of a portable information terminal in the unauthorized use prevention system of FIG. 1;

FIG. 4 is a flowchart for explaining a method of preventing unauthorized use of a portable information terminal in the unauthorized use prevention system of FIG. 1;

FIG. 5 is a diagram for explaining a method for preventing unauthorized use of a portable information terminal in the unauthorized use prevention system of FIG. 1;

FIG. 6 is a diagram for explaining a method for preventing unauthorized use of a portable information terminal in the unauthorized use prevention system of FIG. 1;

FIG. 7 is a diagram for explaining a method of preventing unauthorized use of a portable information terminal in the unauthorized use prevention system of FIG. 1;

FIG. 8 is a diagram for explaining a method of preventing unauthorized use of a portable information terminal in the unauthorized use prevention system of FIG. 1;

9 is a diagram for explaining a method of preventing unauthorized use of the portable information terminal in the unauthorized use prevention system of FIG. 1;

FIG. 10 is a diagram for explaining a method of preventing unauthorized use of a portable information terminal in the unauthorized use prevention system of FIG. 1;

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 10 Personal digital assistant 20 Internet service provider terminal 11 Key input reception part 12 Display control part 13 Communication control part 14 Function stop control part 15 Display 30 Security service provider side terminal 31 Subscriber database 32 Information reception part 33 Information registration part 34 data search unit 35 data collation unit 36 access count acquisition unit 37 access rejection notification unit 38 account confirmation unit 40 partner bank terminal 41 account information database 50 internet

Continued on the front page (51) Int.Cl. ⁷ Identification symbol FI Theme coat II (reference) G06F 1/00 370 G06F 1/00 370E H04Q 7/38 H04B 7/26 109S

Claims (12)

[Claims] 1. A first step in which a user receives an information providing service using a portable information terminal, and a second step in which an Internet service provider terminal performs the information providing service in response to a request from the portable information terminal. According to a request from the Internet service provider side terminal, the security service provider side terminal refers to the user information and the password of the user from the subscriber database, and only when it is confirmed that the user is a legitimate user, A third step of permitting the information providing service by the Internet service provider side terminal; and when the information providing service involves settlement, the partner bank side terminal responds to the request of the security service provider side terminal by the request of the user. Look up information indicating the balance of the bank account from the account information database And a fourth step of giving the security service provider terminal an unauthorized use of the portable information terminal. 2. The first step includes: transmitting a user information for registering in the subscriber database and a password; and a step of receiving the information providing service accompanied by settlement. A sixth step of transmitting user information and a password is included. In the second step, when the user information and the password are received, the information is transmitted to the security service provider side terminal. The seventh step is included. In the third step, when it is confirmed that the user is the legitimate user, the balance of the bank account is immediately checked and whether or not debiting is possible is determined by the Internet service provider side. The method according to claim 1, further comprising an eighth step of notifying the user via a terminal. 3. The ninth step, wherein when the data referred from the subscriber database does not match, the data collating unit notifies the Internet service provider side terminal that the user is not a legitimate user. The method according to claim 1, wherein the second step includes a tenth step of, when receiving a notification that the user is not the authorized user, denying the user access. How to prevent unauthorized use of mobile information terminals. 4. The ninth step, wherein the access count acquisition unit holds the number of access denials of the user and the user information of the user. 4. The method according to claim 3, further comprising an eleventh step of notifying the service provider terminal. 5. The first step includes a twelfth step of transmitting the intention of settlement to the Internet service provider side terminal after confirming that the user is a legitimate user; The step of transmitting includes a thirteenth step of transmitting a will of the settlement from the user to the security service provider side terminal. The third step includes: A fourteenth step of making a request to confirm whether the payment from the user's bank account can be withdrawn is included, and the fourth step includes checking the result of checking whether the withdrawal is possible. The method according to claim 1, further comprising a fifteenth step of transmitting to the security service provider terminal. 6. The twelfth step includes a sixteenth step of notifying the Internet service provider side terminal of a final confirmation of settlement when the debit is possible, wherein the thirteenth step Includes a seventeenth step of notifying the security service provider side terminal of a debit request, and the fourteenth step includes an eighteenth step of notifying the partner bank side terminal of a debit request. The method according to claim 5, wherein the fifteenth step includes a nineteenth step of notifying the security service provider side terminal of the completion of the withdrawal. . 7. The eighteenth step includes a twentieth step of notifying the Internet service provider side terminal of the completion of the debit, and the seventeenth step includes the step of notifying the mobile information terminal of the debit. 7. The method for preventing unauthorized use of a portable information terminal according to claim 6, further comprising a twenty-first step of notifying completion. 8. The portable information terminal according to claim 1, wherein the user information is a name, an address, an age, a telephone number, a customer management number, and a bank account number of the user. How to prevent unauthorized use. 9. The method according to claim 1, wherein the user information is a specific character string. 10. A recording medium on which a program capable of executing the method for preventing unauthorized use of a portable information terminal according to claim 1 is recorded. 11. A program for causing a computer to execute first to fourth steps. 12. A program for causing a computer to execute a first step to a twenty-first step.