JP2002150242A - Personal identification number collating method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a personal identification number collating method used safely by changing the operation method of personal identification numbers used conventionally. SOLUTION: This personal identification number collating method comprises n-digit of right identification numbers comprising multiple character columns, position information showing in what position of the multiple character row groups with the same n-digits to but different numbers from the right identification number is the right identification number inputted, an IC card storing the input frequency of the identification number, and an information processing device electrically connected to the IC card and accessing to the information recorded in the IC card. This method is so set that the IC card itself collates the right identification number of the character row groups, the position information, and the input frequency inputted from an input part of the information processing device by an input means, with the similar collation items stored in the IC card at every transaction in the IC card inside and, when they are collated with one another, the transaction is started between the information processing device and the IC card.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method for confirming the validity of an IC card holder by using the same number of digits as a correct password even if the password is stolen and used. By inputting different PINs multiple times, the IC card cannot be abused unless the input location of the different numbers (number and order of different numbers entered) stored by the holder is stolen. About the method.

[0002]

2. Description of the Related Art When trading goods, a signature of a card holder written on a card with a magnetic stripe (hereinafter referred to as a magnetic card) and a handwriting of a signature of the person written on a sales slip by the person. From the system that performs payment, using the IC card equipped with a central processing unit (hereinafter referred to as CPU), the user himself / herself inputs the personal identification number to the terminal at the site of the sale of goods and records it on the IC card The security code entered and the entered security code are
It is about to change to a system that allows the C chip to confirm itself.

[0003] Identity verification using a magnetic card is a comparison between a signature written on the back of the card and a signature written by the holder of the magnetic card. A person who is not a valid holder imitates the signature. And this comparison was done by humans and was inaccurate. In addition, the personal identification number is recorded on the magnetic stripe of the magnetic card, and at the prize trading site, the personal identification is entered using the terminal as described above, and even if the identity can be confirmed, the magnetic card is stolen. If
By analyzing the magnetic recording pattern of the magnetic stripe, it became possible to decrypt the password.

For this purpose, a method has been adopted in which the personal identification number is not recorded on the magnetic stripe, the personal identification number is recorded on the center terminal, and the external terminal directly checks the terminal with the center. . According to this method, the password is not stolen, but a line usage fee for inquiring the center from the merchandise sales site and the time required for the inquiry are required.

[0005] However, in the case of using an IC card, it is impossible for a third party to analyze the circuit of the IC chip and decipher the password unless the holder of the valid IC card gives the password to another person. Yes, it is more secure than magnetic cards.

[0006] On the other hand, in many cases, the personal identification number is a four-digit number, and many card holders use their home phone number or their own date of birth in order to make the number unforgettable. Therefore, if you lose your phone with your home phone number or a book with your date of birth, such as a driver's license, you will get a very high probability Could be plagiarized and cause severe damage. That said, it's not easy to change the number of digits in a PIN or to use a string of numbers that you might forget if you don't record it.

[0007]

Therefore, as described above, even a relatively high security card such as an IC card may cause some uneasiness. Providing a password collation method that can be used more safely by changing

[0008]

According to the present invention, there is provided a password collating method according to the present invention, wherein the correct n-digit password composed of a plurality of character strings is different from the same n-digit correct password. An IC card storing position information indicating which position of a plurality of character string groups has been input and the number of times a password has been input, and an IC card electrically connected to the IC card and recorded on the IC card. And an information processing apparatus for accessing information, and each time a transaction is made, the correct personal identification number, position information, and number of times of input of the character string group input by the input unit from the input unit of the information processing apparatus, and The correct PIN, location information,
Also, the IC card itself is collated with the number of times of input in the IC card, and when the numbers match, a transaction is started between the information processing apparatus and the IC card.

[0009]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below in detail with reference to the drawings.

FIG. 1 is an example of a hardware (terminal) configuration corresponding to a password collation method for confirming the identity of an IC card holder according to the present invention. FIG. 2 is a control block of the password collation method according to the present invention. FIGS. 3 and 4 show an example of an IC card data format, FIG. 4 is a flowchart of a password collation method of the present invention, FIG. 5 is a first embodiment in which a correct password is input, and FIG. FIG. 7 shows a third embodiment in which a correct password is input, and FIG. 8 shows a fourth embodiment in which a wrong password is input. For example, FIG. 9 shows a fifth embodiment in which an incorrect password is input, and FIG. 10 shows a sixth embodiment in which an incorrect password is input.

Specific examples of the hardware configuration corresponding to the personal identification number collation method shown in FIG. 1 include an ATM used in a financial institution, a cash dispenser, a POS terminal of a store, a personal computer, and the like. 11
Is an IC card processing device having an input unit, 1 is a terminal device such as an ATM used in a financial institution, and 3 is an IC card. Information unique to the card holder, including a personal identification number, is recorded on the IC chip of the IC card 3.

In the IC card 3, a magnetic recording portion 32 is formed on the same side as the external terminal surface of the IC module 31 in many cases. In the case of a credit card or the like, information related to the owner of the card is displayed in an embossed display 33 in the lower part of the card. Although not shown in the figure, the magnetic recording portion is also formed on the back side (the side opposite to the embossed surface) of the IC card, and is used when using a credit card outside Japan. The information recorded in the magnetic recording unit is an IC
There are many parts in common with the information recorded on the chip, and in the case of a bank card, the information includes a bank code, a bank account code, an account number, and other data unique to the user. However, no password is recorded in the magnetic recording unit. The reason is that the recorded data can be decoded by analyzing the magnetic recording waveform and the developed pattern of the recording section. On the other hand, the IC card cannot be decrypted as described above, and the personal identification number is recorded and collated with the externally input personal identification code in the IC chip.
It is only necessary to send out signals that do not match.

The portion of the IC module 31 exposed on the card surface is an external terminal for connecting to an external device.
It is divided into 6 to 8 pieces. The position of each terminal of the external terminal is determined by the ISO (International Standards Organization) so as to match the position of a connector such as a reader / writer provided in the apparatus.

An IC is provided behind the external terminals of the IC module.
The chip is fixed with an adhesive or the like, and each terminal of the IC chip is electrically connected to the external terminal. The IC chip has a ROM (R) in which various processing programs are written.
RAM (Random Access M) that temporarily stores the contents of the transaction, such as an “ad only memory” and a transaction.
memory) for storing various kinds of information as an electrically rewritable EEPROM (Ele).
critically Erasable Program
mmable ROM) and a control circuit for controlling them are formed on the same substrate.

In FIG. 2, the terminal device 1 corresponds to the card 3 shown in FIG.
Corresponds to both the IC module portion and the magnetic recording portion. The card R / W unit 15 is a read and write device having a function of reading and writing recorded information from the IC card 3 inserted by the holder. The operation unit 12 is provided outside the apparatus, and includes an operation panel for inputting data and a keyboard. When the operation unit is an operation panel, the display unit 11 also serves as the display unit, but when the operation unit is a keyboard, the display unit 11 is independent. The storage unit 13 includes a RAM, a ROM, and the like, like the inside of the chip of the IC card.
It is controlled by the control unit 14. The control unit 14 not only controls information input from outside via the operation unit 12, but also controls the entire apparatus. For example, control of taking in and discharging of the card of the card R / W unit 15, printing of a receipt, discharging of a receipt, bills to be paid out, the number of coins, payment, and confirmation of the amount of money to be paid if a money receiving unit is provided. is there. The host device 2 is a large-scale control and storage device such as the central processing unit of the calculation center of the head office connected to the control unit 14 of the terminal 1 of the branch office or the branch office by a dedicated line. The personal identification number of a cash card used in a conventional bank is stored in this higher-level device, and corresponds to an inquiry from each terminal. It also records and manages terminal use history information of each depositor (card holder), updates the balance of deposits, and performs depositing work.

The example shown in FIG. 3 shows the items and arrangement order of data recorded on a conventional IC card. A recent method of filing information in an IC chip uses a key depending on the nature of the information. I manage it separately. Therefore, a plurality of personal identification numbers are set depending on the field of use. In this embodiment, the financial institution code 301, the branch (branch) code 302, and the deposit item
3. Account number 304, customer (owner) name 305, deposit balance 306, password 307, correct password number position information 308 of the present invention, number of inputs 309, transaction histories 1 to n
(310 to 315), and the information recorded in the magnetic recording unit is 301 to 304, and in some cases, 305
Up to. A password 307 which is a main part of the present invention,
The position information 308 of the correct password and the number of times of input 309 are
It is shown in parentheses and cannot be read from the outside, especially unlike other items. The IC card reads the security information input from the operation unit of the terminal device, stores the security information in a temporary memory inside the card, compares the security information with the security number 307 stored in the IC card, and then checks the security code that has been repeatedly input. Check the order in which the correct PIN was typed in. Specific examples will be described with reference to FIGS. 5 to 10. The position information, the number of inputs may be fixed,
You can freely rewrite it. That is, it is a part placed under the control of the card holder.

The flow of the password collation method of the present invention will be described with reference to FIGS. According to the instruction on the display unit 11 of the terminal 1, the IC card 3 is inserted into the card R / W unit (step 101). The display screen changes to a password (number) input screen (step 102). Enter the first password as a 4-digit number 7777 (step 10).
3). Next, the user inputs the second personal identification number as 3456 (step 104). Similarly, the third password is 8888
Is input (step 105). Similarly, the fourth personal identification number is input as 7568 (step 106). Similarly 5
The user enters the personal identification number as 4444 (step 10).
7). The inputted five personal identification numbers are temporarily stored in the storage unit 13 of the terminal device 1, and the work of inquiring the IC card is performed. First, it is confirmed from the operation unit of the terminal that the four-digit number has been input five times, and then it is confirmed that the registered password 8888 has been input only once and the third time. This completes the “collation” operation. The input means correctly performs the password work, confirms that the correct password has been input, and calls the host computer from the terminal 1 (step 108). After the collation of the personal identification number is completed in this way, transactions with the host computer, such as cash withdrawal, transfer, and deposit, are performed (step 109). When a series of transaction work is completed, the screen changes to the final confirmation screen, and when the confirmation panel is pressed, the IC card is discharged from the card R / W unit 15 together with the display of "End". The card holder takes out the IC card 3 from the card R / W unit 15 (step 110).

FIG. 5, FIG. 6, FIG. 7, FIG. 8, FIG.
A specific example will be described with reference to FIG.

[0019]

(Embodiment 1) In the figure, "5" of the denominator of "3/5" in the column of "Correct PIN number" is "5
The third entry of the numerator means "the third input number". The same applies to FIGS. 5 to 10. The embodiment shown in FIG. 5 is an example in which the input is correct as described above. In this embodiment, only the number 4
It is assumed that the user enters a five-digit PIN number five times, and the correct PIN number registered in the IC card is 888.
In step 8, only one out of five inputs is made. Moreover, the correct number is input only at the time of the third input.
That is, the data recorded on the IC chip includes the correct password “8888”, the number of times the password is input “5”, and the order (position) of inputting the correct password “3”. ). The same applies to the following embodiments.

(Embodiment 2) The embodiment shown in FIG. 6 is also an example in which the input is correct as in the first embodiment. Also in this embodiment, it is premised that a four-digit password, which is a numeral only, is input five times, and the correct password registered in the IC card is 8888, and is input twice among five times. Is done. The number of times of correct input is the third and fourth times.

(Embodiment 3) The embodiment shown in FIG. 7 is also an example in which the input is correct as in the first embodiment. In this example,
It is premised that a password consisting of only four digits is entered three times, and the correct password registered in the IC card is 8888, and only one out of three entries is made. Moreover, the correct number is input only at the time of the third input. In this embodiment, when it is troublesome to repeatedly input a four-digit number five times, the number is registered with a small number. Instead, the risk of plagiarism is greater than five.

(Embodiment 4) The embodiment shown in FIG. 8 differs from the above-mentioned case in that the input is not correct. In this example, the plagiarism has somehow learned that the correct PIN is 8888. However, I do not know that it is premised to input the four-digit password five times. Therefore, since the input is performed only once, the process cannot proceed to the next step. Over time, he begins to doubt the correct PIN.

(Embodiment 5) As in the previous embodiment, the embodiment shown in FIG. In this example, the plagiarism has somehow learned that the correct PIN is 8888. In addition, he noticed that he entered the four-digit password several times, but he entered the correct password five times. Therefore, 8888, which should have been input only the third time, has been input any other number of times, so that the process cannot proceed to the next step forever. Over time, he begins to doubt the correct PIN.

(Embodiment 6) As in the previous embodiment, the embodiment shown in FIG. In this example, the plagiarism has somehow learned that the correct PIN is 8888. He also noticed that he entered his four-digit password several times, but he entered the correct PIN three times every other time. Therefore, 8888, which should have been input only the third time, has been input any other number of times, so that the process cannot proceed to the next step forever. Over time, he begins to doubt the correct PIN.

In the above-described embodiment, it is described that an infinite number of combinations of passwords can be tried. However, it is needless to say that the number of repetitions can be limited. Just set it.

[0026]

As described in the above-mentioned six embodiments, even if a secret number is known to another person, a relatively simple four-digit number can be used as a valid secret code depending on what is repeatedly input. I understand. Moreover, it is only necessary to record the order in which the correct personal identification numbers appear and the number of times of inputting in the memory of the IC, and this is an excellent method that does not require the use of a large number of bits.

[Brief description of the drawings]

FIG. 1 shows an example of a hardware (terminal) configuration corresponding to a password collation method for confirming the identity of an IC card holder according to the present invention.

FIG. 2 is a control block diagram of a password verification method according to the present invention;

FIG. 3 shows an example of an IC card data format.

FIG. 4 is a flowchart of a password collation method of the present invention.

FIG. 5 is a first embodiment when a correct password is input.

FIG. 6 shows a second alternative embodiment when a correct password is input.

FIG. 7 shows a third embodiment in which a correct password is input.

FIG. 8 is a first embodiment when an incorrect password is entered.

FIG. 9 shows a second embodiment when an incorrect password is entered.

FIG. 10 shows a third embodiment when an incorrect password is entered.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 1 Personal identification number collation device (terminal) which confirms the identity of an IC card holder 2 Host device 3 IC card 11 Display unit 12 Operation unit (input unit) 13 Storage unit 14 Control unit 15 Card reader / writer unit 31 IC module 32 Magnetic recording section 33 Emboss display section

Claims (1)

[Claims] 1. An n-digit correct password composed of a plurality of character strings, and a position in a plurality of character string groups different from the same n-digit correct password which are input to the correct password. And an information processing device that is electrically connected to the IC card and accesses information recorded on the IC card. Each time, the correct password of the character string group input by the input unit from the input unit of the information processing device, the position information, and the number of inputs,
The IC card checks the correct personal identification number, position information, and the number of times of input stored in the IC card by itself, and when they match, a transaction is started between the information processing device and the IC card. A password collation method characterized in that: