JP2005275923A - Individual authentication method at the time of card settlement, individual authentication system at the time of card settlement, shop information processing system, credit-card company information processing system, portable terminal, and program therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform individual authentication in real time using a portable terminal at the time of card settlement at a shop. <P>SOLUTION: A POS terminal 3 transmits to a server 5 through Internet 4 individual authentication request together with input ID number and password of IC card 1 and cellular telephone number received from a cellular telephone set 2 by short-distance radio. The server 5 performs individual authentication of the user by collating received ID number, password, and cellular telephone number with ID number, password, and cellular telephone number registered beforehand; and responds with the result to POS terminal 3 through Internet 4. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a person authentication method and a person authentication system at the time of card payment, and in particular, a person authentication method at the time of card payment and a person at the time of card payment that can authenticate the person in real time using a mobile phone at the time of card payment at a store. The present invention relates to a personal authentication system, a store information processing device, a credit company information processing device, a portable terminal, and a program.

  Purchases using credit cards at department stores and stores have become very common. Recently, online purchases using online financial statements from terminals such as personal computers have become widespread.

  In such a purchase using credit, it is the most important issue to confirm the identity. Fingerprints and the like have been used in part as personal authentication methods, but generally passwords are used.

  However, passwords are often stolen or inferred. As a result, there are many cases of impersonation and misuse.

  Therefore, in order to further increase security, a method of authenticating the person using a portable terminal has been devised (see, for example, Patent Document 1).

  In the method according to this document, when the payment processing is requested with credit in an Internet transaction system, the payment system first inputs an ID and a password. If the password is OK, after validating the card payment, an authentication e-mail is sent to the principal terminal. If there is no access to this e-mail for 24 hours, or if the user opens this e-mail and connects to the authentication Web and does not enter a password for approval, the settlement procedure is canceled.

  By this method, even if the criminal knows the ID and password, the password for approval cannot be entered unless the user's terminal (for example, mobile phone) is also stolen. This is because the confirmation e-mail does not come to the criminal terminal. As a result, the system can guarantee strong security.

JP 2002-366867 A

  As described above, in the method of sending a confirmation mail from the payment system to the terminal owned by the principal and performing the personal authentication, it takes time to process and exchange the mail. For this reason, there is a problem that the method of authenticating the person by sending an e-mail is not suitable for card payment at a shop (store) that places importance on real time.

  It is an object of the present invention to provide a personal authentication method at the time of card payment, a personal authentication system at the time of card payment, and a mobile terminal that enable real-time user authentication using a mobile terminal at the time of card payment at a shop. .

  The first invention is characterized in that the information processing apparatus authenticates the user using the user ID number, the password, and the mobile phone number of the mobile phone.

  According to a second aspect of the invention, the store information processing apparatus transmits a personal authentication request together with an ID number input from a user, a password, and a mobile phone number of the mobile phone to the credit company information processing apparatus. The user authentication is performed based on the received ID number, the password, and the mobile phone number of the mobile phone, and the result is returned to the store information processing apparatus.

  A third invention is characterized in that the mobile phone number of the mobile phone of the second invention is input from the mobile phone to the store information processing apparatus by short-range radio.

  According to a fourth aspect of the present invention, the personal authentication of the second aspect of the present invention includes the ID number registered in advance, the password and the mobile phone number of the mobile phone and the received ID number, the password and the mobile phone. It is determined by collating with a mobile phone number.

  According to a fifth aspect of the present invention, there is provided a mobile phone for transmitting a mobile phone number, an input means for inputting a user ID number and a password, a receiving means for receiving the mobile phone number of the mobile phone, and the input ID number and password. And a store information processing device configured to include a personal authentication request means for transmitting a personal authentication request together with the received mobile phone number, and an individual who receives the ID number, the password, the mobile phone number, and the personal authentication request. An authentication request receiving means, a personal authentication means for authenticating the user by the ID number, the password, and the mobile phone number; and a personal authentication result answering means for replying a personal authentication result to the store information processing apparatus. It is comprised from the credit company information processing apparatus comprised.

  6th invention is 5th invention, The said mobile telephone reads the mobile phone number beforehand memorize | stored in the memory | storage device, and outputs the said mobile phone number read out by short-range radio | wireless output The store information processing apparatus includes a mobile phone number receiving circuit that receives the mobile phone number by the short-range wireless and stores it in a storage device in the store information processing apparatus.

  According to a seventh aspect of the present invention, the identity authentication means according to the fifth aspect of the invention includes the ID number, the password and the mobile phone number of the mobile phone registered in advance and the received ID number, the password and the mobile phone. The mobile phone number is collated by a collation circuit provided in advance.

  According to an eighth aspect of the present invention, there is provided an input means for inputting an ID number and a password of a user, a receiving means for receiving a mobile phone number of the mobile phone, and an identification authentication together with the input ID number and password and the received mobile phone number. It is characterized by comprising personal authentication request means for transmitting a request to the credit company information processing apparatus.

  According to a ninth aspect of the present invention, there is provided a personal authentication request receiving means for receiving an ID number, a password, a mobile phone number and a personal authentication request, and a personal authentication means for authenticating the user by the ID number, the password and the mobile phone number And a personal authentication result reply means for replying the personal authentication result to the store information processing apparatus.

  A tenth aspect of the invention includes a mobile phone number output circuit that reads out a mobile phone number stored in advance in a storage device and outputs the read mobile phone number by short-range radio. .

  An eleventh invention receives a first function for transmitting a mobile phone number in a mobile phone, a second function for inputting a user ID number and a password in a store information processing apparatus, and a mobile phone number of the mobile phone. A fourth function of transmitting a personal authentication request together with the input ID number and password and the received mobile phone number, and the ID number, password and mobile phone in a credit company information processing apparatus. A fifth function for receiving a number and the user authentication request, a sixth function for authenticating the user by the ID number, the password and the mobile phone number, and a result of the user authentication to the store information processing apparatus. A program for causing a computer to execute the seventh function.

  The present invention has an effect of enabling personal authentication in real time using a mobile terminal at the time of card payment in a shop (store).

  Next, the best mode for carrying out the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a system configuration diagram showing the best mode for carrying out the present invention.

  As can be seen from FIG. 1, the present invention includes an IC card 1, a mobile phone 2, a POS terminal 3 of a shop (store), the Internet 4, and a server 5 of a credit company.

  The IC card 1 is a card used when a user purchases credits at a shop (store), and records an ID, a credit number, and the like.

  The mobile phone 2 is a terminal used for identity authentication when a user purchases with credit at a shop (store). In the mobile phone 2, a number unique to the mobile phone such as a mobile phone number is registered in advance.

  When a user requests purchase by credit at a shop (store), the POS terminal 3 of the shop (store) first acquires an ID number from the IC card 1. Then, the POS terminal 3 sequentially acquires a user input password and a mobile phone number from the mobile phone 2. The POS terminal 3 sends the acquired ID number, password, and mobile phone number of the mobile phone 2 to the credit company server 5 to request authentication. For inputting the mobile phone number from the mobile phone 2, a method using short-range radio such as Bluetooth is appropriate.

  Further, the POS terminal 3 of the shop (store) accepts the settlement processing by the card if it is OK based on the authentication result of the personal authentication from the server 5 of the credit company. If the authentication result of the personal authentication is NG, only cash settlement processing is accepted.

  The Internet 4 is a line used for packet communication between the POS terminal 3 of the shop (store) and the server 5 of the credit company.

  When there is a registration request from the user, the credit company server 5 registers the password and the mobile phone number of the mobile phone 2 in correspondence with the ID number of the user. Further, when the server 5 receives the personal authentication request from the POS terminal 3 of the shop (store), the server 5 acquires the ID number, the password, and the mobile phone number of the mobile phone 2 at the same time. Then, the server 5 collates the received ID number, the password, the mobile phone number of the mobile phone 2, the password corresponding to the ID number registered in advance, and the mobile phone number of the mobile phone 2. The server 5 considers the user to be the person if the matching results match, and considers the user to be another person if they do not match, and replies to that point to the POS terminal 3 of the shop (store).

  Next, FIG. 2 is an operation flowchart showing the best mode for carrying out the present invention.

  The card user requests the credit company to register the ID number and password of his IC card 1 and the mobile phone number of his mobile phone 2 (step 1).

  This registration request needs to be made in advance before shopping with an IC card. In addition, this registration request may be requested directly from the credit company, or may be requested from a terminal such as a personal computer via the Internet.

  Upon receiving this registration request, the credit company server 5 registers the password and the mobile phone number of the mobile phone 2 in a database (not shown) corresponding to the ID number (step 2).

  Next, when there is a payment request by credit from the card user (step 3), the POS terminal 3 requests input of ID, password and mobile phone number (step 4). The settlement request is made by a general input method (not shown) such as menu selection from the user.

  In response to the input request for the ID, password and mobile phone number, the user inputs the ID, password and mobile phone number to the POS terminal 3 (step 5).

  The ID number is input from the IC card 1 to the POS terminal 3 via a card reader which is a well-known input means (not shown). The password is input to the POS terminal 3 by key input which is a well-known input means (not shown) by the card user.

  Next, the mobile phone number stored in advance in the storage device in the mobile phone 2 is input to the POS terminal 3 (step 6).

  Data exchange between the cellular phone 2 and the POS terminal 3 is performed by a short-range wireless communication such as a known Bluetooth. In this case, a mobile phone number output circuit (not shown) that outputs a mobile phone number by short-range wireless is required in the mobile phone 2. The mobile phone number output circuit reads a mobile phone number stored in advance in the storage device, and outputs the read mobile phone number by short-range radio. The request for outputting the mobile phone number by short-range wireless may be made by pressing a specific key. Further, the POS terminal 3 requires a mobile phone number receiving circuit that receives a mobile phone number by short-range wireless and stores it in a storage device in the POS terminal 3.

  When the POS terminal 3 acquires the ID number, password, and mobile phone number, it sends a personal authentication request to the credit company server 5 by a known transmission means (step 7). At the same time, the POS terminal 3 also transmits the ID number, password, and mobile phone number to the server 5.

  When the server 5 receives a personal authentication request from the POS terminal 3 by a well-known receiving means (not shown), the server 5 performs personal authentication and returns the result to the POS terminal 3 (step 8).

  The personal authentication is performed by collating the ID number, password, mobile phone number received from the POS terminal 3 and the same item registered in advance by a collation circuit (not shown). The server 5 considers the user to be the person if the result of the collation matches, and regards the user to be another person if the results do not match.

  Upon receiving the response, the POS terminal 3 notifies the card user whether the card payment is permitted or not based on the response result (step 9). Notification that card payment is permitted or not may be made via the display device of the POS terminal 3.

  If the personal authentication is OK in step 9, the POS terminal 3 performs a payment process with a card, and if it is NG, performs a payment process with cash (step 10).

  In the above, the personal authentication method using a portable terminal at the time of card payment at a shop (store) has been described. It goes without saying that the present invention is not limited to this, and can be applied to any business system that requires real-time user authentication.

1 is a system configuration diagram showing the best mode for carrying out the present invention. It is an operation | movement flowchart which shows the best form for implementing this invention.

Explanation of symbols

1 IC Card 2 Mobile Phone 3 POS Terminal 4 Internet 5 Server

Claims (11)

An information processing apparatus authenticates a user by using the input user ID number, password, and mobile phone number of the mobile phone. The store information processing apparatus transmits a personal authentication request to the credit company information processing apparatus together with the ID number input from the user, the password, and the mobile phone number of the mobile phone, and the credit company information processing apparatus receives the received ID number, A personal authentication method at the time of card payment, wherein the user is authenticated by the password and the mobile phone number of the mobile phone, and the result is returned to the store information processing apparatus. The personal authentication method at the time of card payment according to claim 2, wherein the mobile phone number of the mobile phone is input from the mobile phone to the store information processing apparatus by short-range radio. The identity authentication is determined by comparing the ID number, the password, and the mobile phone number of the mobile phone registered in advance with the received ID number, the password, and the mobile phone number of the mobile phone. The personal authentication method at the time of card settlement according to claim 2. A mobile phone for transmitting a mobile phone number, an input means for inputting a user ID number and a password, a receiving means for receiving the mobile phone number of the mobile phone, and the received mobile phone and the received ID number and password A store information processing apparatus configured to include a personal authentication request means for transmitting a personal authentication request together with a number; a personal authentication request receiving means for receiving the ID number, the password, the mobile phone number, and the personal authentication request; Credit company information including personal authentication means for authenticating the user with the ID number, the password, and the mobile phone number, and personal authentication result answering means for replying the personal authentication result to the store information processing apparatus. A personal authentication system at the time of card settlement, characterized by comprising a processing device. The mobile phone includes a mobile phone number output circuit that reads out and reads out the mobile phone number stored in advance in a storage device, and outputs the read mobile phone number by short-range wireless communication. 6. The personal authentication system at the time of card settlement according to claim 5, further comprising a mobile phone number receiving circuit that receives a telephone number by the short-range wireless and stores it in a storage device in the store information processing apparatus. The identity authentication means includes a collation circuit provided in advance with the ID number registered in advance, the password and the mobile phone number of the mobile phone, and the received ID number, the password and the mobile phone number of the mobile phone. The personal authentication system at the time of card payment according to claim 5, wherein the verification is performed by: An input means for inputting the user's ID number and password; a receiving means for receiving the mobile phone number of the mobile phone; and a personal identification request together with the input ID number and password and the received mobile phone number. A store information processing apparatus comprising a personal authentication requesting means for transmitting to the apparatus. A personal authentication request receiving means for receiving an ID number, a password, a mobile phone number, and a personal authentication request; a personal authentication means for authenticating the user by the ID number, the password and the mobile phone number; and a personal authentication result. A credit company information processing apparatus comprising: a personal authentication result answering means for replying to the store information processing apparatus. A mobile terminal comprising a mobile phone number output circuit for reading out and reading out a mobile phone number stored in advance in a storage device by short-range radio. A first function for transmitting a mobile phone number in a mobile phone; a second function for inputting a user ID number and a password in a store information processing apparatus; and a third function for receiving a mobile phone number of the mobile phone. A fourth function of transmitting a personal authentication request together with the input ID number and password and the received mobile phone number; the ID number, the password, the mobile phone number, and the personal authentication request in a credit company information processing apparatus; A fifth function for receiving the identity, a sixth function for authenticating the user by the ID number, the password, and the mobile phone number, and a seventh function for returning the identity authentication result to the store information processing apparatus. A program that causes a computer to execute.

Images