JP2006215702A - Personal authentication system and method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a personal authentication system capable of reducing the risk of abuse. <P>SOLUTION: A cash card 12 has personal identification information. An authentication medium 13 has authentication information. An ATM 11 sends to an authentication server 14 the personal identification information read from the cash card 12, the authentication information read from the authentication medium 13, and an ID number inputted by a user. An authentication means 18 identifies the user based on the personal identification information and refers to an authentication information storage part 16 to determine whether or not the user's ID number and authentication information match the ID number and the authentication information received from the ATM 11, respectively. If both the ID numbers and the authentication information match, the authentication means 18 outputs a message indicating that authentication has been successful. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a personal authentication system and method, and more particularly to a personal authentication system that performs authentication using a card and a personal identification number.

  Usually, when performing transactions such as withdrawing cash from an ATM, a personal identification number is entered to perform personal authentication. However, the personal identification number may be leaked to others, and stronger personal authentication is required especially when withdrawing large amounts of cash. As a technique for performing personal authentication by combining a plurality of authentication means, there is a technique described in Patent Document 1. In this technology, using a plurality of authentication means such as a card, signature, information known only to the person, face authentication, fingerprint verification, etc., depending on the level of transaction, for example, authentication by only a card (password), or Authentication is performed by entering information that is known only to the card, signature, and person.

Patent Document 2 uses an IC card including a magnetic recording unit and an IC chip, and makes a transaction using information recorded on the IC chip and information recorded on the magnetic recording unit. The technology is described. In Patent Document 2, for example, a transaction with a low security level such as deposit is performed using information recorded in the magnetic recording unit, and a transaction with a high security level such as a withdrawal is performed with magnetic recording. It is described that the transaction is performed by using both the information recorded in the section and the information recorded in the IC chip.
Japanese Patent Laying-Open No. 2001-351047 (FIG. 5, paragraphs 0057 to 0063) JP 2003-132399 A (paragraphs 0009 to 0014)

  However, since Patent Document 1 uses a signature, information known only to the person, or biometric authentication as an authentication means other than a card, storing such information is complicated and there is a problem that operation is complicated. . Even when both information recorded on the IC chip and information recorded on the magnetic recording unit are used as in Patent Document 2, there is a risk of unauthorized use when the card is stolen. It cannot be excluded.

  An object of the present invention is to provide a personal authentication system and method that solves the above-described problems of the prior art, reduces the risk of unauthorized use, and does not complicate operations.

  To achieve the above object, a personal authentication system of the present invention, a personal authentication method for performing personal authentication using a computer, personal identification information read from a personal information recording medium for recording personal identification information on the computer, and Recording the authentication information and reading the authentication information read from the authentication information recording medium separate from the personal information recording medium, and the password entered by the input means, the computer, personal identification information, The authentication information and the personal identification number corresponding to the input personal identification information are read from a storage device that stores the authentication information and the personal identification number in association with each other, the read authentication information and personal identification number and the input authentication information And a step of outputting a message indicating that the authentication is successful when it is determined that the passwords match each other.

  In addition, the personal authentication system of the present invention includes personal information reading means for reading the personal identification information from a personal information recording medium storing personal identification information, authentication information stored, and authentication separate from the personal information recording medium. When receiving the authentication information reading means for reading the authentication information from the information recording medium, the input means for inputting the personal identification number, the personal identification information, the authentication information, and the personal identification number, the personal identification information, the authentication information, and Reading means for reading out authentication information and a password corresponding to the inputted personal identification information from a storage device that stores the password associated with the password, and the authentication information and password read by the reading means and the input And a notification means for notifying that the authentication has succeeded when the authentication information and the personal identification number coincide with each other.

  In the conventional personal authentication method, since authentication is performed using a personal information recording medium and a personal identification number, the personal information recording medium may be illegally used due to theft or leakage of the personal identification number. On the other hand, in the present invention, in addition to the personal information recording medium and the personal identification number, an authentication information recording medium different from the personal information recording medium is used for personal authentication. As described above, since the personal information recording medium and the authentication information recording medium are separate media, the probability of both of them being stolen simultaneously is low. For this reason, the risk of unauthorized use of the personal information recording medium can be reduced. Also, storing authentication information is easier than storing biometric information, and the operation can be simplified as compared to the case where biometrics is used for personal authentication.

  In the authentication method and system of the present invention, the personal identification number input by the input means includes the first personal identification number corresponding to the personal identification information and the second personal identification number corresponding to the authentication information. A configuration can be adopted in which it is determined that the code numbers match when the encryption code and the second code number match the corresponding first code number and the second code number stored in the storage device, respectively. In this case, the risk of unauthorized use can be further reduced by using two passwords.

  In the personal authentication method and system of the present invention, it is possible to adopt a configuration in which the personal information recording medium is a card type medium, the authentication information recording medium is a non-card type medium, and the personal information recording medium is a card type medium. A configuration in which the authentication information recording medium is a non-card type medium can be employed. When the personal information recording medium is a card type medium and the authentication information recording medium is a non-card type medium, for example, the personal information recording medium is put in a wallet and the authentication information recording medium is put in a place other than the wallet and carried. Therefore, it is possible to reduce the probability of both of them being stolen at the same time, and to reduce the risk of unauthorized use.

  According to the personal authentication method of the present invention, a computer refers to a storage device that stores conditions that require authentication by authentication information for each user, determines whether authentication by authentication information is necessary, and If it is determined that authentication using authentication information is necessary, a configuration that further includes a step of prompting the user to input authentication information can be employed. Further, the personal authentication system of the present invention refers to a storage device that stores conditions that require authentication using authentication information for each user, and determines whether or not authentication using authentication information is necessary, When the determination unit determines that authentication with authentication information is necessary, a configuration may be employed that further includes a notification unit that prompts the user to input authentication information. For example, when the transaction amount is small due to the setting recorded in the recording device, authentication is performed using the personal information recording medium and the personal identification number. When the transaction amount is large, the personal information recording medium and the authentication information recording medium , And authentication is performed using a password. By doing so, the user does not need to carry the authentication information recording medium when making a small transaction, and does not need to always carry the authentication information recording medium.

  In the personal authentication method and system of the present invention, a personal information recording medium, a personal identification number, and an authentication information recording medium are used for personal authentication. In the present invention, since the personal information recording medium and the authentication information recording medium are separate media, the probability that both of them are stolen at the same time can be lowered, and the risk of unauthorized use can be reduced. Moreover, the operation is not complicated as in the case of using biometrics for personal authentication.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 shows a transaction system including a personal authentication system according to an embodiment of the present invention. The transaction system 10 includes an ATM 11, an authentication server 14, and a transaction server 22. The ATM 11 is connected to the authentication server 14 and the transaction server 22 via the communication line 21. The user can withdraw cash from the account or deposit cash by inserting the cash card 12 into the ATM 11 and performing a predetermined operation.

  The ATM 11 has a cash card reading unit 19 and an authentication medium reading unit 20. The cash card 12 has information for identifying an individual or an account. The cash card reading unit 19 reads information specifying an individual (account) stored in the cash card 12. The authentication medium 13 is issued corresponding to the cash card 12 and has information necessary for authentication. The authentication medium 13 is configured as a storage medium such as an IC card or RFID (Radio Frequency-Identification). The authentication medium reading unit 20 reads authentication information from the authentication medium 13.

  The user makes the cash card reading unit 19 read the cash card 12 and inputs a personal identification number corresponding to the cash card, thereby performing a transaction such as withdrawal. In the present embodiment, in the transaction with the cash card 12, in addition to the input of the personal identification number corresponding to the cash card 12, the authentication medium 13 is used for personal authentication when the ATM 11 is operated.

  The authentication server 14 includes a setting information storage unit 15, an authentication information storage unit 16, a setting determination unit 17, and an authentication unit 18. In using the system, the user sets a transaction amount and transaction content that require authentication by the authentication medium 13. For example, the user can set that authentication by the authentication medium 13 is required when the withdrawal amount exceeds 50,000 yen per day, or when the withdrawal amount exceeds 300,000 yen per month. It can be set that authentication by the authentication medium 13 is required. In addition, it can be set that the operation content requires authentication by the authentication medium 13 for transfer to an account other than a predetermined account such as rent transfer. Such a setting is stored in the setting information storage unit 15 corresponding to the user (account) when, for example, the bank staff operates a dedicated terminal or the user operates the ATM 11. .

  The authentication information storage unit 16 stores a password for authentication using the cash card 12 and authentication information of the authentication medium 13 for each customer. When there is an authentication request from the ATM 11, the setting determination unit 17 refers to the setting information storage unit 15 and determines whether authentication by the authentication medium 13 is necessary. The authentication unit 16 refers to the authentication information storage unit 16 and authenticates the user.

  For example, consider a case where a user makes a withdrawal. When the user inserts the cash card 12 into the cash card reading unit 19, the cash card reading unit 19 reads the user identification information (account identification information) from the cash card 12. When the user operates the ATM 11 and inputs a withdrawal amount, the ATM 11 transmits user identification information and transaction information including the operation type and the withdrawal amount to the transaction server 22.

  When the transaction server 22 receives the user identification information and the transaction information, the transaction server 22 sends an authentication request to the authentication server 14. In the authentication server 14 that has received this request, the setting information determination unit 17 refers to the setting information storage unit 15 to determine whether or not authentication by the authentication medium 13 is necessary when the user makes a withdrawal. to decide. For example, if the setting information storage unit 15 stores a setting indicating that authentication with the authentication medium 13 is required when the withdrawal amount exceeds 50,000 yen, the setting determination unit 17 receives the received transaction. It is determined whether or not the withdrawal amount specified by the user exceeds 50,000 yen based on the information. When determining that the withdrawal amount exceeds 50,000 yen, the setting determination unit 17 determines that authentication by the authentication medium 13 is necessary for the transaction.

  If the setting information storage unit 15 stores a setting indicating that authentication by the authentication medium 13 is necessary when the amount of money to be withdrawn in a month exceeds 300,000 yen, the setting determination unit 17 With reference to the account information storage unit 23 that stores the transaction log and the like, it is determined whether or not the total amount of money withdrawn in a month exceeds 300,000 yen based on the amount of money withdrawn this time. When the setting determination means 17 determines that the total amount of withdrawals per month exceeds 300,000, it determines that the authentication with the authentication medium 13 is necessary for the current transaction.

  When the setting determination means 17 determines that authentication by the authentication medium 13 is not necessary, the ATM 11 prompts the user to input a personal identification number and transmits the personal identification number entered by the user to the authentication server 14. In the authentication server 14, the authentication unit 18 compares the received personal identification number with the user personal identification number stored in the authentication information storage unit 16 and determines whether or not they match. When it is determined that the two match, the authentication means 18 outputs a notification that the authentication has succeeded to the transaction server 22, and when it does not match, the authentication means 18 outputs a notification that the authentication has failed to the transaction server 22. . When the transaction server 22 receives a notification from the authentication means 18 that the authentication is successful, the transaction is established, and the ATM 11 withdraws the amount specified by the user.

  If the setting determination means 17 determines that authentication is required by the authentication medium 13, the ATM 11 prompts the user to input a personal identification number and prompts the user to input authentication information of the authentication medium 13. In this case, the user inputs the personal identification number and inserts the authentication medium 13 into the authentication medium reading unit 20 to read the authentication information in the authentication medium 13. The ATM 11 transmits the input personal identification number and the authentication information read by the authentication medium reading unit 20 to the authentication server 14.

  In the authentication server 14, the authentication unit 18 compares the received personal identification number with the user personal identification number stored in the authentication information storage unit 16 and determines whether or not they match. Further, referring to the authentication information storage unit 16, it is determined whether or not the received authentication information of the authentication medium 13 matches the authentication information of the authentication medium 13 issued corresponding to the user's cash card 12. judge. When it is determined that the passwords match and the authentication information of the authentication medium 13 matches, the authentication means 18 outputs that the authentication has succeeded, and if it does not match, the authentication means 18 notifies that the authentication has failed. Output to the transaction server 22. When the transaction server 22 receives notification from the authentication means 18 that the authentication is successful, the ATM 11 withdraws the specified amount.

  In the present embodiment, for example, when the withdrawal amount exceeds a predetermined amount by the setting of the user or bank staff, authentication by the three points of the cash card 12, the personal identification number, and the authentication medium 13 is performed by the user. To request. In this embodiment, since the cash card 12 and the authentication medium 13 are separate physically separated media, there is a low possibility that both of them will be stolen or lost at the same time. For this reason, by storing the cash card 12 and the authentication medium 13 separately, the user can minimize loss due to unauthorized use of the cash card 12 when the cash card is lost or stolen. Safety can be increased.

  Here, when biometric authentication such as fingerprint authentication is adopted for personal authentication, there is a problem that it is difficult to organize biometric authentication information storage and personal information protection. On the other hand, the authentication information by the authentication medium 13 can be managed in the same way as the personal identification number, and is easy to use compared to the case where it is added to the cash card 12 and biometric authentication is requested. Further, when the authentication medium 13 is lost, it can be issued at low cost and can be operated easily.

  In the above-described embodiment, the ATM 11 is described as an example of a device that performs authentication, but the device is not limited to this. For example, when a safe for lending is operated unattended, an input of a card for identifying a user and a personal identification number may be required at the entrance of the safe and at the entrance to the safe. In such a case, an authentication medium reading unit 20 is installed at the entrance of the safe room, and when entering the safe room, the authentication information of the authentication medium 13 is requested in addition to the user identification card and the password. When the authentication by these three points is successful, the safe room can be entered. A user who can enter the vault opens the individual vault using a physical key. In this way, the security level can be raised when using a safe deposit box.

  As another example of authentication in a safe deposit box, the following can be considered. First, the user inputs a user information identification card and a personal identification number when entering or leaving the safe room. If this authentication is successful, entry into and exit from the vault will be permitted. Next, when the individual safe is opened using the physical key, the authentication medium is read by an authentication medium reader installed in the safe room. When an individual safe is permitted to enter and exit with a user identification card and a personal identification number, and the authentication information of the authentication medium is stored in association with the individual safe to be opened using a physical key Open with a physical key. As described above, when the authentication using the personal identification card and the personal identification number and the authentication medium are performed step by step, the security level can be raised as in the above case.

  In the above embodiment, the ATM 11 prompts the input of the personal identification number and the authentication information of the authentication medium 13 at the same time. However, the present invention is not limited to this. For example, it may be configured such that the input of a personal identification number is first prompted, the authentication of the personal identification number is successful, the input of the transaction amount is prompted, and the authentication using the authentication medium 13 is performed according to the amount. In addition to authentication by the authentication medium 13, an input of another password corresponding to the authentication information may be requested. In this case, the security can be further strengthened by performing authentication with the cash card 12, the password corresponding to the cash card, the authentication medium 13, and the password corresponding to the authentication information. In this case, from the viewpoint of security, it is preferable that the personal identification number corresponding to the cash card is different from the personal identification number corresponding to the authentication information.

  In the above embodiment, an example in which the ATM 11 that requests authentication and the authentication server 14 that performs authentication communicate via the communication line 21 has been described. However, the present invention is not limited thereto, and the ATM 11 functions as the authentication server 14. And a device that requires authentication and a device that performs authentication may be configured integrally. In this case, when the cash card 12 is an IC card, a configuration in which the IC chip of the cash card 12 is substituted for the setting information storage unit 15 is also possible. The example in which the ATM 11 requests authentication by the authentication medium 13 has been shown. In addition to this, in addition to the passbook and the seal, the authentication information of the authentication medium 13 is used in the case of high-value transactions and unusual transactions at the window. An authentication operation may be required. The authentication medium 13 may be a medium that is separate from the cash card 12, and is not limited to a card-type medium. For example, when the authentication medium 13 is a mobile phone strap or key holder, it is not put in the wallet together with the cash card 12, so that the probability of being stolen can be lowered at the same time. Can be further enhanced.

  The conditions that require authentication by the authentication medium 13 are not limited to those described in the above embodiment. For example, the user or bank staff sets the user's living behavior area, and if the withdrawal is made by the ATM 11 outside the living behavior area, the user needs to be authenticated by the authentication medium 13. Can be set. In this case, the authentication server 14 may determine whether or not authentication by the authentication medium 13 is necessary with reference to information on a place where the ATM 11 is stored in advance. In addition, if a user or bank employee has made a withdrawal operation more than a predetermined number of times in a day, the authentication medium 13 is required to authenticate the withdrawal after the predetermined number of times. Can be set. In this case, the authentication server 14 refers to the account information storage unit 23 to obtain the number of times of sunrise and determines whether authentication by the authentication medium 13 is necessary. do it.

  In addition, the ATM 11 can be used in an operation mode that requires authentication by the authentication medium 13 unconditionally. In this case, if the cash card 12 and the authentication medium 13 are not prepared, the ATM 11 cannot be used at all, and the safety becomes stronger.

  As described above, the present invention has been described based on the preferred embodiments. However, the personal authentication system and method of the present invention are not limited to the above embodiments, and various modifications and changes can be made to the configuration of the above embodiments. Changes are also included in the scope of the present invention.

The block diagram which shows the structure of the transaction system containing the personal authentication system of one Embodiment of this invention.

Explanation of symbols

10: Transaction system 11: ATM
12: Cash card 13: Authentication medium 14: Authentication server 15: Setting information storage unit 16: Authentication information storage unit 17: Setting determination unit 18: Authentication unit 19: Cash card reading unit 20: Authentication medium reading unit 21: Communication Line 22: Transaction server 23: Account information storage unit

Claims (10)

A personal authentication method for performing personal authentication using a computer,
The personal identification information read from the personal information recording medium for recording the personal identification information on the computer, the authentication information recorded and read from the authentication information recording medium separate from the personal information recording medium, and the input means A step of inputting a password to be entered;
The computer reads out the authentication information and the password corresponding to the input personal identification information from a storage device that stores the personal identification information, the authentication information, and the password in association with each other, and reads out the read authentication information and the password. And a step of outputting that the authentication is successful when it is determined that the input authentication information and the personal identification number coincide with each other.   The personal identification number input by the input means includes a first personal identification number corresponding to the personal identification information and a second personal identification number corresponding to the authentication information, and the computer includes the first personal identification code and the second personal identification number. The personal authentication method according to claim 1, wherein the personal identification number is determined to match if the personal identification number and the corresponding first personal identification number and the second personal identification number stored in the storage device coincide with each other.   The personal authentication method according to claim 1 or 2, wherein the personal information recording medium is a card-type medium, and the authentication information recording medium is a non-card type medium.   The personal authentication method according to claim 1 or 2, wherein each of the personal information recording medium and the authentication information recording medium is a card-type medium.   The computer refers to a storage device that stores conditions that require authentication for each user and determines whether authentication by authentication information is necessary, and authentication by authentication information is necessary for the determination. The personal authentication method according to any one of claims 1 to 4, further comprising a step of prompting the user to input authentication information when the determination is made. Personal information reading means for reading the personal identification information from a personal information recording medium for storing the personal identification information;
Authentication information reading means for storing authentication information and reading the authentication information from an authentication information recording medium separate from the personal information recording medium;
An input means for inputting a personal identification number;
When the personal identification information, the authentication information, and the password are received, from the storage device that stores the personal identification information, the authentication information, and the password in association with each other, the authentication information corresponding to the input personal identification information and A reading means for reading out the personal identification number;
A personal authentication system comprising: output means for outputting that the authentication is successful when the authentication information and password read by the reading means match the input authentication information and password.   The password input by the input means includes a first password corresponding to the personal identification information and a second password corresponding to the authentication information, and the notification means includes the first password and the second password. The personal authentication system according to claim 6, wherein the personal identification number is determined to match if the personal identification number and the corresponding first personal identification number and the second personal identification number stored in the storage device respectively match.   The personal authentication system according to claim 6 or 7, wherein the personal information recording medium is a card-type medium and the authentication information recording medium is a non-card type medium.   The personal authentication method according to claim 6 or 7, wherein each of the personal information recording medium and the authentication information recording medium is a card-type medium.   A determination unit that determines whether or not authentication by authentication information is necessary with reference to a storage device that stores conditions that require authentication by authentication information for each user, and the determination unit requires authentication by authentication information. The personal authentication system according to any one of claims 6 to 9, further comprising notification means for prompting the user to input authentication information when it is determined that there is.

Images