JP2007108908A - Remote banking system and remote banking method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a remote banking system for achieving full-scale multi-banking transaction for the remote banking using an IP network for which dedicate software or an expensive MODEM is not required. <P>SOLUTION: This remote banking system is provided with a terminal 11; a platform device 30 connected through the Internet 20 to the terminal 11; and a plurality of financial systems 51 connected through a private line 40 to the platform device 30. The terminal 11 transmits the identification of content to be used and an account number and a telephone number and a certificate through the Internet 20 to a platform server 31 of the platform device 30. The platform server 31 performs authentication based on the received certificate. When there is not any problem in the authentication result, an existing remote banking system 32 transmits the received account number and telephone number through the private line 40 to a financial system 51. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a remote banking system and a remote banking method capable of performing multi-bank transactions via the Internet or an IP (Internet Protocol) network.

Conventionally, in ANSER-SPC (registered trademark) and HT used as a remote channel of a financial institution, an ANSER (registered trademark) system connected to a user terminal via a public line network mediates the connection with the financial institution. Then, the ANSER system receives the caller telephone number from the exchange of the first type communication carrier and sends it to the financial institution to improve the security (for example, see Non-Patent Document 1). On the other hand, with the spread of IP (Internet Protocol) networks such as the Internet, Internet banking has been used as an inexpensive remote channel that does not require dedicated software or an expensive modem. It has also rapidly expanded to small and medium-sized businesses and SOHO (Small Office Home Office) classes. In this Internet banking, an authentication method using an electronic certificate issued by a financial institution is adopted in order to improve security.
“Start“ ANSER-SPC Area One TM ”service”, [online], July 6, 2000, NTT DATA Corporation, [October 6, 2005 search], Internet <URL: http: / /www.nttdata.co.jp/release/2000/07061.html>

  However, ANSER-SPC and HT require dedicated software and expensive modems, and there is a problem that it is too expensive for SMEs and SOHO classes. In conventional Internet banking, since electronic certificates are issued by financial institutions, multi-bank transactions that use multiple financial institutions require that electronic certificates be changed for each financial institution. There is a problem that multi-bank transactions are not possible.

  The present invention has been made in view of such circumstances, and its purpose is to enable remote multi-bank transactions in remote banking using an IP network that does not require dedicated software or expensive modems. To provide a banking system.

  The present invention has been made to solve the above-described problems. The invention according to claim 1 is directed to a terminal owned by a user, a platform device connected to the terminal through a communication network, and communication with the platform device. A remote banking system comprising a plurality of financial institution systems connected by a road and providing services, wherein the terminal has one certificate of the user who owns the terminal, a plurality of user related information, and each user related A storage area for storing user authentication information associated with the information, a service used by the user, input means for specifying user-related information from the storage area, and a service specified by the input means. Identification, user-related information, user authentication information associated with the user-related information, and a certificate stored in the storage area, Receiving means for receiving service identification, user-related information, user authentication information and a certificate transmitted by the transmission means of the terminal. Means, authentication means for performing authentication based on the received certificate, and identification of the received service, user-related information, and user authentication information if there is no problem in the authentication result in the authentication means, the financial institution system And a relay means for transmitting to the remote banking system.

  The invention described in claim 2 is the remote banking system according to claim 1, wherein the platform device stores a certificate management area storing validity / revocation of each certificate and identification of each certificate. An authentication information management area for storing a combination of user authentication information and a service management area for storing a combination of identification of each certificate and available service, and that the received certificate is valid. Confirming that a combination of certificate checking means for checking with reference to the inter-certificate area and the received user authentication information and identification of the received certificate is stored in the authentication information management area A service for confirming that a combination of the authentication information confirmation means for performing the received service identification and the received certificate identification is stored in the service management area Characterized in that it comprises a certification means.

  The invention described in claim 3 is the remote banking system according to claim 1 or 2, wherein the platform device includes a certificate authority server that issues the certificate.

  The invention according to claim 4 is the remote banking system according to any one of claims 1 to 3, wherein the communication network is an IP (Internet Protocol) network. To do.

  The invention according to claim 5 is a terminal owned by a user, a platform device connected to the terminal via a communication network, and a plurality of financial institution systems that provide services by being connected to the platform device via a communication path. In the remote banking system, the terminal stores user-related information specified by a user and service identification, user authentication information stored in the terminal in association with the user-related information, and stored in the terminal. A first process of transmitting a certificate to the platform apparatus via the communication network, a service identification, user-related information, user authentication information, and certificate transmitted from the terminal by the platform apparatus, And the platform device performs authentication based on the received certificate. When there is no problem in the authentication result in the third process and the third process, the platform device transmits the received service identification, user-related information, and user authentication information to the financial institution system. 4 is a remote banking method.

According to the present invention, the platform device issues a certificate, and after the platform device authenticates the transaction request from the terminal based on the certificate, the certificate is transmitted to each financial institution system. Multi-bank transactions are possible.
Further, according to the present invention, it is possible to eliminate the need for dedicated software or an expensive modem by using an IP network as a communication network for connecting a terminal and a platform device.

  Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a schematic block diagram showing the configuration of a remote banking system according to an embodiment of the present invention. Reference numeral 10 denotes a user who uses the remote banking system, and includes a terminal 11 that stores the certificate of the user 10 and a private key Kp. Reference numeral 20 denotes the Internet, which connects the user 10 and the platform device 30. The platform device 30 is a device that provides the user 10 with a remote banking environment of a plurality of financial institutions, and includes a platform server 31, an existing remote banking system 32, a management server 33, and a certificate authority server 34. The platform server 31 receives a message from the terminal 11 via the Internet 20 and authenticates it. The existing remote banking system 32 provides a remote banking service of the financial system 51 using a public telephone line or the like as a communication line with a user, and improves security by receiving a caller telephone number from an exchange. It is. In this embodiment, a message is received from the platform server 31, converted into the same format as the conventional system, and transmitted to the financial system 51. The management server 33 stores the registration contents of each user 10 for the remote banking service.

  The certificate authority server 34 is a so-called PKI (Public Key Infrastructure) certificate authority, and issues a certificate of the user 10. This certificate authority server 34 stores an RA (Registration Authority) 35 for authenticating the other party at the time of issuing a certificate, a secret key Kcp of the certificate authority server 34, and issues an IA (Issuring Authority) 36, RA35 for issuing a certificate. It consists of a certificate issuance management DB 37 that stores authentication information for authentication. Reference numeral 40 denotes a dedicated line, which is a communication line that connects the platform device 30 and each financial institution 50 on a one-to-one basis. The financial institution 50 is a financial institution that provides a remote banking service to the user 10, and each financial institution includes a financial system 51 and an operation terminal 52. The financial system 51 is a system that has conventionally provided a remote banking service via the existing remote banking system 32, and uses a caller telephone number received from the existing remote banking system 32 for user authentication. The operation terminal 52 is a device for registering information of the user 10 who applied for registration of the remote banking service with the financial institution 50.

  Next, the operation of this remote banking system will be described. In order to use the service of this remote banking system, the user 10 first needs to register for the service and obtain a certificate. A sequence from registration application of the user 10 to acquisition of the certificate is shown in FIG. First, the user 10 makes an application for remote banking registration in writing to the financial institution 50 (S10). By this registration application, as name, address, telephone number, account number, and contents to be used, for example, “Company A, XX city XX town, 06-1111-6666, 0001-123-123456, contents 1 and contents 2 Is notified to the financial institution 50. The contents here correspond to the detailed items of the remote banking service. The financial institution 50 registers the combination of the account number “0001-123-123456” and the telephone number “06-1111-6666” in the financial system 51, the name “Company A”, the address “○ × city ○ × town”, The content “content 1 / content 2” to be used is input to the operation terminal 52. When these pieces of information are input, the operation terminal 52 transmits these pieces of information to the RA 35 of the platform device 30 via the dedicated line 40 (S11).

  Upon receipt of these pieces of information, the RA 35 issues, for example, “ABC001, 1234567, AAA, XYZ” as a user ID, certificate ID, certificate acquisition ID, and one-time password, and issues a certificate together with the received information. Information is registered in the management DB 37 (S12), and the user ID “ABC001” and the certificate ID “1234567” are also notified to the operation terminal 52 (S13). When the operation terminal 52 receives the user ID “ABC001” and the certificate ID “1234567”, the operation terminal 52 receives them together with the previously input telephone number “06-1111-6666” and the content “content 1 / content 2” to be used. And sent to the management server 33 and registered in the certificate management table (FIG. 4), telephone number management table (FIG. 5), and content management table (FIG. 7) in the management server 33.

  On the other hand, the RA 35 creates a document that describes the connection destination URL that is the URL of the RA 35 together with the previously issued certificate acquisition ID “AAA” and the one-time password “XYZ”. The financial institution 50 mails the document to the user 10 (S15). Upon receiving the document, the user 10 uses the terminal 11 to access the connection destination URL described in the document via the Internet 20 and inputs the certificate acquisition ID “AAA” and the one-time password “XYZ”. . Since the connection destination URL is RA35, the terminal 11 transmits the certificate acquisition ID “AAA” and the one-time password “XYZ” input previously to the RA35 via the Internet 20 as a certificate acquisition request ( S16). When the RA 35 receives the certificate acquisition ID “AAA” and the one-time password “XYZ”, the RA 35 authenticates the user 10 by confirming whether there is a combination that matches the certificate issuance management DB 37 (S17).

  When the matching combination is confirmed, the RA 35 obtains the certificate ID “1234567” registered with the combination in the certificate issuance management DB 37, and requests the IA 36 to issue a certificate with the ID (S18). . Upon receiving the certificate issuance request, the IA 36 issues the certificate describing the certificate ID “1234567” and the public key of the user 10 and the private key Kp of the user 10 and notifies the RA 35 (S19). ). Upon receipt of the certificate and private key Kp, the RA 35 transmits it to the terminal 11 of the user 10 via the Internet 20 (S20). Upon receiving the certificate and the private key Kp, the terminal 11 stores it in its own device.

  When the remote banking service of a plurality of financial institutions is used, the certificate authority server 34 issues a certificate (sequence S15 and later) only when applying to the first financial institution 50, and the second and subsequent financial institutions. When applying to, only registration of a combination of a telephone number and an account number to the financial system and registration of a telephone number and contents to be used to the management server 33 are performed.

  Next, the operation when the user 10 uses the terminal 11 and uses the remote banking service will be described with reference to FIG. Prior to using the service, the user 10 registers in advance in the terminal 11 the account number and the telephone number described in writing in association with the registration for the service. Here, the account number is user-related information, and the telephone number is user authentication information. When applying to a plurality of financial institutions, the combination of the account number and telephone number registered in each financial institution is registered. Next, the user 10 specifies the content to be used and the account number for the terminal 11. Here, it is assumed that the content “content 1” and the account number “0001-123-123456” previously given as an example at the time of service registration are designated. When the content to be used and the account number are specified, the terminal 11 is registered with the account number “0001-123-123456” in its own device (here, “06-1111-6666”). )), And the phone number “06-1111-6666”, the designated content “content 1” and the account number “0001-123-123456” are stored in the own device at the time of the previous service registration. The certificate with the certificate ID “1234567” and the software ID (for example, “OBX01”), which is the identification of the software operating on the own device, are set in a message, and in the same device as the certificate The electronic message is signed with the stored secret key Kp and transmitted to the platform server 31 of the platform device 30 via the Internet 20 (Sa1). 0).

  Upon receiving the message, the platform server 31 verifies the validity of the certificate included in the message with the public key of the certificate authority, and further describes the validity of the signature attached to the message. Verification is performed using the public key of the user 10 (Sa101). If there is no problem in the verification result, the platform server 31 recognizes that the message is a message transmitted from the user who issued the certificate, and performs the subsequent processing. The platform server 31 refers to the certificate management table (FIG. 4) of the management server 33 and confirms that the certificate ID “1234567” of the certificate in the message is valid, and supports the certificate ID. The user ID “ABC001” is acquired. Next, referring to the telephone number management table (FIG. 5), it is confirmed that the telephone number “06-1111-6666” described in the message is associated with the previously acquired user ID “ABC001”. The vendor management table is checked to confirm that the software ID “OBX01” described in the message exists in the vendor management table, and the content “content 1” described in the message is referred to by referring to the content management table. It is confirmed that the user is permitted to use (Sa102). When these confirmations are finished, the platform server 31 notifies the existing banking system 32 of the account number “0001-123-123456”, the telephone number “06-1111-6666”, and the content “content 1” in the message.

  In the existing banking system 32, an account number “0001-123-123456” which is user-related information in the conventional system and content “content 1” which is service request information are set in a conventional system using a conventional public telephone line. The request message is received, and this is processed in the same manner as the telephone number “06-1111-6666” as the user authentication information is received from the exchange at this time. In other words, a user who has an account number “0001-123-123456” and a telephone number “06-1111-6666” is converted into a message requesting the service of the content “content 1”, and this message is financially transmitted through the dedicated line 40. It transmits to the financial system 51 of the institution 50 (Sa103). When the financial system 51 receives this message, the account number and the telephone number in the message are matched with the combination of the account number and the phone number stored in its own device after the above-described sequence S10. After confirming this, the service of the content “content 1” is executed (Sa104).

  As shown in FIG. 8, not all financial institutions issue and authenticate certificates, but all financial institutions established by a platform operator operating a platform device while each financial institution is an authentication service provider for users. Multi-bank transactions are realized with one certificate by using an authentication model that uses a single authentication system to issue and authenticate certificates based on certificate policies and certificate operation rules common to institutions. .

In addition, since authentication independent of the network type is possible, the access line between the user 10 and the platform device 30 can be accessed in various forms as well as the conventional dial-up. For example, access from a terminal on an in-house network of a user company is also possible. As a result, the data linkage with the in-house system can be expanded, and media and human intervention can be eliminated, so that total security enhancement can be realized.
Moreover, since the message transmitted from the existing remote banking system 32 to the financial system 51 has the same format as the conventional system, the financial system 51 does not need to be changed as it is in the conventional system.
Furthermore, as the access line of the terminal 11 to the Internet 20, a high-speed line having an Mbps band such as an optical fiber or an ADSL (Asymmetric Digital Subscriber Line) can be used, so that a large amount of data can be transmitted in a short time. It becomes possible.
In the present embodiment, when a user makes a registration application for remote banking, a telephone number is notified. However, the user notifies an arbitrary number of a specific number of digits (for example, 10 digits), It may be used instead of a telephone number. In addition, when a user makes an application for remote banking registration, an arbitrary number having a specific number of digits can be given to the user and used instead of a telephone number.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design and the like within a scope not departing from the gist of the present invention.

  The present invention is suitable for use in a remote banking system that provides a user with a remote banking service that allows multi-bank transactions via the Internet, an IP network, or the like that cannot acquire caller information from the network.

It is a block diagram which shows the structure of the remote banking system by one Embodiment of this invention. It is a sequence diagram explaining operation | movement of the registration application and certificate issuing in the embodiment. It is a flowchart explaining the operation | movement of service implementation in the same embodiment. It is an example of the content of the certificate management table of the management server 33 in the embodiment. It is an example of the content of the telephone number management table of the management server 33 in the embodiment. It is an example of the content of the vendor management table of the management server 33 in the embodiment. It is an example of the content of the content management table of the management server 33 in the embodiment. It is a figure explaining the authentication model in the embodiment.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... User 11 ... Terminal 20 ... Internet 30 ... Platform apparatus 31 ... Platform server 32 ... Existing remote banking system 33 ... Management server 34 ... Certification authority server 35 ... RA
36 ... IA
37 ... Certificate issuance management DB
40 ... dedicated line 50 ... financial institution 51 ... financial system

Claims (5)

A remote banking system comprising a terminal owned by a user, a platform device connected to the terminal via a communication network, and a plurality of financial institution systems connected to the platform device via a communication path and providing services,
The terminal
A storage area for storing one certificate of the user who owns the terminal, a plurality of user related information and user authentication information associated with each user related information;
An input means for a user to specify a service to be used and user-related information from the storage area;
Identification of the service designated by the input means, user related information, user authentication information associated with the user related information, and a certificate stored in the storage area are transmitted via the communication network. Transmission means for transmitting to the platform device,
The platform device is:
Receiving means for receiving the service identification, user-related information, user authentication information and certificate transmitted by the transmitting means of the terminal;
Authentication means for performing authentication based on the received certificate;
If there is no problem in the authentication result in the authentication means, the remote banking system comprises: relay means for transmitting the received service identification, user-related information, and user authentication information to the financial institution system. The platform device is:
A certificate management area for storing validity / revocation of each certificate;
An authentication information management area for storing a combination of identification of each certificate and user authentication information;
A service management area for storing a combination of identification of each certificate and identification of available services;
Certificate confirmation means for confirming that the received certificate is valid with reference to the inter-certificate area;
Authentication information confirmation means for confirming that a combination of the received user authentication information and the received certificate identification is stored in the authentication information management area;
2. The remote according to claim 1, further comprising: service confirmation means for confirming that a combination of the received service identification and the received certificate identification is stored in the service management area. Banking system.   The remote banking system according to claim 1, wherein the platform device includes a certificate authority server that issues the certificate.   The remote banking system according to any one of claims 1 to 3, wherein the communication network is an IP (Internet Protocol) network. In a remote banking system comprising a terminal owned by a user, a platform device connected to the terminal via a communication network, and a plurality of financial institution systems connected to the platform device via a communication path and providing services,
The terminal includes user-related information specified by the user and service identification, user authentication information stored in the terminal in association with the user-related information, and a certificate stored in the terminal. A first step of transmitting to the platform device via the communication network;
A second process in which the platform device receives service identification, user-related information, user authentication information, and a certificate transmitted by the terminal;
A third process in which the platform device performs authentication based on the received certificate;
When there is no problem in the authentication result in the third process, the platform apparatus transmits a received service identification, user-related information, and user authentication information to the financial institution system. A remote banking method characterized by comprising:

Images