JP2007317095A - Authentication system of automatic transaction apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system of an automatic transaction apparatus, in a simple configuration, authenticating a user by means of a one-time password. <P>SOLUTION: The authentication system of the automatic transaction apparatus has a card reader 210 for reading information stored on a transaction card; a money dispenser 220 for handling deposit and withdrawal of cash; a display device 200 for displaying transaction information; an input device 200 operated by the user; and a controller 230 for controlling the devices. A pass key created by the controller is displayed in the display device and the input of a one-time password created by a mobile terminal 30 according to a predetermined algorithm based on the displayed pass key and an ID number is accepted. An ID number created when the controller decodes the accepted one-time password according to the predetermined algorithm is compared with the ID number stored in the automatic transaction device, so as to authenticate the user. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an authentication system for an automatic transaction apparatus, and more particularly, to an authentication system for an automatic transaction apparatus that can authenticate a user using a one-time password.

  As a personal authentication method in an automatic transaction apparatus, a method using a personal identification number known only to the principal has been generally used. In order to improve safety, a method using a one-time password is also considered. The method using a one-time password is a method in which a different password (one-time password) is calculated each time based on information shared by the authenticating side, and authentication is performed by comparing the results.

When this method is used, it is also necessary for the authenticating side to know the one-time password used by the authenticated side. For this purpose, a method of synchronizing both times and generating the same one-time password from the synchronized time information (Patent Document 1), or the one that authenticates the one-time password generated by the authenticating system via the network A method (Patent Document 2) obtained and used in the above is known.
JP 2002-259344 A JP 2005-182129 A

  In the method of directly inputting the code number using the code number as described above, the code number is concealed because it is viewed from behind, the code number is estimated from the movement of the hand, or the position of the code number input device is fixed. There is a risk that the security code will be stolen by shooting with the camera.

  On the other hand, in the one-time password method using the password generated based on the time information of the authenticating side and the side to be authenticated, it is necessary that the time of the system on the side to be authenticated is synchronized with the system on the side to be authenticated. is there.

  However, when a mobile terminal is used as a token (one-time password generator), the time of the mobile terminal itself often deviates from the correct time. In such a case, it is not possible to synchronize the authentication side. Note that if the time is to be managed separately from the time information of the mobile terminal itself, it becomes necessary to add a dedicated function to the mobile terminal, which is not general purpose.

  In the method of acquiring the one-time password via the network, it is necessary to be connected to the network before the transaction. For this reason, when the place where the transaction is to be made is in a place where the radio wave condition is bad, such as in a building or underground, it is necessary to re-operate after having returned to a place where the radio wave condition is good. Furthermore, in places where the radio wave conditions are poor such as in mountainous areas, it is difficult to use the service itself.

  The present invention has been made in view of these problems, and provides an authentication system for an automatic transaction apparatus that can authenticate a user using a one-time password with a simple configuration.

  In order to solve the above problems, the present invention employs the following means.

  A card reading device for reading information stored in a transaction card, a deposit / withdrawal device for handling cash deposit / withdrawal, a display device for displaying transaction information, an input device operated by a user, and a control device for controlling each of these devices An automatic transaction apparatus authentication system comprising: a pass key generated by the control device displayed on the display device; and a mobile terminal side according to a predetermined algorithm based on the displayed pass key and password. The input of the generated one-time password is accepted, and the password generated by the control device decrypting the received one-time password according to a predetermined algorithm is compared with the password stored in the automatic transaction device side. To authenticate the user.

  Since the present invention has the above configuration, a user can be easily authenticated using a one-time password.

  Hereinafter, the best embodiment will be described with reference to the accompanying drawings. FIG. 1 is a diagram for explaining an authentication system for an automatic transaction apparatus. As shown in the figure, the automatic transaction apparatus 20 is connected to the host 10 via a network 40. Moreover, the portable terminal 30 which the user of the automatic transaction apparatus 20 operates is connected with the host 10 via the network 40, for example.

FIG. 2 is a diagram illustrating details of the host 10. The host 10 includes an arithmetic processing unit 100 that controls the entire apparatus, a storage device 110 that is managed by the arithmetic processing unit 100, a transmission control unit 120, and a database 130. The storage device 110 stores an account information management service program 111, a password calculation program 112, a net banking service program 114, and the like. The password calculation program 112 generates a password from a one-time password, which will be described later, or generates a one-time password from a password, a passkey, and the like. The transmission control unit 120 performs automatic transaction via the network 40. The device 20 and the mobile terminal 30 are connected. The database 130 stores an account number, a password, and key information (the reason for using the key information will be described later) as the account information 131. In this way, the host 10 provides an account information management service to the automatic transaction apparatus 20 via the network 40 and provides a net banking service to the portable terminal 30.

  FIG. 3 is a diagram for explaining the details of the automatic transaction apparatus 20. The automatic transaction apparatus 20 includes a display input apparatus 200 for displaying information to the user or receiving input from the user, a card reading apparatus 210 for reading a transaction card such as a bank cash card, and a deposit / withdrawal apparatus for depositing / withdrawing money. 220 and a control unit 230 for controlling them.

  The control unit 230 includes an arithmetic device 240, a storage device 250, and a transmission control device 260. The automatic transaction apparatus 20 is connected to the host 10 via the transmission control apparatus 260 and the network 40, and can receive an account information management service.

  FIG. 4 is a diagram for explaining the details of the mobile terminal 30. The mobile terminal 30 includes a display unit 300 that displays information to the user, an input unit 310 that receives user input, a call unit 320 that processes a call function, an arithmetic processing unit 330, a storage device 340, and a transmission control unit 350. . The portable terminal 30 is connected to the host 10 via the transmission control unit 350 and the network 40, and can receive a net banking service.

  As described above, the host 10 stores the one-time password calculation program 112 in the built-in storage device 110. In addition, the portable terminal 30 incorporates a one-time password generation program 341 that generates a one-time password from a personal identification number and a pass key in a built-in storage device 340. For this reason, authentication can be realized by making the authentication password calculation algorithms (113, 342) included in the one-time password generation programs 112, 341 correspond to each other. The mechanism is described in detail below.

  Note that the portable terminal 30 supports application download via a network. Therefore, the user can download the one-time password generation program 341 from the mobile terminal 30 by accessing, for example, net banking of a financial institution. A user can obtain a one-time password by inputting his / her personal identification number and a pass code, which will be described later, displayed on the automatic transaction apparatus 20 into the one-time password generation program 341 during the transaction.

  5 and 6 are diagrams illustrating the first embodiment. Here, an example will be described in which a reversible encryption method (a method in which a personal identification number can be restored from a one-time password) is adopted as the authentication password calculation algorithm (113, 342). First, prior to conducting a transaction with the automatic transaction apparatus, a one-time password generation program is downloaded to the portable terminal.

  FIG. 5 shows processing when the one-time password generation program 341 is downloaded from the host 10 to the portable terminal 30. First, the user uses the mobile terminal 30 to access the mobile banking site provided by the host 10 and displays the mobile banking login screen 500 on the display screen of the mobile terminal 30. In this state, the user inputs the user ID and the personal identification number, or operates the terminal according to the authentication method at the time of mobile banking login defined by the financial institution, and authenticates the user and logs in.

  When logging in, a mobile banking transaction selection screen 501 is displayed on the mobile terminal 30. The user selects “Program Download” on the screen. Download is started by this selection. At this time, a mobile banking download screen 502 is displayed on the mobile terminal 30 and the one-time password generation program 341 is downloaded. At this time, the host 10 generates a different set of key information for each account, and causes the mobile terminal 30 to download the generated key information together with the one-time password generation program 341.

  The portable terminal 30 stores the downloaded key information as key information 343 in the storage device 340. On the other hand, the host 10 retrieves the user account information 131 from the database 130 and stores the generated key information as the key information 133.

  The downloaded one-time password generation program 341 includes an authentication password calculation algorithm 342 for performing reversible encryption method encryption processing using the key information. On the other hand, the password calculation program 112 of the host 10 incorporates an authentication password calculation algorithm 113 for decrypting a password (one-time password) generated by encryption processing using the reversible encryption method using the key information. To do.

  It should be noted that the one-time password generation program 341 may be incorporated in advance in the portable terminal, or the one-time password generation program 341 may be downloaded without the user authentication, and the user authentication may be performed at the initial startup of the tool. In this case, the portable terminal 30 downloads the key information after the authentication of the person is completed and stores it as the key information 343. Note that the key information 133 and 343 can have different values or the same value.

  FIG. 6 is a diagram for explaining processing for performing a withdrawal transaction using the automatic transaction apparatus. First, the user activates the downloaded one-time password generation program 341 and displays the authentication information input screen 600 on the mobile terminal 30. Next, the display input screen screen of the automatic transaction apparatus 20 is operated, for example, “withdrawal” is selected as the type of transaction, and a transaction card is inserted. Then, the display input screen of the automatic transaction apparatus 20 transitions to the password input screen 701. On this screen, a passkey 750 generated by the automatic transaction apparatus 20 is displayed. This passkey 750 is a character string that changes for each transaction. In the present invention, this character string is one of the keys for generating a password for personal authentication, and is referred to here as a pass key for convenience.

  Next, the user operates the portable terminal to input the password 650 and pass key 750 on the authentication information input screen 600 (the password may be input in advance). The downloaded one-time password generation program 341 uses the key information 133 and the authentication password calculation function 342 to generate the one-time password 651 from the personal identification number 650 and the passkey 750, and the generated one-time password 651 is displayed in the password display screen 601. To display. The user inputs the displayed one-time password 651 on the password input screen 701 of the automatic transaction apparatus.

  The automatic transaction apparatus 20 transmits the input one-time password 651 and the card information 751 read from the transaction card by the card reader 210 to the host 10. The host 10 retrieves the account information 131 based on the received card information 751 to obtain the personal identification number 132 and the key information 133. The host 10 decrypts the one-time password 651 by the authentication password calculation algorithm 113 using the acquired key information, and obtains the personal identification number A00. The personal identification number A00 and the personal identification number 132 obtained by searching the account number are compared. If they are equal, the authentication is successful. The host 10 transmits this authentication result A01 to the automatic transaction apparatus 20.

  According to the authentication result, the automatic transaction apparatus 20 changes the screen to the withdrawal screen 203 if the authentication is successful, and the user can perform a withdrawal transaction. If authentication fails, processing such as displaying a message prompting the user to re-enter the password is performed.

  Next, a second embodiment will be described. Here, an example in which an irreversible encryption method is employed as the authentication password calculation algorithm (113, 342) will be described.

  First, as in the first embodiment, a one-time password generation program is downloaded to a mobile terminal prior to performing a transaction using an automatic transaction apparatus.

  At this time, the host 10 prepares key information used for encryption of the irreversible encryption method, and downloads it together with the one-time password generation program 341. This key information is different for each account. The portable terminal 20 stores this key information as key information 343 in the storage device 340. On the other hand, the host 10 searches the database 130 for the account information 131 corresponding to the user, and stores the key information as the key information 133.

  The one-time password generation program 341 includes an authentication password calculation algorithm 342 that performs an irreversible encryption method using the key information. On the other hand, the password calculation program 112 of the host 10 also incorporates an authentication password calculation algorithm 113 that performs encryption processing of an irreversible encryption method using the key information. The authentication password calculation algorithm 342 and the authentication password calculation algorithm 113 output the same result when the same data is encrypted using the same key information.

  Even if the one-time password generation program 341 is installed in advance in the mobile terminal, or the one-time password generation program 341 is allowed to be downloaded without the user authentication, and the user authentication is performed at the initial startup of the tool. Good. In this case, after the personal authentication is completed, the mobile terminal 30 downloads key information used for encryption using the irreversible encryption method.

  FIG. 7 is a diagram for explaining the second embodiment. Here, a process of performing a withdrawal transaction using an automatic transaction apparatus will be described. First, the user activates the one-time password generation program 341 of the mobile terminal 30 to display the authentication information input screen 800. The user operates the transaction selection screen 900 displayed on the display input screen of the automatic transaction apparatus 20 to select “withdrawal” and insert a transaction card. Then, the screen of the automatic transaction apparatus 20 transitions to a password input screen 901. On this screen, a pass key 950 generated by the automatic transaction apparatus 20 is displayed.

  Next, the user inputs the personal identification number 850 and the pass key 950 on the authentication information input screen 800 of the portable terminal. The one-time password generation program 341 uses the key information 343 and the authentication password calculation function 342 to generate the one-time password 851 from the personal identification number 850 and the passkey 950, and displays the generated one-time password 851 on the password display screen 801. . The user inputs the displayed one-time password 651 on the password input screen 901 of the automatic transaction apparatus.

  The automatic transaction apparatus 20 transmits the input one-time password 851, the card information 951 read from the transaction card by the card reader 210, and the pass key 950 to the host 10. The host 10 retrieves the account information 131 based on the received card information 751 to obtain the personal identification number 132 and the key information 133. The host 10 uses the acquired key information 133 and the authentication password calculation algorithm 113 to decrypt the password 132 and the passkey 950 to obtain a one-time password B00.

  Here, the authentication password calculation algorithm 342 included in the one-time password generation program 341 of the portable terminal 30 and the authentication password calculation algorithm 113 included in the password calculation program 112 of the host 10 encrypt the same data using the same key information. The output results are set to be equal. Therefore, the host 10 compares the password B00 and the one-time password 851, and if the comparison results match, the personal identification number 850 and the personal identification number 132 that are the computation targets of the respective computation algorithms are equal. Certify. If they do not match, authentication is not performed. This authentication result B01 is transmitted to the automatic transaction apparatus 20.

  If the authentication result is an authentication success, the automatic transaction apparatus 20 changes the display screen to the withdrawal screen 203, and the user can perform a withdrawal transaction. If authentication fails, processing such as displaying a message prompting the user to re-enter the password is performed.

  The key information (133, 343) is provided for each account for the following reason. That is, when the key information is not used, even if the one-time password generation program 341 of another person's portable terminal is used, the same password can be obtained when the password is equal to the pass code.

  For this reason, when a passcode and a one-time password are stolen by a third party, the one-time password generation program 341 in the portable terminal other than the authorized user is set to a fixed passcode as shown in FIG. If the generated one-time password matches the stolen password, the password entered at that time will be recognized as the personal password. The reason for having the key information (133, 343) for each account is to prevent the personal identification number from being known in this way using a mobile phone other than the user.

  In the above example, the pass key (850, 950) is generated by the automatic transaction apparatus 20, but it may be generated by the host 10 and transmitted to the automatic transaction apparatus 20 for display.

  As described above, in the present invention, a portable terminal incorporating a tool having a password generation function is used. In addition, when authenticating by the automatic transaction apparatus, a different pass key (character string) is displayed for each transaction on the screen of the automatic transaction apparatus. The user enters the displayed passkey into a mobile phone having a password generation function. The mobile phone generates and displays a one-time password based on the passkey. The user inputs the displayed one-time password into the automatic transaction apparatus, and the automatic transaction apparatus performs authentication based on the input password.

A one-time password generated based on a different passkey each time is different. For this reason, even if a password used for a certain transaction is stolen, it cannot be used for the next transaction, so safety can be secured. Thus, since the present invention uses a one-time password method, when entering a PIN The risk of the security code being stolen can be avoided. Further, since the one-time password is generated based on the character string displayed on the transaction apparatus, it is not necessary to synchronize the authenticating system as in the time-synchronized one-time password method. In addition, the mobile terminal that generates the one-time password to be used needs to be connected to the network only when acquiring a tool for generating the one-time password prior to the transaction. For this reason, it is not necessary to be connected to the network when a transaction is desired as in the method of acquiring a one-time password via the network. Although the user needs to input his / her personal identification number or the like to the mobile terminal 30 at the time of transaction, the mobile terminal is more mobile than input to a pin pad or touch panel with a fixed position and a certain size. Since the display screen is high and the display screen is small, the danger of looking into the screen or shooting with a hidden camera can be significantly reduced.

It is a figure explaining the authentication system of an automatic transaction apparatus. It is a figure explaining the detail of a host. It is a figure explaining the detail of an automatic transaction apparatus. It is a figure explaining the detail of a portable terminal. It is a figure explaining 1st Embodiment. It is a figure explaining 1st Embodiment. It is a figure explaining 2nd Embodiment. It is a figure explaining the identification method of a PIN code.

Explanation of symbols

10 Host 20 Automatic Transaction Device 30 Mobile Terminal 40 Network 100 Operation Processing Unit 110 Storage Device 111 Account Information Management Service Program 112 Password Operation Program 113 Authentication Password Operation Algorithm 114 Net Banking Service Program 120 Transmission Control Unit 130 Database 131 Account Information 132 Security Code 133 Key information 200 Display input device 210 Card reader 220 Deposit / withdrawal device 230 Control unit 240 Arithmetic processing device 250 Storage device 260 Transmission control device 300 Display unit 310 Input unit 320 Calling unit 330 Arithmetic processing unit 340 Storage device 341 One-time password generation Program 342 Authentication password calculation algorithm 343 Key information 350 Transmission control unit

Claims (5)

A card reading device for reading information stored in a transaction card, a deposit / withdrawal device for handling cash deposit / withdrawal, a display device for displaying transaction information, an input device operated by a user, and a control device for controlling each of these devices An automatic transaction device authentication system provided,
Displaying the passkey generated by the control device on the display device;
Accepting the input of a one-time password generated on the mobile terminal side according to a predetermined algorithm based on the displayed passkey and password,
The authentication is performed by comparing the personal identification number generated by the control device decrypting the received one-time password according to a predetermined algorithm and the personal identification number stored on the automatic transaction device side. Authentication system for automatic transaction equipment. A card reader for reading information stored in a transaction card;
A deposit and withdrawal device that handles cash deposits and withdrawals;
A display device for displaying transaction information;
An input device operated by the user;
It has a control device that controls each of these devices,
Displaying the passkey generated by the control device on the display device;
An automatic transaction apparatus for authenticating a user by comparing a personal identification number acquired based on card information read by the card reader and a personal identification number generated by decrypting a one-time password input via the input device When,
An input device for inputting the passkey and the password used for the transaction;
A mobile device that generates and displays a one-time password based on the entered passkey and PIN,
An authentication system for an automatic transaction apparatus, wherein the one-time password generated by the portable terminal is used as a one-time password input to the automatic transaction apparatus. A card reader for reading information stored in a transaction card;
A deposit and withdrawal device that handles cash deposits and withdrawals;
A display device for displaying transaction information;
An input device operated by the user;
It has a control device that controls each of these devices,
Displaying the passkey generated by the control device on the display device;
Using the PIN code obtained from the host based on the card information read by the card reader and the one-time password generated based on the passkey, and the one-time password input via the input device. An automatic transaction device for authenticating a person,
An input device for inputting the passkey and the password used for the transaction;
A mobile device that generates and displays a one-time password based on the entered passkey and PIN,
An authentication system for an automatic transaction apparatus, wherein the one-time password generated by the portable terminal is used as a one-time password to be input to the automatic transaction apparatus. In the authentication system of the automatic transaction apparatus according to claim 2,
The said portable terminal acquires the tool for producing | generating a one-time password previously from the host of the said automatic transaction apparatus, The authentication system of the automatic transaction apparatus characterized by the above-mentioned. In the authentication system of the automatic transaction apparatus according to claim 4,
An automatic transaction apparatus authentication system, wherein the automatic transaction apparatus generates a one-time password based on the passkey and password.

Images