JP2011107791A - Authentication system, authentication server and authentication method using one-time password - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication system or the like that authenticates a user who purchases a commodity or the like in a credit card member store by use of an OTP (a one-time password), allows a common OTP in logging into a member store server, without requiring the user to input a card number of a credit card when a purchase request is made. <P>SOLUTION: In the authentication system using the OTP, the member store server and a card company server are connected with an authentication server performing OTP authentication by use of a common OTP serial or the like. The OTP provided by the authentication server for authenticating the user in approving payment by credit card in the card company server to the purchase request received by the member store server when the user logs in to the member store. The user is authenticated by the OTP in two stages in approval of purchase at the time of login only by causing a terminal operated by the user to store one OTP serial and OTP seed necessary for using the OTP. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an authentication system, an authentication server, and an authentication method for authenticating a user who purchases goods or services using a credit card at a credit card member store using a one-time password.

  In recent years, with the expansion of electronic commerce using the Internet, opportunities for credit cards to be used for payment for goods and services purchased on the Internet are increasing. Compared to payment using a CAT terminal installed in a conventional store and a dedicated network, payment by credit card on the Internet significantly increases the risk of fraudulent transactions due to the outflow of the credit card number. Safety measures have become an important issue in electronic commerce.

  On the other hand, when making a payment using a credit card on the Internet, you will be asked to enter the security code printed on the credit card, or you will need to enter the password registered with the card company along with the credit card number. By authenticating the user, personal authentication for confirming the owner of the credit card is used (for example, see Non-Patent Document 1 and Non-Patent Document 2).

  In addition, a one-time password (OTP) may be used as a method for avoiding the risk of a password leaking. For example, when an IC card is inserted into a dedicated auxiliary device, a credit card is provided on the condition of personal authentication based on biometric information. An invention has been disclosed in which a card number and a one-time password of a card are displayed, and personal authentication is performed when the credit card is used with the one-time password (see Patent Document 1).

JP 2008-15924 A

Explanation of “3-D Secure”, IT Glossary / e-Words homepage, [Search November 2, 2009], Internet <URL: http://e-words.jp/w/3-DE382BBE382ADE383A5E382A2.html> Secure online shopping, Visa Inc.・ VISA card homepage, [Search on November 2, 2009], Internet <URL: http://www.visa-asia.com/ap/jp/cardholders/security/vbv.shtml>

  As in the invention described in Patent Document 1, the safety of transactions is enhanced by using a one-time password, but it still has some problems from the viewpoint of safety and convenience. Yes. First, in the case where a customer uses a credit card for payment on the Internet, it is considered that the customer is often logged in to some product sales site or service providing site. If you use a high one-time password, you must authenticate using a common one-time password mechanism not only when you approve payments for credit cards but also when you log in to these sites. For example, it will be possible to strengthen the safety at the entrance stage of trading.

  Secondly, even in the invention described in Patent Document 1, the customer is required to input a credit card number, and this card number is transmitted via the network (see paragraph 0125 of Patent Document 1). There will be a risk that the card number will be leaked on the network, but a system will be provided that can authenticate without sending the credit card card number for each purchase request from the terminal operated by the customer. Is preferred.

  The present invention has been made to cope with such a problem, and a user who purchases a product or service using a credit card at a credit card member store is authenticated by using a one-time password, and the member store server. To provide an authentication system, an authentication server, and an authentication method that can apply a common one-time password mechanism even when logging in to a company and that do not require the input of a credit card number at the time of purchase request. It is intended.

  A first invention for solving the problems according to the present invention sells goods or services for authenticating a user who purchases goods or services using a credit card at a credit card member store using a one-time password. An authentication system comprising a member store server of a member store, a card carrier server of a card carrier that issues a credit card, and an authentication server that performs user authentication processing, wherein the member store server identifies a user. The member store in which the user ID of the user is designated from the user information storage means for storing the ID and the OTP serial assigned to authenticate the user with a one-time password in association with the user terminal operated by the user Login request accepting means for accepting a login request to the server; A first OTP serial reading unit that reads from the user information storage unit an OTP serial associated with a user ID of a user who has received a login request by a receiving unit, and a first one that receives a one-time password input to the user terminal. Authentication request transmitting means for transmitting an authentication request designating the OTP serial read by the first OTP serial reading means and the one-time password received by the first OTP receiving means to the authentication server Using a credit card from an authentication result receiving means for receiving an authentication result for the authentication request transmitted by the authentication request transmitting means from the authentication server, and a user terminal operated by a user logged in to the member store server. Purchase request reception that accepts purchase requests to purchase goods or services And a second OTP serial reading means for reading out the OTP serial associated with the user ID of the logged-in user who has received the purchase request from the purchase request receiving means, and the user terminal. Second OTP receiving means for receiving the one-time password, purchase information of the product or service specified in the purchase request received by the purchase request receiving means, and the OTP serial read by the second OTP serial reading means And a purchase information transmitting means for transmitting the one-time password received by the second OTP accepting means to the card provider server, wherein the card provider server transmits purchase information of the member store server. Purchase that receives purchase information, OTP serial, and one-time password sent from the means An information receiving unit; an authentication request transmitting unit for transmitting an authentication request specifying the OTP serial and the one-time password received by the purchase information receiving unit; and a transmission of the authentication request transmitting unit from the authentication server. An authentication result receiving means for receiving an authentication result in response to an authentication request, wherein the authentication server generates an OTP serial assigned to each user who uses one-time password authentication and an OTP seed used for authentication Authentication information storage means for storing the authentication information, authentication request receiving means for receiving an authentication request specifying an OTP serial and a one-time password from the member store server or the card carrier server, and reception of the authentication request receiving means The OTP seed associated with the OTP serial An authentication processing unit that reads out from the storage unit, generates a one-time password, and authenticates a person who has input the one-time password with the user if it matches the one-time password received by the authentication request receiving unit; and the authentication processing unit The authentication system using the one-time password is characterized by comprising authentication result transmission means for transmitting the authentication result by the method to the member store server or the card company server.

  A second invention for solving the problems according to the present invention sells a product or service for authenticating a user who purchases a product or service using a credit card at a credit card member store using a one-time password. An authentication system comprising a member store server of a member store, a card carrier server of a card carrier that issues a credit card, and an authentication server that performs user authentication processing, wherein the member store server identifies a user. The member store in which the user ID of the user is designated from the user information storage means for storing the ID and the OTP serial assigned to authenticate the user with a one-time password in association with the user terminal operated by the user Login request accepting means for accepting a login request to the server; A first OTP serial reading unit that reads from the user information storage unit an OTP serial associated with a user ID of a user who has received a login request by a receiving unit, and a first one that receives a one-time password input to the user terminal. Authentication request transmitting means for transmitting an authentication request designating the OTP serial read by the first OTP serial reading means and the one-time password received by the first OTP receiving means to the authentication server Using a credit card from an authentication result receiving means for receiving an authentication result for the authentication request transmitted by the authentication request transmitting means from the authentication server, and a user terminal operated by a user logged in to the member store server. Purchase request reception that accepts purchase requests to purchase goods or services And a second OTP serial reading means for reading out the OTP serial associated with the user ID of the logged-in user who has received the purchase request from the purchase request receiving means, and the purchase request receiving means. Purchase information transmitting means for transmitting the purchase information of the product or service specified in the purchase request received by the second OTP serial reading means and the OTP serial read by the second OTP serial reading means to the card carrier server, The card business server includes purchase information receiving means for receiving purchase information transmitted from the purchase information transmitting means of the member store server and an OTP serial; and an OTP reception for receiving a one-time password input to the user terminal. Means, OTP serial received by the purchase information receiving means, and acceptance of the OTP acceptance means An authentication request transmitting means for transmitting an authentication request designating the one-time password to the authentication server; an authentication result receiving means for receiving an authentication result for the authentication request transmitted by the authentication request transmitting means from the authentication server; The authentication server includes an authentication information storage means for storing an OTP serial assigned to each user who uses one-time password authentication and an OTP seed for generating a one-time password used for authentication, and the member store server Or an authentication request receiving means for receiving an authentication request designating an OTP serial and a one-time password from the card carrier server, and an OTP seed associated with the OTP serial received by the authentication request receiving means as the authentication information storage means. To generate a one-time password and authenticate If the received one-time password matches the received one-time password, the authentication processing means for authenticating the person who entered the one-time password with the user, and the authentication result by the authentication processing means, the member store server or the card operator An authentication system using a one-time password, comprising: an authentication result transmitting means for transmitting to a server.

  In the present invention, the member store server and the card company server are connected to an authentication server that authenticates with a one-time password using a common OTP serial, etc., and the purchase accepted by the member store server at the time of login to the member store server. When using a one-time password provided by the authentication server to authenticate the user at the time of credit card payment approval at the card carrier server for the request, the user can use one OTP serial and OTP necessary to use the one-time password. By simply storing the seed in the terminal operated by the user, it is possible to receive authentication with a one-time password in two stages at the time of login and approval of purchase, and the safety of the transaction is improved.

  In the present invention, the one-time password input by the user at the time of purchase approval is accepted by the member store server in the first invention, whereas it is accepted by the card company server in the second invention.

  Further, according to the present invention, the card business server includes a card information storage means for storing a card number of a credit card used by a user in association with an OTP serial assigned to authenticate the user with a one-time password. The card number reading means for reading out the card number associated with the OTP serial transmitted from the purchase information transmitting means of the member store server from the card information storage means, the purchase information received by the purchase information receiving means and the card An authorization request transmitting means for transmitting an authorization request designating the card number read by the number reading means to an authorization system for executing credit card authorization, and an authorization for the authorization request transmitted by the authorization request transmitting means from the authorization system. Receive results A sled result receiving means may also be characterized in that it comprises.

  If comprised in this way, even if a user does not input the card number of a credit card at the time of a purchase request, a card company server can specify a card number from OTP serial and can perform processing required for authorization. It is possible to reduce the risk of the card number being leaked on the net.

  In the above configuration, the card provider server is input from the user terminal operated by the user to the OTP serial registration request in which the card number and OTP serial of the credit card used by the user are designated, and to the user terminal. OTP serial registration request receiving means for receiving the one-time password, and second authentication request transmitting means for transmitting an authentication request specifying the OTP serial and the one-time password received by the OTP serial registration request receiving means to the authentication server A second authentication result receiving means for receiving an authentication result for the authentication request transmitted by the authentication request transmitting means from the authentication server, and at least the authentication result received by the second authentication result receiving means is the user himself / herself. The OTP serial registration request on the condition that it is authenticated And OTP serial register means in association with the card number and OTP serial credit card specified in the registration request received biasing means for registering the card information storage section may be characterized in that it comprises.

  If comprised in this way, it will become possible to safely perform the association of the OTP serial and the card number in the card business server by assuming user authentication with a one-time password.

  Further, in the member store server, the user information storage means stores the user ID and a password designated for authenticating the user in association with each other, and the member store server stores the login request. The receiving means reads the password associated with the user ID of the user who has received the login request from the user information storage means, and compares the password with the password specified in the login request received by the login request receiving means, and matches the password. The login request receiving means logs in on the condition that the password matches at least in the password determining means and the authentication result received by the authentication result receiving means is authenticated with the user. Log-in to execute the login process of the user who accepted the request And in-execution unit may be characterized in that it comprises.

  If comprised in this way, when a user logs in to a member store server, it will become possible to improve the safety | security of a transaction more by using the authentication by a normal password and the authentication by a one-time password together.

  Further, in the member store server, the user information storage means stores the user ID and a password designated for authenticating the user in association with each other, and the member store server stores the user operation. An OTP serial registration request accepting means for accepting an OTP serial registration request in which a user ID for identifying the user and an OTP serial is designated, and a password accepting means for accepting a password input to the user terminal; A password for reading the password associated with the user ID of the user whose registration request has been received by the OTP serial registration request receiving means from the user information storage means and comparing the password received by the password receiving means to determine a password match Determining means and at least said path OTP serial registration means for associating the user ID specified in the registration request accepted by the OTP serial registration request accepting means with the OTP serial and registering it in the user information storage means on condition that the passwords are matched in the password judging means It is good also as providing.

  If comprised in this way, it will become possible to safely perform the association of the OTP serial and the user ID in the member store server by assuming the user authentication by the password.

  The present invention can also be specified as an authentication server constituting the authentication system according to the present invention.

  An authentication server corresponding to the first aspect of the present invention is a member of a merchant that sells products or services for authenticating a user who purchases a product or service using a credit card at a credit card member store using a one-time password. An authentication server for performing user authentication processing, connected to a member store server and a card operator server of a card operator that issues a credit card, wherein the member store server includes a user ID for identifying a user, User information storage means for associating and storing an OTP serial assigned for authenticating a user with a one-time password, and a user terminal operated by the user to the member store server to which the user ID of the user is designated Log-in request accepting means for accepting a log-in request and the log-in request accepting means log The first OTP serial reading means for reading the OTP serial associated with the user ID of the user who has received the request from the user information storage means, and the first OTP reception for receiving the one-time password input to the user terminal Authentication request transmitting means for transmitting an authentication request designating the OTP serial read by the first OTP serial reading means and the one-time password accepted by the first OTP accepting means to the authentication server; A product or service using a credit card from an authentication result receiving means for receiving an authentication result in response to an authentication request transmitted from the authentication request transmitting means and a user terminal operated by a user who is logged in to the member store server. Purchase request accepting means for accepting a purchase request for purchasing the purchase, and the purchase Second OTP serial reading means for reading out the OTP serial associated with the user ID of the logged-in user who has received the purchase request from the user information storage means, and the one-time password input to the user terminal A second OTP receiving means for receiving the purchase information of the product or service designated in the purchase request received by the purchase request receiving means, the OTP serial read by the second OTP serial reading means, and the second Purchase information transmission means for transmitting the one-time password received by the OTP reception means to the card provider server, and the card provider server transmits the purchase information from the purchase information transmission means of the member store server. Purchase information receiver who receives received purchase information, OTP serial, and one-time password And an authentication request transmitting means for transmitting an authentication request specifying the OTP serial and the one-time password received by the purchase information receiving means to the authentication server, and an authentication transmitted by the authentication request transmitting means from the authentication server. An authentication result receiving means for receiving an authentication result for a request, and storing an OTP serial assigned to each user who uses one-time password authentication and an OTP seed for generating a one-time password used for authentication in association with each other Authentication information storage means, authentication request receiving means for receiving an authentication request designating an OTP serial and a one-time password from the member store server or the card carrier server, and the OTP serial received by the authentication request receiving means Read the associated OTP seed from the authentication information storage means A one-time password is generated, and if it matches the one-time password received by the authentication request receiving means, an authentication processing means for authenticating a person who has entered the one-time password with the user, and an authentication result by the authentication processing means And an authentication result transmitting means for transmitting to the member store server or the card provider server.

  An authentication server corresponding to the second aspect of the invention is a member of a merchant that sells products or services for authenticating a user who purchases a product or service using a credit card at a credit card member store using a one-time password. An authentication server for performing user authentication processing, connected to a member store server and a card operator server of a card operator that issues a credit card, wherein the member store server includes a user ID for identifying a user, User information storage means for associating and storing an OTP serial assigned for authenticating a user with a one-time password, and a user terminal operated by the user to the member store server to which the user ID of the user is designated Log-in request accepting means for accepting a log-in request and the log-in request accepting means log The first OTP serial reading means for reading the OTP serial associated with the user ID of the user who has received the request from the user information storage means, and the first OTP reception for receiving the one-time password input to the user terminal Authentication request transmitting means for transmitting an authentication request designating the OTP serial read by the first OTP serial reading means and the one-time password accepted by the first OTP accepting means to the authentication server; A product or service using a credit card from an authentication result receiving means for receiving an authentication result in response to an authentication request transmitted from the authentication request transmitting means and a user terminal operated by a user who is logged in to the member store server. Purchase request accepting means for accepting a purchase request for purchasing the purchase, and the purchase Second OTP serial reading means for reading out the OTP serial associated with the user ID of the logged-in user who has received the purchase request from the user information storage means, and the one-time password input to the user terminal A second OTP receiving means for receiving the purchase information of the product or service designated in the purchase request received by the purchase request receiving means, the OTP serial read by the second OTP serial reading means, and the second Purchase information transmission means for transmitting the one-time password received by the OTP reception means to the card provider server, and the card provider server transmits the purchase information from the purchase information transmission means of the member store server. Purchase information receiver who receives received purchase information, OTP serial, and one-time password And an authentication request transmitting means for transmitting an authentication request specifying the OTP serial and the one-time password received by the purchase information receiving means to the authentication server, and an authentication transmitted by the authentication request transmitting means from the authentication server. An authentication result receiving means for receiving an authentication result for a request, and storing an OTP serial assigned to each user who uses one-time password authentication and an OTP seed for generating a one-time password used for authentication in association with each other Authentication information storage means, authentication request receiving means for receiving an authentication request designating an OTP serial and a one-time password from the member store server or the card carrier server, and the OTP serial received by the authentication request receiving means Read the associated OTP seed from the authentication information storage means A one-time password is generated, and if it matches the one-time password received by the authentication request receiving means, an authentication processing means for authenticating a person who has entered the one-time password with the user, and an authentication result by the authentication processing means And an authentication result transmitting means for transmitting to the member store server or the card provider server.

  The present invention can also be specified as an authentication method executed by the authentication system according to the present invention.

  An authentication method corresponding to the first aspect of the present invention is a method for authenticating a user who purchases a product or service using a credit card at a credit card member store using a one-time password. An authentication method executed by a member store server, a card carrier server of a card carrier that issues a credit card, and an authentication server that performs user authentication processing. The member store server includes a user that identifies a user. User information storage means for storing an ID and an OTP serial assigned to authenticate the user with a one-time password in association with each other, the OTP assigned to each user who uses one-time password authentication in the authentication server. OTP seed to generate one-time password for serial and authentication An authentication information storage means for storing in association is provided, and the member store server accepts a login request from the user terminal operated by the user to the member store server in which the user ID of the user is designated. A first OTP serial reading step in which the member store server reads from the user information storage means an OTP serial associated with the user ID of the user who has received the login request in the login request receiving step; A first OTP receiving step in which the store server receives the one-time password input to the user terminal; an OTP serial read by the member store server in the first OTP serial reading step; and the first OTP reception. Specify the one-time password accepted in the step An authentication request sending step for sending an authentication request to the authentication server; an authentication result receiving step for receiving an authentication result for the authentication request sent by the member store server in the authentication request sending step from the authentication server; A merchant server accepts a purchase request to purchase a product or service using a credit card from a user terminal operated by a user who is logged in to the merchant server, and the merchant server A second OTP serial reading step for reading out the OTP serial associated with the user ID of the logged-in user who has received the purchase request in the request receiving step from the user information storage means, and the member store server is connected to the user terminal. The second OTP reception step that accepts the entered one-time password The purchase information of the product or service specified in the purchase request received in the purchase request receiving step, the OTP serial read in the second OTP serial reading step, and the second The one-time password received in the OTP reception step of the purchase information transmission step of transmitting to the card company server, the purchase information transmitted by the card company server in the purchase information transmission step of the member store server, The purchase information receiving step for receiving the OTP serial and the one-time password, and the card carrier server sends the authentication request specifying the OTP serial and the one-time password received in the purchase information receiving step to the authentication server. An authentication request transmitting step, and the card carrier server The authentication result receiving step for receiving the authentication result for the authentication request transmitted in the authentication request transmitting step, and the authentication server designates the OTP serial and the one-time password from the member store server or the card business server. An authentication request receiving step of receiving an authentication request; and the authentication server reads an OTP seed associated with the OTP serial received in the authentication request receiving step from the authentication information storage means to generate a one-time password, and If it matches the one-time password received in the request receiving step, an authentication processing step for authenticating the person who entered the one-time password with the user, and the authentication server displays the authentication result in the authentication processing step as the member store. Authentication sent to the server or the card company server A result transmitting step, an authentication method using a one-time password, characterized by having a.

  An authentication method corresponding to the second aspect of the invention is a method of authenticating a member who sells a product or service for authenticating a user who purchases the product or service using a credit card at a credit card member store using a one-time password. An authentication method executed by a member store server, a card carrier server of a card carrier that issues a credit card, and an authentication server that performs user authentication processing. The member store server includes a user that identifies a user. User information storage means for storing an ID and an OTP serial assigned to authenticate the user with a one-time password in association with each other, the OTP assigned to each user who uses one-time password authentication in the authentication server. OTP seed to generate one-time password for serial and authentication An authentication information storage means for storing in association is provided, and the member store server accepts a login request from the user terminal operated by the user to the member store server in which the user ID of the user is designated. A first OTP serial reading step in which the member store server reads from the user information storage means an OTP serial associated with the user ID of the user who has received the login request in the login request receiving step; A first OTP receiving step in which the store server receives the one-time password input to the user terminal; an OTP serial read by the member store server in the first OTP serial reading step; and the first OTP reception. Specify the one-time password accepted in the step An authentication request sending step for sending an authentication request to the authentication server; an authentication result receiving step for receiving an authentication result for the authentication request sent by the member store server in the authentication request sending step from the authentication server; A merchant server accepts a purchase request to purchase a product or service using a credit card from a user terminal operated by a user who is logged in to the merchant server, and the merchant server A second OTP serial reading step of reading from the user information storage means an OTP serial associated with the user ID of the logged-in user who has received the purchase request in the request receiving step; and the member store server receives the purchase request Purchase of goods or services specified in the purchase request received in the step Information and the OTP serial read in the second OTP serial read step to the card provider server, the card provider server, and the member store server in the purchase information transmission step. A purchase information receiving step for receiving the transmitted purchase information and an OTP serial; an OTP accepting step for the card operator server to accept a one-time password input to the user terminal; and the card operator server, An authentication request transmitting step of transmitting an authentication request designating the OTP serial received in the purchase information receiving step and the one-time password received in the OTP receiving step to the authentication server, and the card provider server from the authentication server The authentication request transmitted in the authentication request transmission step. An authentication result receiving step for receiving an authentication result, an authentication request receiving step for receiving an authentication request specifying an OTP serial and a one-time password from the member store server or the card business server, The authentication server reads out the OTP seed associated with the OTP serial received in the authentication request receiving step from the authentication information storage means, generates a one-time password, and matches the one-time password received in the authentication request receiving step. For example, an authentication processing step for authenticating a person who has entered a one-time password with the user, and an authentication result for the authentication server to transmit an authentication result in the authentication processing step to the member store server or the card business server. And a transmission step. It is an authentication method using the word.

  According to the present invention, when a user who purchases a product or service using a credit card is authenticated using a one-time password at a credit card member store, the common one-time password mechanism is used when logging into the member store server. Can be applied, and it is also possible to eliminate the need to input the card number of the credit card at the time of purchase request. Therefore, the safety at the time of purchasing goods or services on the net is increased without imposing a special operation burden on the user.

It is a figure which shows the outline | summary of embodiment of the authentication system concerning this invention. It is a block diagram which shows the structure of the authentication system concerning this invention. It is a figure which shows the procedure which requests | requires the download of an OTP application in the authentication system concerning this invention. It is a figure which shows the procedure which downloads an OTP application in the authentication system concerning this invention. In the authentication system concerning this invention, it is a figure which shows the procedure which registers an OTP serial in the customer database of a member store server. In the authentication system concerning this invention, it is a figure which shows the procedure which registers an OTP serial in the conversion table of a card carrier server. It is a figure which shows the procedure which logs in to a member store server in the authentication system concerning this invention. In the authentication system concerning this invention, it is a figure which shows the procedure which requests | requires purchase of goods etc. from a member store server. In the authentication system concerning this invention, it is a figure which shows the procedure which approves the payment by a credit card in a card company server. 6 is a flowchart showing a processing flow for requesting download of an OTP application in the authentication system according to the present invention. It is a flowchart which shows the processing flow which downloads an OTP application in the authentication system concerning this invention. It is a flowchart which shows the processing flow which registers an OTP serial in the customer database of a member store server in the authentication system concerning this invention. In the authentication system concerning this invention, it is a flowchart which shows the processing flow which registers an OTP serial in the conversion table of a card carrier server. It is a flowchart which shows the processing flow which logs in to a member store server in the authentication system concerning this invention. In the authentication system according to the present invention, it is a flowchart showing a processing flow for requesting the member store server to purchase products and the like. In the authentication system concerning this invention, it is a flowchart which shows the processing flow which approves the payment by a credit card in a card company server.

  Embodiments for carrying out the present invention will be described below in detail with reference to the drawings. The following description shows an example of the embodiment of the present invention. The configuration of the present invention, such as the type of terminal used by the customer and the configuration for downloading a one-time password, is shown in the following. The form is not limited.

  An outline of an embodiment of an authentication system according to the present invention will be described with reference to FIG. The authentication system according to the present invention is a card business of a card operator such as a member store server of a member store that provides products or services that can be purchased using a credit card on the Internet, a card company that issues a credit card, etc. And an authentication server that performs authentication processing of a user who purchases a product or service.

  In the present invention, the one-time password used for customer authentication is managed in the authentication system. The one-time password is generated by applying a different OTP seed to a predetermined logic of the OTP application, and an OTP serial is assigned to each customer as a code for identifying a different OTP seed for each customer.

  The OTP serial assigned to each customer and the corresponding OTP seed are stored in association with the authentication database of the authentication system. In addition, by storing the OTP serial and OTP seed assigned to the customer and the same OTP application as the authentication system in the terminal operated by the customer, the terminal operated by the customer and the authentication system are synchronized, and the same one-time password Can be generated and used for authentication.

  In the embodiment described below, a customer who purchases a product or service at a member store using a credit card issued by a card operator connects the mobile phone as a terminal for displaying a one-time password to the member store. It is assumed that a PC (personal computer) is used as a terminal for performing operations for purchasing goods and services at the site. In this case, the same OTP application as the authentication system, the OTP serial assigned to the customer, and the OTP seed are downloaded in advance to the mobile phone of the customer.

  When accepting a one-time password entered by a customer in the authentication system, if the OTP serial assigned to the customer can be identified, a one-time password can be generated from the corresponding OTP seed. The customer can be authenticated from the match with the generated one-time password.

  In the present invention, the customer database of the member store server stores the user ID used to identify the customer at the member store and the OTP serial assigned to authenticate the customer with a one-time password in association with each other. Has been. As a result, when the customer logs in to the member store server, if the customer user ID is specified, the customer can be identified without inputting the OTP serial. It is possible to perform authentication using a one-time password by specifying the OTP serial to be performed and making an inquiry to the authentication system.

  In addition, when a customer who has logged in to a merchant server requests that a merchant store purchase a product or service using a credit card, the merchant server requests a credit card transaction authorization from the card company server. In addition, the customer's OTP serial and the one-time password entered by the customer are transmitted together with purchase information such as the product code and purchase price. The card company server can receive the authentication using the one-time password by sending the received OTP serial and the one-time password to the authentication system and making an inquiry.

  With the above configuration, in the present invention, the customer simply downloads one OTP serial or the like, and logs in to the member store server or purchases a product or service using a credit card in the member store server. It is possible to use a highly secure authentication means using a one-time password.

  Further, according to the present invention, by providing a conversion table in which the card number of the credit card held by the customer and the OTP serial assigned to the customer are associated with the card business server, the settlement of the credit card designating the OTP serial from the member store server. When the request is accepted, it is possible to specify the card number in the card business server and authorize the credit card payment without requiring the customer to input the card number. According to this payment scheme, the card number is not input to the customer's terminal and transmitted over the net, which is effective in reducing the risk of card number leakage.

  The configuration of the authentication system according to the present invention will be described with reference to FIG.

  The member store server 10 is a Web server that is connected to the Internet and can communicate with a customer terminal (PC) 60, and includes an OTP serial registration unit 11, a login reception unit 12, and a purchase request reception unit 13. ing. Each of these units is functionally specified, and an application program for executing processing necessary for each function is read into a memory area such as a main memory of a computer constituting the member store server 10. And each function is implement | achieved by performing arithmetic processing by CPU.

  Further, the member store server 10 is provided with a customer DB (database) 14. A predetermined storage area such as a computer HDD is allocated to the customer DB (database) 14, but the hardware configuration is not particularly limited, and a part of a computer functioning as a Web server may be used. Alternatively, a different computer may be used as the database server.

  The OTP authentication system 20 includes an OTP authentication application acceptance server 21, a download server 22, an authentication server 23, and an authentication DB (database) 24. The physical configurations of these servers and databases are not particularly limited, and functions such as a plurality of servers may be realized by the same computer.

  The OTP authentication application acceptance server 21 and the download server 22 are Web servers that are connected to the Internet and can communicate with the customer terminal (PC) 60 and the customer terminal (mobile phone) 70, respectively. Each function is realized by reading an application program for executing necessary processing into a memory area such as a main memory of the computer and executing arithmetic processing by the CPU.

  The authentication server 43 is a server computer connected to the member store server 10 and the card company server 30 via a network, and performs an authentication process in response to an authentication request from the member store server 10 and the card company server 30. An application program to be executed is read into a memory area such as a main memory of the computer, and an arithmetic function is executed by the CPU, thereby realizing an authentication function. The network connecting the authentication server 43 to the member store server 10 and the card company server 30 is not limited to the Internet.

  A predetermined storage area such as a computer HDD is allocated to the authentication DB (database) 24. However, the hardware configuration is not particularly limited, and a part of the computer functioning as a server such as the authentication server 23 may be used. It may be used, or a different computer may be used as the database server.

  The card business server 30 is a Web server that is connected to the Internet and can communicate with a customer terminal (PC) 60, and includes an OTP serial registration unit 31 and an authentication processing unit 32. Each of these units is functionally specified, and an application program for executing processing necessary for each function is read into a memory area such as a main memory of a computer constituting the card carrier server 30. Each function is realized by the calculation processing being executed by the CPU.

  The card business server 30 is provided with a conversion TB (table) 33. A predetermined storage area such as a computer HDD is allocated to the conversion TB (table) 33. However, the hardware configuration is not particularly limited, and a part of a computer functioning as a Web server may be used. Alternatively, a different computer may be used as the database server.

  The authorization system 40 and the 3-D authentication server 50 are respectively connected to the card operator server 30 via the network in order to execute authorization for a payment approval request in the card operator server 30 and authentication of a customer by a password. In the present invention, these configurations are not particularly limited. The computer is connected to the card operator server 30 via a network, and a predetermined process is performed in response to a request from the card operator server 30. What is necessary is just to perform.

  Based on the configuration of the authentication system described above, the operation of the authentication system according to the present invention will be described below with reference to FIGS.

  FIG. 3 shows a procedure for requesting download of an OTP application in the authentication system according to the present invention, and FIG. 10 is a flowchart showing a processing flow in the OTP authentication application reception server 21.

  If the customer who operates the customer terminal (PC) 60 and accesses the member store server 10 to purchase goods or services wants to use the OTP authentication (one-time password authentication) service, it is provided from the member store server 10. Application for the OTP authentication service is selected on the Web page ((1) in FIG. 3). By jumping to the OTP authentication application acceptance server 21 by a function such as a link ((2) in FIG. 3), the customer terminal (PC) 60 accesses the card business server 30 ((3) in FIG. 3).

  Here, in the OTP authentication application reception server 21 that has received access for the OTP authentication application, the processing shown in the flowchart of FIG. 10 is performed. When an application request for OTP authentication is received from the customer terminal (PC) 60 (S01), an OTP serial associated with the OTP seed to be used for authentication of the customer who has received the application request is assigned (S02). The assigned OTP serial and the associated OTP seed are stored in the authentication DB 24. However, the OTP serial and the OTP seed assigned here may be newly stored in the authentication DB 24. Any combination of the OTP serial and the OTP seed stored in the authentication DB 24 may be selected to be in an effective state.

  In addition, the download ID and password are assigned to the OTP serial assigned here, and are stored in the authentication DB 24 in association with the OTP serial assigned to the customer. The ID and password for downloading are output on a predetermined sheet or the like together with the URL of the download server 22 for downloading the OTP application, OTP serial, and OTP seed (S03), and sent to the customer by mail or the like ( (4) of FIG.

  FIG. 4 shows a procedure for downloading an OTP application in the authentication system according to the present invention, and FIG. 11 is a flowchart showing a processing flow in the download server 22.

  The customer who has received the URL of the download server 22 for downloading the download ID and password, the OTP application, etc., accesses the URL of the download server 22 designated by the operation of the customer terminal (mobile phone) 70 and operates the OTP. Download the application ((1) in FIG. 4). Since the OTP application downloaded here is common to all customers, input of a download ID and password is not required at this stage.

  Next, the download ID and password are input to the customer terminal (mobile phone) 70 and transmitted to the download server 22 ((2) in FIG. 4). When the download server 22 searches the authentication DB 24 and finds a matching combination among valid IDs and passwords stored in the authentication DB 24, the OTP serial and OTP associated with the ID and password are confirmed. The seed is read from the authentication DB 24 and downloaded to the customer terminal (mobile phone) 70 ((3) in FIG. 4). Since the OTP serial and OTP seed downloaded here are unique for each customer, the OTP (one-time password) is generated by the OTP application using this OTP seed, so that the customer's OTP authentication can be performed. .

  The above procedure is shown as a processing flow in the download server 22 in the flowchart of FIG. When the download server 22 receives a download request for the OTP application from the customer terminal (mobile phone) 70 (S11), the customer terminal (mobile phone) 70 downloads the OTP application (S12). Subsequently, the download ID and password input to the customer terminal (mobile phone) 70 are received (S13).

  Here, the authentication DB 24 is searched, and if it matches any of the valid ID and password stored in the authentication DB 24 (S14), the OTP serial and OTP seed associated with this ID and password are read from the authentication DB 24. Then, it is downloaded to the customer terminal (mobile phone) 70 (S15). If there is no matching ID and password, or if the matching ID and password are invalid such as already downloaded or expired (S16), error processing is performed.

  FIG. 5 shows a procedure for registering the OTP serial in the customer DB 14 of the member store server 10 in the authentication system according to the present invention, and FIG. 12 is a flowchart showing a processing flow in the member store server 10.

  A customer ID for identifying the customer is assigned to the customer who uses the service provided by the member store server 10, and this user ID is registered in the customer DB 14 in association with the password for authentication. When the customer to whom the user ID is assigned operates the customer terminal (PC) 60 to access the member store server 10, the login reception unit 12 is activated to perform authentication using the user ID and the password, and to the member store server 10. Is executed ((1) in FIG. 5).

  When the OTP serial registration menu is selected while the customer is logged in, the OTP serial registration unit 11 of the member store server 10 is activated. The customer activates the OTP application downloaded to the customer terminal (mobile phone) 70, displays the OTP serial on the customer terminal (mobile phone) 70, and inputs this to the customer terminal (PC) 60 to input the member store server 10 Send to. The member store server 10 stores the received OTP serial in the customer DB 14 in association with the user ID ((2) in FIG. 5).

  FIG. 12 is a flowchart showing the above procedure as a processing flow in the login accepting unit 12 and the OTP serial registration unit 11 of the member store server 10. When the member store server 10 receives a login request from the customer terminal (PC) 60 (S21), it requests the customer terminal (PC) 60 to input a user ID and password, and the user ID input to the customer terminal (PC) 60. And a password are accepted (S22).

  Here, the customer DB 14 is searched, and if it matches any of the valid user ID and password stored in the customer DB 14 (S23), a login process is executed (S24). When a registration request specifying an OTP serial is received from the customer terminal (PC) 60 in the logged-in state (S25), the received OTP serial is written in the customer DB 14 in association with the user ID of the logged-in customer (S26). On the other hand, if there is no matching ID and password, or if the matching ID and password are invalid, such as withdrawn or expired, error processing is performed (S27).

  FIG. 6 shows a procedure for registering an OTP serial in the conversion TB 33 of the card company server 30 in the authentication system according to the present invention, and FIG. 13 is a flowchart showing a processing flow in the card company server 30.

  A customer who uses a credit card issued by a card company that operates the card company server 30 operates the customer terminal (PC) 60 to access the card company server 30. If the customer wishes to use OTP authentication when making a payment with a credit card, the card provider server 30 selects an OTP serial registration menu, and the card provider server 30 activates the OTP serial registration unit 31.

  The customer activates the OTP application downloaded to the customer terminal (mobile phone) 70 to display the OTP serial, and the customer terminal (mobile phone) 70 displays the OTP generated using the OTP seed. The customer inputs the OTP serial and OTP displayed on the customer terminal (mobile phone) 70 to the customer terminal (PC) 60 and transmits them to the card carrier server 30.

  In the card carrier server 30 that has received the OTP serial and the OTP, the authentication processing unit 32 is activated and transmits them to the authentication server 23 to request OTP authentication of the customer. The authentication server 23 reads the OTP seed corresponding to the OTP serial received from the card carrier server 30 from the authentication DB 24, and uses the same OTP application downloaded from the OTP seed to the customer terminal (mobile phone) 70 using the OTP application. And OTP authentication of the customer is performed depending on whether or not it matches the OTP received from the card carrier server 30 ((1) in FIG. 6). If they match, an authentication result indicating that the customer has been authenticated, and if not matched, an authentication result indicating that the customer has not been authenticated is returned to the card business server 30.

  Further, the card business server 30 requests the customer to input a credit card number in order to confirm the card user. At the same time, in order to confirm that the customer is the credit card holder himself / herself, an input of a security code or the like printed on the credit card is requested. The customer inputs the requested information into the customer terminal (PC) 60 and transmits it to the card operator server 30 ((2) in FIG. 6).

  Upon receiving the customer's card number and an authentication code such as a security code, the card carrier server 30 sends these to the authorization system 40 to request the customer's identity, and the authorization system 40 uses the same authorization as when using a credit card. And the confirmation result is returned to the card business server 30 ((3) in FIG. 6). If it is confirmed that the customer is the customer himself / herself by OTP authentication by the authentication server 23 and authorization by the authorization system 40, the card number and OTP serial number of the customer's credit card received from the customer terminal (PC) 60 are Registration is made in association with the conversion TB33 ((4) in FIG. 6).

  Note that the method for confirming the card user is not limited to the authorization using the authorization system 40 as long as the card user can be confirmed. For example, the 3-D authentication server 50 It is also possible to use a method using a password registered in advance by the customer, such as 3-D secure using. It is preferable to use these methods together in order to perform the personal authentication reliably.

  FIG. 13 is a flowchart showing the above procedure as a processing flow in the OTP serial registration unit 31 and the authentication processing unit 32 of the card business server 30. When the card business server 30 receives an OTP serial registration request from the customer terminal (PC) 60 (S31), it requests the customer terminal (PC) 60 to input the OTP serial and OTP, and inputs it to the customer terminal (PC) 60. Received OTP serial and OTP are received (S32).

  Subsequently, in order to authenticate the person by OTP authentication, the received OTP serial and OTP are transmitted to make an inquiry to the authentication server 23 (S33). If the authentication server 23 confirms the identity of the user based on the authentication result of the OTP authentication (S34), the card number and the security code input to the customer terminal (PC) 60 are accepted (S35). Further, in order to authenticate the identity of the card user, the received card number and security code are transmitted to make an inquiry to the authorization system 40 (S36). If it is confirmed that the user is the card user as a result of the authorization by the authorization system 40 (S37), the card number received from the customer terminal (PC) 60 and the OTP serial are linked and registered in the conversion TB 33 ( S38). If the identity is not confirmed as a result of either authentication by the authentication server 23 or authorization by the authorization system 40, error processing is performed (S39).

  In the above flow, the processing order of the authentication by the authentication server 23 and the authorization by the authorization system 40 is not particularly limited, and the authorization may be performed first. In addition, as described above, the method for checking the card user himself / herself is not limited to only authorization, and a method such as 3-D secure may be used in combination.

  As described above with reference to FIGS. 3 to 6 and FIGS. 10 to 13, the OTP application, OTP serial, and OTP seed are downloaded to the customer terminal (mobile phone) 70, and the user DB 14 of the member store server 10 has the user On the premise that the ID and the OTP serial are stored in association with each other, and the conversion TB 33 of the card carrier server 30 stores the card number and the OTP serial in association with each other, in the present invention, as described below, the member store server 10 The OTP authentication is performed by the authentication server 23 at the time of logging in to the merchant and at the time of purchasing a product or service using a credit card at the member store server 10. It should be noted that in order to implement the present invention, such a precondition only has to be prepared, and the processing procedure for downloading the OTP application is not limited to the method described so far.

  FIG. 7 shows a procedure for logging in to the member store server 10 in the authentication system according to the present invention, and FIG. 14 is a flowchart showing a processing flow in the member store server 10.

  When the customer operates the customer terminal (PC) 60 to access the member store server 10 and requests login, the login reception unit 12 is activated and authentication is performed using the user ID and password ((1) in FIG. 7). ). Here, an OTP input is requested together with a fixed password (password registered in the customer DB 14), and the customer activates the OTP application downloaded to the customer terminal (mobile phone) 70 to display the OTP, The OTP displayed on the customer terminal (mobile phone) 70 is input to the customer terminal (PC) 60 and transmitted to the member store server 10 ((2) in FIG. 7).

  In the member store server 10 that has received the OTP, the OTP serial stored in association with the user ID previously authenticated with the fixed password is read from the customer DB 14. In the present invention, it is possible to specify an OTP serial necessary for OTP authentication without causing the customer to input the OTP serial by reading out and using the OTP serial registered in advance.

  Subsequently, the OTP received from the customer terminal (PC) 60 and the OTP serial read from the customer DB 14 are transmitted to the authentication server 23 to request customer OTP authentication. The authentication server 30 reads the OTP seed corresponding to the OTP serial received from the member store server 10 from the authentication DB 24, and uses the same OTP application downloaded from the OTP seed to the customer terminal (mobile phone) 70 as the OTP. The customer's OTP authentication is performed based on whether or not it matches the OTP generated and received from the member store server 10 ((3) in FIG. 7). If they match, an authentication result indicating that the customer has been authenticated and if not matched, an authentication result indicating that the customer has not been authenticated is returned to the member store server 10.

  The member store server 10 performs login processing on the condition that the personal authentication is performed by the OTP authentication. As described above, the member store server 10 uses both a fixed password authentication and an OTP authentication to strengthen the identity authentication at the time of login and increase the safety of transactions.

  FIG. 14 is a flowchart showing the above procedure as a processing flow in the login reception unit 12 of the member store server 10. When the member store server 10 receives a login request from the customer terminal (PC) 60 (S41), it requests the customer terminal (PC) 60 to input a user ID and password, and the user ID input to the customer terminal (PC) 60. And a password are accepted (S42).

  Here, the customer DB 14 is searched, and it is confirmed whether it matches any of the valid user ID or password stored in the customer DB 14 (S43). If they match, the customer terminal (PC) 60 is requested to input an OTP, and the OTP input to the customer terminal (PC) 60 is accepted (S44). Further, the OTP serial corresponding to the user ID previously authenticated by the password is read from the customer DB 14 (S45), and the authentication server transmits the received OTP and the read OTP serial in order to authenticate the person by OTP authentication. 23 is inquired (S46).

  When it is confirmed that the personal authentication is performed based on the authentication result of the OTP authentication by the authentication server 23 (S47), a process for login is executed (S48). If authentication is not made by either a fixed password or authentication by the authentication server 23, error processing is performed (S49).

  FIG. 8 shows a procedure for requesting the member store server 10 to purchase a product or the like in the authentication system according to the present invention, and FIG. 15 is a flowchart showing a processing flow in the member store server 10.

  While the customer is logged in to the member store server 10, the customer requests the purchase of goods or services provided by the member store server 10. From the customer terminal (PC) 60, purchase information such as the product code and quantity of the product to be purchased is transmitted to the member store server 10 and an OTP input is requested. The customer downloads to the customer terminal (mobile phone) 70. The OTP application is activated to display the OTP, and the OTP displayed on the customer terminal (mobile phone) 70 is input to the customer terminal (PC) 60 and transmitted to the member store server 10 ((1 in FIG. 8). )).

  In the member store server 10, the purchase request reception unit 13 is activated, and the OTP serial stored in association with the user ID of the logged-in customer is read from the customer DB 14 together with the received purchase information and OTP, and the card business server. 30 ((2) in FIG. 8). In the present invention, it is possible to specify an OTP serial necessary for OTP authentication without causing the customer to input the OTP serial by reading out and using the OTP serial registered in advance.

  As will be described later, the OTP input by the customer for OTP authentication is not limited to the method transmitted in response to the input request from the member store server 10 as described above. It is good also as taking the system transmitted with respect to the input request from the card provider server 30 which received etc. In the latter case, the purchase information and the OTP serial are transmitted from the member store server 10 to the card company server 30, and the transmitted information does not include OTP.

  FIG. 15 is a flowchart showing the above procedure as a processing flow in the purchase request receiving unit 13 of the member store server 10. When the member store server 10 receives a purchase request in which purchase information of goods or services is designated from the customer terminal (PC) 60 (S51), it requests the customer terminal (PC) 60 to input an OTP, and the customer terminal (PC). The OTP input to 60 is received (S52). Further, the OTP serial corresponding to the logged-in user ID is read from the customer DB 14 (S53), and the received purchase information, OTP and the read OTP serial are transmitted to the card business server 30 (S54). Here, as described above, the card carrier server 30 may accept the OTP without including it.

  FIG. 9 shows a procedure for authorizing payment by credit card in the card company server in the authentication system according to the present invention, and FIG. 16 is a flowchart showing a processing flow in the card company server 30.

  When the card business server 30 receives the purchase information, OTP serial, and OTP from the member store server 10 ((1) in FIG. 9), the authentication processing unit 32 is activated and transmits the received OTP and OTP serial to the authentication server 23. Requesting the customer's OTP authentication. The authentication server 30 reads the OTP seed corresponding to the OTP serial received from the card carrier server 30 from the authentication DB 24, and uses the same OTP application downloaded from the OTP seed to the customer terminal (mobile phone) 70 as an OTP. And OTP authentication of the customer is performed depending on whether or not it matches the OTP received from the card carrier server 30 ((2) in FIG. 9). If they match, an authentication result indicating that the customer has been authenticated, and if not matched, an authentication result indicating that the customer has not been authenticated is returned to the card business server 30.

  Note that the OTP to be transmitted to the authentication server 23 is not received from the member store server 10, but is requested from the card operator server 30 to the customer terminal (PC) 60, and the card business from the customer terminal (PC) 60. The OTP received by the operator server 30 may be used.

  Next, the card number of the credit card corresponding to the OTP serial received by the card company server 30 is read from the conversion TB 33 ((3) in FIG. 9), and the card number of the credit card used for settlement is specified. In this way, if the card number is specified without causing the customer to transmit the card number, it is possible to prevent the card number of the credit card from being transmitted / received on the network, thereby reducing the risk of the card number being leaked. It is effective.

  Subsequently, the purchase information received by the card company server 30 and the read card number are transmitted to the authorization system 40, and an authorization is requested as to whether or not payment by credit card is possible. At the time of authorization, authentication by a security code as described in FIG. 6 or 3-D secure may be requested. The result of the authorization in the authorization system 40 is returned to the card business server 30 ((4) in FIG. 9), and from the result of the identity authentication and authorization by the OTP authentication, it is determined whether or not the payment by the credit card is possible and the member store server. Reply to 10.

  In the above explanation, the card number of the credit card used by the customer for payment is read from the conversion TB 33 and specified. However, if the same number as the credit card is used as the number used as the OTP serial, The conversion from OTP serial to card number using the conversion TB33 becomes unnecessary. For example, if the member store server 10 issues a dedicated house card or the like to a member store that provides a service, and the credit card issuance and the OTP serial assignment are performed together, this embodiment is possible. .

  FIG. 16 is a flowchart showing the above procedure as a processing flow in the authentication processing unit 32 of the card business server 30. The card company server 30 receives purchase information, OTP serial, and OTP from the member store server 10 (S55). Here, when the OTP is not received from the member store server, the customer terminal (PC) 60 is requested to input the OTP, and the OTP input to the customer terminal (PC) 60 is received (S56).

  Subsequently, in order to authenticate the person by OTP authentication, the received OTP serial and OTP are transmitted to make an inquiry to the authentication server 23 (S57). When the authentication result of the OTP authentication by the authentication server 23 confirms that the user is authenticated (S58), the card number corresponding to the OTP serial received from the conversion TB 33 is read (S59), and the customer terminal (PC ) The information necessary for authentication such as the security code input in 60 is received, and the read card number and the security code are transmitted to make an inquiry to the authorization system 40 in order to confirm whether or not the payment by the credit card is possible. (S60).

  When it is confirmed that the credit card can be settled as a result of the authorization by the authorization system 40 (S61), the fact that the credit card settlement is approved is transmitted to the member store server 10 (S62). If either the authentication by the authentication server 23 or the authorization by the authorization system 40 is NG, error processing is performed (S63).

DESCRIPTION OF SYMBOLS 10 Member store server 11 OTP authentication application reception part 12 OTP serial registration part 13 Login reception part 14 Purchase request reception part 15 Customer database 20 OTP authentication system 21 OTP authentication application reception server 22 Download server 23 Authentication server 24 Authentication database 30 Card carrier Server 31 OTP serial registration unit 32 Authentication processing unit 33 Conversion table 40 Authorization system 50 3-D authentication server 60 Customer terminal (PC)
70 Customer terminal (mobile phone)

Claims (10)

A member store server of a member store that sells products or services and a card that issues a credit card for authenticating a user who purchases the product or service using a credit card at a member store of the credit card using a one-time password An authentication system comprising a card company server of a business operator and an authentication server that performs user authentication processing,
The member store server is
User information storage means for storing a user ID for identifying a user and an OTP serial assigned to authenticate the user with a one-time password in association with each other;
Login request receiving means for receiving a login request from the user terminal operated by the user to the member store server in which the user ID of the user is designated;
A first OTP serial reading means for reading from the user information storage means an OTP serial associated with the user ID of the user whose log-in request accepting means has accepted the log-in request;
First OTP accepting means for accepting a one-time password input to the user terminal;
An authentication request transmitting means for transmitting an authentication request designating the OTP serial read by the first OTP serial reading means and the one-time password received by the first OTP receiving means to the authentication server;
An authentication result receiving means for receiving an authentication result for the authentication request transmitted by the authentication request transmitting means from the authentication server;
Purchase request receiving means for receiving a purchase request for purchasing a product or service using a credit card from a user terminal operated by a user who is logged in to the member store server;
A second OTP serial reading unit that reads from the user information storage unit an OTP serial associated with the user ID of the logged-in user whose purchase request receiving unit has received the purchase request;
Second OTP accepting means for accepting a one-time password input to the user terminal;
Purchase information of goods or services designated in the purchase request received by the purchase request receiving means, the OTP serial read by the second OTP serial reading means, and the one-time password received by the second OTP receiving means And purchase information transmitting means for transmitting to the card company server,
The card business server is
Purchase information receiving means for receiving purchase information transmitted from the purchase information transmitting means of the member store server, an OTP serial, and a one-time password;
An authentication request transmitting means for transmitting an authentication request specifying the OTP serial and one-time password received by the purchase information receiving means to the authentication server;
An authentication result receiving means for receiving an authentication result for the authentication request transmitted by the authentication request transmitting means from the authentication server,
The authentication server is
Authentication information storage means for storing an OTP serial assigned to each user who uses one-time password authentication and an OTP seed for generating a one-time password used for authentication in association with each other;
An authentication request receiving means for receiving an authentication request specifying an OTP serial and a one-time password from the member store server or the card carrier server;
If the OTP seed associated with the OTP serial received by the authentication request receiving means is read from the authentication information storage means to generate a one-time password and matches the one-time password received by the authentication request receiving means, the one-time An authentication processing means for authenticating the person who entered the password with the user,
An authentication system using a one-time password, comprising: an authentication result transmitting unit configured to transmit an authentication result by the authentication processing unit to the member store server or the card business server. A member store server of a member store that sells products or services and a card that issues a credit card for authenticating a user who purchases the product or service using a credit card at a member store of the credit card using a one-time password An authentication system comprising a card company server of a business operator and an authentication server that performs user authentication processing,
The member store server is
User information storage means for storing a user ID for identifying a user and an OTP serial assigned to authenticate the user with a one-time password in association with each other;
Login request receiving means for receiving a login request from the user terminal operated by the user to the member store server in which the user ID of the user is designated;
A first OTP serial reading means for reading from the user information storage means an OTP serial associated with the user ID of the user whose log-in request accepting means has accepted the log-in request;
First OTP accepting means for accepting a one-time password input to the user terminal;
An authentication request transmitting means for transmitting an authentication request designating the OTP serial read by the first OTP serial reading means and the one-time password received by the first OTP receiving means to the authentication server;
An authentication result receiving means for receiving an authentication result for the authentication request transmitted by the authentication request transmitting means from the authentication server;
Purchase request receiving means for receiving a purchase request for purchasing a product or service using a credit card from a user terminal operated by a user who is logged in to the member store server;
A second OTP serial reading unit that reads from the user information storage unit an OTP serial associated with the user ID of the logged-in user whose purchase request receiving unit has received the purchase request;
Purchase information transmitting means for transmitting the purchase information of the product or service specified in the purchase request received by the purchase request receiving means and the OTP serial read by the second OTP serial reading means to the card provider server. And comprising
The card business server is
Purchase information receiving means for receiving the purchase information transmitted from the purchase information transmitting means of the member store server and the OTP serial;
OTP accepting means for accepting a one-time password input to the user terminal;
An authentication request transmitting unit for transmitting an authentication request specifying the OTP serial received by the purchase information receiving unit and the one-time password received by the OTP receiving unit to the authentication server;
An authentication result receiving means for receiving an authentication result for the authentication request transmitted by the authentication request transmitting means from the authentication server,
The authentication server is
Authentication information storage means for storing an OTP serial assigned to each user who uses one-time password authentication and an OTP seed for generating a one-time password used for authentication in association with each other;
An authentication request receiving means for receiving an authentication request specifying an OTP serial and a one-time password from the member store server or the card carrier server;
If the OTP seed associated with the OTP serial received by the authentication request receiving means is read from the authentication information storage means to generate a one-time password and matches the one-time password received by the authentication request receiving means, the one-time An authentication processing means for authenticating the person who entered the password with the user,
An authentication system using a one-time password, comprising: an authentication result transmitting unit configured to transmit an authentication result by the authentication processing unit to the member store server or the card business server. The card business server is
Card information storage means for storing the card number of a credit card used by the user and the OTP serial assigned to authenticate the user with a one-time password in association with each other;
Card number reading means for reading out the card number associated with the OTP serial transmitted from the purchase information transmitting means of the member store server from the card information storage means;
An authorization request transmitting means for transmitting an authorization request designating the purchase information received by the purchase information receiving means and the card number read by the card number reading means to an authorization system for executing credit card authorization;
The authentication system according to claim 1, further comprising: an authorization result receiving unit that receives an authorization result for the authorization request transmitted by the authorization request transmitting unit from the authorization system. The card business server is
OTP serial registration request accepting means for accepting an OTP serial registration request in which the card number and OTP serial of the credit card used by the user are designated and a one-time password input to the user terminal from a user terminal operated by the user When,
Second authentication request transmitting means for transmitting an authentication request designating the OTP serial and one-time password received by the OTP serial registration request receiving means to the authentication server;
Second authentication result receiving means for receiving an authentication result for the authentication request transmitted by the authentication request transmitting means from the authentication server;
The card number of the credit card specified in the registration request received by the OTP serial registration request receiving means, on the condition that at least the authentication result received by the second authentication result receiving means is authenticated with the user. 4. An authentication system according to claim 3, further comprising: OTP serial registration means for associating an OTP serial with the card information storage means. In the member store server,
In the user information storage means, the user ID and a password designated for authenticating the user are stored in association with each other,
The member store server is
A password associated with the user ID of the user who has accepted the login request by the login request accepting unit is read from the user information storage unit, and the password is compared with the password specified in the login request accepted by the login request accepting unit. Password determination means for determining the match of
The login of the user whose login request reception means has accepted the login request on condition that the password matches at least in the password determination means and that the authentication result received by the authentication result reception means has been authenticated by the user. The authentication system according to claim 1, further comprising login execution means for executing processing. In the member store server,
In the user information storage means, the user ID and a password designated for authenticating the user are stored in association with each other,
The member store server is
An OTP serial registration request receiving means for receiving an OTP serial registration request in which a user ID for identifying the user and an OTP serial is designated from a user terminal operated by the user;
Password accepting means for accepting a password input to the user terminal;
The OTP serial registration request accepting means reads from the user information storage means the password associated with the user ID of the user who accepted the registration request, and compares the password received by the password accepting means to determine the password match. Password determination means;
OTP serial registration in which the user ID specified in the registration request accepted by the OTP serial registration request accepting means and the OTP serial are associated and registered in the user information storage means on condition that the passwords match at least in the password judging means And an authentication system according to any one of claims 1 to 5. A member store server of a member store that sells products or services and a card that issues a credit card for authenticating a user who purchases the product or service using a credit card at a member store of the credit card using a one-time password An authentication server that is connected to the card business server of the business and performs user authentication processing,
In the member store server,
User information storage means for storing a user ID for identifying a user and an OTP serial assigned to authenticate the user with a one-time password in association with each other;
Login request receiving means for receiving a login request from the user terminal operated by the user to the member store server in which the user ID of the user is designated;
A first OTP serial reading means for reading from the user information storage means an OTP serial associated with the user ID of the user whose log-in request accepting means has accepted the log-in request;
First OTP accepting means for accepting a one-time password input to the user terminal;
An authentication request transmitting means for transmitting an authentication request designating the OTP serial read by the first OTP serial reading means and the one-time password received by the first OTP receiving means to the authentication server;
An authentication result receiving means for receiving an authentication result for the authentication request transmitted by the authentication request transmitting means from the authentication server;
Purchase request receiving means for receiving a purchase request for purchasing a product or service using a credit card from a user terminal operated by a user who is logged in to the member store server;
A second OTP serial reading unit that reads from the user information storage unit an OTP serial associated with the user ID of the logged-in user whose purchase request receiving unit has received the purchase request;
Second OTP accepting means for accepting a one-time password input to the user terminal;
Purchase information of goods or services designated in the purchase request received by the purchase request receiving means, the OTP serial read by the second OTP serial reading means, and the one-time password received by the second OTP receiving means And purchase information transmitting means for transmitting the information to the card company server,
In the card business server,
Purchase information receiving means for receiving purchase information transmitted from the purchase information transmitting means of the member store server, an OTP serial, and a one-time password;
An authentication request transmitting means for transmitting an authentication request specifying the OTP serial and one-time password received by the purchase information receiving means to the authentication server;
An authentication result receiving means for receiving an authentication result for the authentication request transmitted by the authentication request transmitting means from the authentication server, and
Authentication information storage means for storing an OTP serial assigned to each user who uses one-time password authentication and an OTP seed for generating a one-time password used for authentication in association with each other;
An authentication request receiving means for receiving an authentication request specifying an OTP serial and a one-time password from the member store server or the card carrier server;
If the OTP seed associated with the OTP serial received by the authentication request receiving means is read from the authentication information storage means to generate a one-time password and matches the one-time password received by the authentication request receiving means, the one-time An authentication processing means for authenticating the person who entered the password with the user,
An authentication result transmitting means for transmitting an authentication result by the authentication processing means to the member store server or the card business server;
An authentication server using a one-time password. A member store server of a member store that sells products or services and a card that issues a credit card for authenticating a user who purchases the product or service using a credit card at a member store of the credit card using a one-time password An authentication server that is connected to the card business server of the business and performs user authentication processing,
In the member store server,
User information storage means for storing a user ID for identifying a user and an OTP serial assigned to authenticate the user with a one-time password in association with each other;
Login request receiving means for receiving a login request from the user terminal operated by the user to the member store server in which the user ID of the user is designated;
A first OTP serial reading means for reading from the user information storage means an OTP serial associated with the user ID of the user whose log-in request accepting means has accepted the log-in request;
First OTP accepting means for accepting a one-time password input to the user terminal;
An authentication request transmitting means for transmitting an authentication request designating the OTP serial read by the first OTP serial reading means and the one-time password received by the first OTP receiving means to the authentication server;
An authentication result receiving means for receiving an authentication result for the authentication request transmitted by the authentication request transmitting means from the authentication server;
Purchase request receiving means for receiving a purchase request for purchasing a product or service using a credit card from a user terminal operated by a user who is logged in to the member store server;
A second OTP serial reading unit that reads from the user information storage unit an OTP serial associated with the user ID of the logged-in user whose purchase request receiving unit has received the purchase request;
Second OTP accepting means for accepting a one-time password input to the user terminal;
Purchase information of goods or services designated in the purchase request received by the purchase request receiving means, the OTP serial read by the second OTP serial reading means, and the one-time password received by the second OTP receiving means And purchase information transmitting means for transmitting the information to the card company server,
In the card business server,
Purchase information receiving means for receiving purchase information transmitted from the purchase information transmitting means of the member store server, an OTP serial, and a one-time password;
An authentication request transmitting means for transmitting an authentication request specifying the OTP serial and one-time password received by the purchase information receiving means to the authentication server;
An authentication result receiving means for receiving an authentication result for the authentication request transmitted by the authentication request transmitting means from the authentication server, and
Authentication information storage means for storing an OTP serial assigned to each user who uses one-time password authentication and an OTP seed for generating a one-time password used for authentication in association with each other;
An authentication request receiving means for receiving an authentication request specifying an OTP serial and a one-time password from the member store server or the card carrier server;
If the OTP seed associated with the OTP serial received by the authentication request receiving means is read from the authentication information storage means to generate a one-time password and matches the one-time password received by the authentication request receiving means, the one-time An authentication processing means for authenticating the person who entered the password with the user,
An authentication result transmitting means for transmitting an authentication result by the authentication processing means to the member store server or the card business server;
An authentication server using a one-time password. A member store server of a member store that sells products or services and a card that issues a credit card for authenticating a user who purchases the product or service using a credit card at a member store of the credit card using a one-time password An authentication method executed by a card company server of a business operator and an authentication server that performs user authentication processing,
In the member store server, user information storage means for storing a user ID for identifying a user and an OTP serial assigned to authenticate the user with a one-time password in association with each other,
The authentication server includes an authentication information storage unit that stores an OTP serial assigned to each user using authentication using a one-time password and an OTP seed that generates a one-time password used for authentication in association with each other.
A login request receiving step in which the member store server receives a login request from the user terminal operated by the user to the member store server in which the user ID of the user is specified;
A first OTP serial reading step in which the member store server reads from the user information storage means an OTP serial associated with the user ID of the user who has received the login request in the login request receiving step;
A first OTP accepting step in which the member store server accepts a one-time password input to the user terminal;
An authentication request transmitting step in which the member store server transmits an authentication request designating the OTP serial read in the first OTP serial reading step and the one-time password received in the first OTP receiving step to the authentication server. When,
An authentication result receiving step in which the member store server receives an authentication result for the authentication request transmitted in the authentication request transmission step from the authentication server;
A purchase request receiving step for receiving a purchase request for purchasing a product or service using a credit card from a user terminal operated by a user who is logged in to the member store server;
A second OTP serial reading step in which the member store server reads from the user information storage means an OTP serial associated with the user ID of the logged-in user who has received the purchase request in the purchase request receiving step;
A second OTP accepting step in which the member store server accepts a one-time password input to the user terminal;
The member store server purchase information of the product or service specified in the purchase request received in the purchase request reception step, the OTP serial read in the second OTP serial read step, and the second OTP reception step. A purchase information transmission step of transmitting the one-time password received in step 1 to the card carrier server;
A purchase information receiving step in which the card company server receives the purchase information transmitted in the purchase information transmission step by the member store server, an OTP serial, and a one-time password;
An authentication request sending step for sending an authentication request specifying the OTP serial and the one-time password received in the purchase information receiving step to the authentication server,
An authentication result receiving step in which the card operator server receives an authentication result for the authentication request transmitted in the authentication request transmission step from the authentication server;
An authentication request receiving step in which the authentication server receives an authentication request specifying an OTP serial and a one-time password from the member store server or the card carrier server;
The authentication server reads the OTP seed associated with the OTP serial received in the authentication request receiving step from the authentication information storage unit to generate a one-time password, and matches the one-time password received in the authentication request receiving step If so, an authentication processing step for authenticating the person who entered the one-time password with the user,
An authentication result transmitting step in which the authentication server transmits an authentication result in the authentication processing step to the member store server or the card business server;
An authentication method using a one-time password. A member store server of a member store that sells products or services and a card that issues a credit card for authenticating a user who purchases the product or service using a credit card at a member store of the credit card using a one-time password An authentication method executed by a card company server of a business operator and an authentication server that performs user authentication processing,
In the member store server, user information storage means for storing a user ID for identifying a user and an OTP serial assigned to authenticate the user with a one-time password in association with each other,
The authentication server includes an authentication information storage unit that stores an OTP serial assigned to each user using authentication using a one-time password and an OTP seed that generates a one-time password used for authentication in association with each other.
A login request receiving step in which the member store server receives a login request from the user terminal operated by the user to the member store server in which the user ID of the user is specified;
A first OTP serial reading step in which the member store server reads from the user information storage means an OTP serial associated with the user ID of the user who has received the login request in the login request receiving step;
A first OTP accepting step in which the member store server accepts a one-time password input to the user terminal;
An authentication request transmitting step in which the member store server transmits an authentication request designating the OTP serial read in the first OTP serial reading step and the one-time password received in the first OTP receiving step to the authentication server. When,
An authentication result receiving step in which the member store server receives an authentication result for the authentication request transmitted in the authentication request transmission step from the authentication server;
A purchase request receiving step for receiving a purchase request for purchasing a product or service using a credit card from a user terminal operated by a user who is logged in to the member store server;
A second OTP serial reading step in which the member store server reads from the user information storage means an OTP serial associated with the user ID of the logged-in user who has received the purchase request in the purchase request receiving step;
The member store server sends the purchase information of the product or service designated in the purchase request received in the purchase request reception step and the OTP serial read in the second OTP serial read step to the card carrier server. A purchase information transmission step for transmission;
A purchase information receiving step in which the card company server receives the purchase information transmitted in the purchase information transmission step by the member store server and the OTP serial;
An OTP accepting step in which the card company server accepts a one-time password input to the user terminal;
An authentication request transmitting step for transmitting an authentication request designating the OTP serial received in the purchase information receiving step and the one-time password received in the OTP receiving step to the authentication server;
An authentication result receiving step in which the card operator server receives an authentication result for the authentication request transmitted in the authentication request transmission step from the authentication server;
An authentication request receiving step in which the authentication server receives an authentication request specifying an OTP serial and a one-time password from the member store server or the card carrier server;
The authentication server reads the OTP seed associated with the OTP serial received in the authentication request receiving step from the authentication information storage unit to generate a one-time password, and matches the one-time password received in the authentication request receiving step If so, an authentication processing step for authenticating the person who entered the one-time password with the user,
An authentication result transmitting step in which the authentication server transmits an authentication result in the authentication processing step to the member store server or the card business server;
An authentication method using a one-time password.

Images