JP2011164821A - Authentication service method and system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication service having high security. <P>SOLUTION: An authentication service method is a method executed by a system which includes an OTP token, a terminal, an exclusive site for a net shop, and an authentication server and in which the terminal, the exclusive site, and the authentication server are connected to a network, the terminal transmits an input card number to the exclusive site, the exclusive site transmits a request for user authentication of a credit card identified by the received card number to the authentication server, the authentication server, upon receiving the request for user authentication of the credit card identified by the received card number, creates challenge data and transmits it to the terminal, the OTP token, on the basis of the challenge data that have been received at the terminal and input, creates a one-time password, the terminal transmits the input one-time password to the authentication server, and the authentication server, on the basis of the received one-time password, performs user authentication, and transmits the authentication result to the exclusive site. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an authentication service.

  In general, 3D secure is known as a user authentication service necessary for credit card payment in a network such as the Internet.

  In this 3D secure, a password is registered in the authentication server in advance, and the user is prompted to transmit the password when making a credit card payment over the network.

  In general, it is also known to use a time-based one-time password as a user authentication service necessary for credit card payment in a network such as the Internet.

  This time-based one-time password is generated when a user has a one-time password generator that generates a one-time password in synchronization with the authentication server in advance and makes a credit card payment over the network. The user is prompted to send a one-time password.

  These services have a risk of so-called phishing, in which a third party is assumed to be an authentication server and invites a password or one-time password to be transmitted to a server other than the authentication server, and the password or one-time password is stolen.

  Also, with a time-based one-time password, if the one-time generator is stolen, and if the ID and password necessary for logging in to the net shop are known in advance, the risk of impersonation increases.

  The present invention has been made in view of such background art, and an object thereof is to provide an authentication service having high security.

In order to solve the above-mentioned problems in the present invention, first, the invention of claim 1 includes an OTP token, a terminal, a dedicated site for a net shop, and an authentication server. A system that is connected to the
The terminal sends the entered card number to a dedicated site;
A process in which the dedicated site transmits a request for user authentication of the credit card identified by the received card number to the authentication server;
When the authentication server receives a request for user authentication of a credit card identified by the received card number, a step of generating challenge data and transmitting it to the terminal;
A step of generating a one-time password based on challenge data received and inputted by the terminal at the OTP token;
The terminal sends the entered one-time password to the authentication server;
The authentication service method is characterized in that the authentication server includes a step of performing user authentication based on the received one-time password and transmitting an authentication result to a dedicated site.

  The invention of claim 2 further includes the step of allowing the challenge code to be input only when the OTP token performs user authentication based on the input PIN and the authentication is successful. The authentication service method is as described.

Further, in the invention of claim 3, the authentication server has a database that stores the card number and the presence / absence of possession of the OTP token as a pair,
When the authentication server receives a request for user authentication of a credit card identified by the received card number, the authentication server is identified by the received card number instead of generating challenge data and transmitting it to the terminal. When a credit card user authentication request is received, it is checked whether or not an OTP token is paired with this card number by referring to the database, and if there is no OTP token, this is sent to a dedicated site, The authentication service method according to claim 1, further comprising a step of generating challenge data and transmitting the challenge data to a terminal when possessing an OTP token.

In the invention of claim 4,
A system comprising an OTP token, a terminal, a dedicated site for a net shop, and an authentication server, wherein the terminal, the dedicated site, and the authentication server are connected to a network,
The OTP token has means for generating a one-time password based on challenge data received and input by the terminal.
The terminal has means for sending the entered card number to a dedicated site, and means for sending the entered one-time password to the authentication server,
The dedicated site has means for transmitting a request for user authentication of the credit card identified by the received card number to the authentication server,
When the authentication server receives the request for user authentication of the credit card identified by the received card number, the authentication server performs user authentication based on the means for generating challenge data and transmitting it to the terminal and the received one-time password. The authentication service system includes a means for transmitting the authentication result to a dedicated site.

  Further, in the invention of claim 5, the OTP token performs user authentication based on the input PIN, and has means for enabling input of a challenge code only when the authentication is successful. This is the authentication service system described.

  Further, in the invention of claim 6, the authentication server is a user authentication of a credit card identified by a database storing the card number and the presence / absence of possession of the OTP token, and the card number received by the dedicated site. When receiving a request for user authentication of a credit card identified by the received card number, instead of means for generating challenge data and transmitting it to the terminal, the card number and A means for confirming whether or not a pair of OTP tokens is possessed, and transmitting this to a dedicated site if there is no possession of an OTP token; 6. An authentication service system according to claim 4 or 5, wherein

  According to the first and fourth aspects of the present invention, even if a third party is invited to transmit a one-time password to a server other than the authentication server pretending to be an authentication server, the server different from this authentication server As long as the same challenge data is not sent to the terminal, the one-time password cannot be stolen, so that it is possible to cope with a phishing scam.

  In the inventions of claims 2 and 5, even if an OTP token is stolen, it is impossible to input a challenge code for generating a one-time password unless a user is successfully authenticated by entering a PIN. This has the effect of reducing risk.

  According to the inventions of claims 3 and 6, the net shop can know whether or not the user who intends to pay with a credit card has an OTP token, and can prompt the user to possess the OTP token. effective.

  As described above, the present invention has an effect of providing an authentication service having high security.

The figure which shows the structural example of the system which concerns on this invention. The flowchart which shows the example of the flow of the user authentication process for the payment by a credit card.

  An embodiment of the present invention will be described below.

  As shown in FIG. 1, the system according to the present invention includes a user terminal, an OTP (One Time Password) token, a credit card, a dedicated site for an online shop, an authentication server of a card company or a third party data center, These terminals, a dedicated site, and an authentication server are connected to a network such as the Internet.

  The OTP token is a password generation device, and is given by a card company only to a credit card user who desires user authentication with a one-time password.

  A one-time password is generated based on challenge data that changes randomly every time it is sent from the authentication server using an OTP token, and is a password that changes randomly every time it is generated. It is used for authentication.

  The authentication server generates the same one-time password as the OTP token based on the challenge data, and verifies the generated one-time password against the one-time password that has been sent. (Also called password authentication).

  The OTP token performs user authentication using a PIN (Personal identification number), and a challenge code can be input only when the authentication is successful, thereby making it possible to generate a one-time password.

  The authentication server has a database that stores a card number and a credit card user identified by the card number in pairs with or without an OTP token.

  Below, an example of the flow of the user authentication process for the payment with a credit card is demonstrated according to the flowchart of FIG.

S (STEP) 1;
A user logs in to a dedicated site of a net shop from a terminal with an ID and a password and performs shopping.

S (STEP) 2;
When the user inputs a card number on the Web screen of the terminal for payment by credit card, the terminal transmits the input card number to a dedicated site of the net shop.

S (STEP) 3;
Upon receiving the card number, the dedicated site of the net shop transmits a request for user authentication using a one-time password for the user of the credit card identified by the received card number to the authentication server together with the received card number.

S (STEP) 4;
When the authentication server receives a request for user authentication using a one-time password together with the card number, the authentication server refers to the database to check whether the credit card user identified by the received card number has an OTP token.

S (STEP) 5;
If you do not have an OTP token, go to STEP 6
On the other hand, if there is an OTP token, the process proceeds to STEP7.

S (STEP) 6;
The authentication server transmits no possession of the OTP token to the exclusive site of the net shop, and proceeds to STEP13.

S (STEP) 7;
The authentication server generates challenge data (random numerical sequence) and transmits it to the user's terminal, and stores the generated challenge data in association with the user and the generation time.

S (STEP) 8;
When the user receives the challenge data at the terminal, the user inputs a PIN (Personal identification number) in the OTP token.

S (STEP) 9;
When the OTP token authenticates the user with the entered PIN, and the authentication is successful and the challenge data can be input, the user inputs the received challenge data into the OTP token.

S (STEP) 10;
The OTP token generates and outputs a one-time password based on the input challenge data.

S (STEP) 11;
When the user inputs the output one-time password to the terminal, the terminal transmits the input one-time password to the authentication server.

S (STEP) 12;
Upon receiving the one-time password, the authentication server performs the same operation as the user's OTP token based on the stored challenge data, generates a one-time password, and compares the received password with the generated password. One-time password authentication is performed, and if it matches, the one-time password authentication result indicating that the authentication is successful and the authentication failure is sent if they are different is transmitted to a dedicated site of the net shop.

S (STEP) 13;
When the dedicated server of the net shop has no OTP token or receives a one-time password authentication result, it performs processing to complete the transaction.

  In this way, since a one-time password is generated based on challenge data randomly generated by the authentication server and used for authentication, a one-time password generated only from the time and the formula held by the OTP token is used. Compared with the case where the time password is used for authentication, the security is improved and the risk of phishing can be reduced.

Claims (6)

A method executed by a system including an OTP token, a terminal, a dedicated site for a net shop, and an authentication server, wherein the terminal, the dedicated site, and the authentication server are connected to a network,
The terminal sends the entered card number to a dedicated site;
A process in which the dedicated site transmits a request for user authentication of the credit card identified by the received card number to the authentication server;
When the authentication server receives a request for user authentication of a credit card identified by the received card number, a step of generating challenge data and transmitting it to the terminal;
A step of generating a one-time password based on challenge data received and inputted by the terminal at the OTP token;
The terminal sends the entered one-time password to the authentication server;
An authentication service method comprising: an authentication server performing user authentication based on the received one-time password and transmitting an authentication result to a dedicated site.   2. The authentication service method according to claim 1, further comprising a step of allowing a challenge code to be input only when the OTP token performs user authentication based on the input PIN and the authentication is successful. The authentication server has a database that stores the card number and the presence / absence of an OTP token in pairs,
When the authentication server receives a request for user authentication of a credit card identified by the received card number, the authentication server is identified by the received card number instead of generating challenge data and transmitting it to the terminal. When a credit card user authentication request is received, it is checked whether or not an OTP token is paired with this card number by referring to the database, and if there is no OTP token, this is sent to a dedicated site, 3. The authentication service method according to claim 1, further comprising a step of generating challenge data and transmitting the challenge data to the terminal when possessing the OTP token. A system comprising an OTP token, a terminal, a dedicated site for a net shop, and an authentication server, wherein the terminal, the dedicated site, and the authentication server are connected to a network,
The OTP token has means for generating a one-time password based on challenge data received and input by the terminal.
The terminal has means for sending the entered card number to a dedicated site, and means for sending the entered one-time password to the authentication server,
The dedicated site has means for transmitting a request for user authentication of the credit card identified by the received card number to the authentication server,
When the authentication server receives the request for user authentication of the credit card identified by the received card number, the authentication server performs user authentication based on the means for generating challenge data and transmitting it to the terminal and the received one-time password. And an authentication service system comprising means for transmitting an authentication result to a dedicated site.   5. The authentication service system according to claim 4, wherein the OTP token performs user authentication based on the input PIN, and has means for allowing a challenge code to be input only when the authentication is successful. When the authentication server receives a request for user authentication of a credit card identified by the card number received by the dedicated site and the database storing the card number and the presence or absence of possession of the OTP token, the challenge data When a request for user authentication of a credit card identified by the received card number is received instead of the means for generating and transmitting to the terminal, the presence or absence of an OTP token paired with this card number by referring to the database And, when there is no possession of the OTP token, this is transmitted to a dedicated site, and when there is possession of the OTP token, the challenge data is generated and transmitted to the terminal. Item 6. An authentication service system according to item 4 or 5.

Images