JP2017139563A - Code number inquiry system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To make it possible to inhibit a code number from being leaked from data transmitted to a card member requiring inquiry of the code number and limit a time in which the card member can access the code number.SOLUTION: A code number inquiry system 6 according to the embodiment includes a service server 3 that performs calculation using a function taking a token ID of a token 1 possessed by a card member 5, the current time, and a challenge code as parameters to search for a challenge code at the time when a value obtained from the function agrees with the card member 5's code number. The token 1 possessed by the card member 5, when a challenge code is input to the token 1, uses a function shared with the service server 3 to generate a code number from a token ID stored by the token, the current time, and the challenge code; and displays the generated code number on a display 13.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a technique for inquiring a card member about a password that the card member has forgotten.

  A card system using a card is generally configured to authenticate a card member who uses the card system by using a card storing a card number and a card member's personal identification number. . If at least one of these is missing, the card system fails to authenticate the card member, and the card member cannot use the card system. For this reason, when the card member is lost, the card member requests the card issuing company to reissue the card, and when the card member forgets the code number, the card member requests the card issuing company to check the code number.

  In the past, it has been necessary to visit the card issuer's store to ask for the PIN, or to ask the card issuer to send mail with the PIN printed. . However, since the above-described method is not convenient, various methods for conveniently inquiring a card member with a password are proposed by the patent literature.

  Patent Document 1 proposes a method of using an e-mail for a personal identification number inquiry as a method for conveniently querying a personal identification number. In addition, a method has been proposed in which a card member can authenticate using unique information, and when the authentication using the card member specific information is successful, the PIN is referred. For example, Patent Document 2 discloses an invention in which a password is notified to a card member when the voiceprint authentication is successful as authentication using information unique to the card member. Further, although it is not an invention related to the personal identification number reference, Patent Document 3 discloses a system in which a transaction can be performed if fingerprint authentication, which is authentication using information unique to a card member, is successful even if the personal identification number is forgotten.

JP 2003-242114 A JP-A-2005-70907 JP 11-338947 A

  However, there is a problem that if the card member's personal identification number itself is transmitted as electronic data to the card member's terminal device in order to inquire the personal identification number for convenience, the personal identification number may be leaked from the card member's terminal device due to illegal programs. . One way to prevent the security code from being leaked is to scramble (eg, encrypt) the security code sent to the cardholder's terminal device, but the card member who requested the security code inquires about the security code. It is more desirable to be able to limit the time that can be viewed.

  SUMMARY OF THE INVENTION Accordingly, it is an object of the present invention to prevent a personal identification number from being leaked from data transmitted to a card member who has requested a personal identification number inquiry, and to limit the time during which the personal identification number can be viewed by the card member. And

  In the first invention for solving the above-described problem, when a password reference request is received from a terminal device possessed by a card member, the token ID of the token possessed by the card member, the time at this time, and the challenge code are used as parameters. A password that performs an operation using a function, searches for the challenge code when a value obtained from the function matches the password of the card member, and executes a process of transmitting the searched challenge code to the terminal device A service server having a number inquiry unit, a number input unit used for inputting numbers, and when the challenge code is input using the number input unit, using the function common to the service server, A password is generated from the token ID stored at the time, the time at this time and the challenge code, and the generated password is A personal identification number inquiry system, characterized in that it comprises a token including a personal identification number generation unit for executing processing for displaying on the display. Further, the second invention is the service server described in the first invention.

  According to the present invention, since a challenge code not directly related to a personal identification number is transmitted to a terminal device possessed by the card member who has requested the personal identification number, data to be transmitted to the card member is not transmitted. PIN does not leak from. The token that can generate a correct password is limited to a token that has the same function as that of the service server and stores the token ID used when the service server searches for a challenge code. Furthermore, the time when this token can generate a correct password is limited to the time when the service server searches for the challenge code.

The figure which showed the structure of the PIN code inquiry system. The block diagram of a PIN code inquiry system. The figure explaining the process performed with a PIN code inquiry system.

  From here, preferred embodiments of the present invention will be described. The following description is not intended to limit the technical scope of the present invention, but is provided to aid understanding.

  FIG. 1 shows the configuration of a password reference system 6 according to this embodiment. 1 is operated by the card issuing company, the terminal device 2 used by the card member 5 holding the card 50, the token 1 distributed to the card member 5 by the card issuing company, and the card issuing company. It comprises at least a service server 3. In FIG. 1, the terminal device 2 and the service server 3 are connected via a network 4, but the token 1 operates stand-alone for the purpose of preventing infection of unauthorized programs.

  The service server 3 is a device that provides various services related to the card to the card member 5 using a website. The service server 3 provides the card member 5 with a password reference service for a password used in a card system (for example, an automatic teller machine) as one of various services related to the card. In this embodiment, when the service server 3 notifies the card member 5 of the password of the card member 5 that has received the inquiry request, the service server 3 does not transmit the password itself to the terminal device 2 but generates the password on the token 1 side. The challenge code, which is a data string that is necessary for the operation and is a meaningless numeric string, is transmitted to the terminal device 2.

  The terminal device 2 possessed by the card member 5 is a device used when the card member 5 uses the service provided by the service server 3. When the card member 5 uses the password reference service, the terminal device 2 receives a challenge code, which is a meaningless number string, from the service server 3 and is necessary for generating the password on the token 1 side. Sent.

  The token 1 possessed by the card member 5 becomes a device that can generate a personal identification number using the challenge code generated by the service server 3. The token 1 possessed by the card member 5 generates a personal identification number using the challenge code input to the token 1 by the card member 5 and displays the generated personal identification number on the display 13 of the token 1.

  FIG. 2 shows a block diagram of the password reference system 6 according to the present embodiment. FIG. 2 shows only functions necessary for the description of the present invention.

  The service server 3 is an apparatus realized by a server having a CPU, a memory, a network interface, and the like. The service server 3 includes a login authentication unit 30 and a password reference unit 31 as functions realized by a computer program that operates a server used as the service server 3. The service server 3 includes a clock circuit 32 that measures time in a predetermined unit time, and is further connected to a card member DB 33.

  The card member DB 33 is a DB that stores information related to the card member 5 for each card member 5. In the present embodiment, as information related to the card member 5, the contact information (here, the e-mail address) of the card member 5 and the password of the card member 5 are associated with the card number of the card 50 held by the card member 5. The number is stored in the card member DB 33.

  The login authentication unit 30 of the service server 3 is a function for authenticating the card member 5 at the start of use of the service server 3. For the login authentication of the card member 5, an ID number used for specifying the card member 5 accessing the service server 3 and authentication information for confirming the validity of the card member 5 accessing the service server 3 are required. In this embodiment, the card number of the card 50 possessed by the card member 5 is used as this ID number. In this embodiment, the token 1 is provided with a function for generating a time-synchronized one-time password (OTP), and the time-synchronized OTP is used for this authentication information. The authentication information used for login authentication may be a login password set by the card member 5 in the service server 3.

  The password reference unit 31 of the service server 3 is a function for providing the card member 5 with a password reference service. The personal identification number inquiry unit 31 of the service server 3 performs an operation using a function having the token ID of the card member 5 possessed by the card member 5, the time and the challenge code as parameters, as processing relating to the personal identification number inquiry. , A process for searching for a challenge code when the value obtained from the function becomes the password of the cardholder 5 is executed. Further, the personal identification number inquiry unit 31 of the service server 3 performs processing for transmitting the searched challenge code to the terminal device 2 in a predetermined format (here, mail format).

  When searching for a challenge code, the password reference unit 31 of the service server 3 starts with an initial value (for example, all digits are “0”) and generates a value using a function common to the token 1 However, the value is repeatedly generated while changing the challenge code until it matches the personal identification number of the card member 5. When the number of digits of the value obtained from the function common to token 1 is different from the number of digits of the personal identification number, the unnecessary number of digits of the value obtained from the function common to token 1 may be masked. As a function used by the password reference unit 31 of the service server 3 for searching for a challenge code, for example, a one-way hash function can be used in the same way as a one-time password. It should be noted that the token ID is used as one of the parameters of the function for generating the personal identification number because the same function as that of the service server 3 is set, and the personal identification is performed only for the token 1 possessed by the card member 5 who requested the personal identification number inquiry. This is so that a number can be generated. The time when the challenge code is searched is used to limit the time during which the password can be generated on the token 1 side within this time.

  The terminal device 2 is a device realized using a computer including a CPU, a memory, a network interface, and the like. In FIG. 1, the terminal device 2 is illustrated as a smartphone, but the terminal device 2 may be a personal computer or a tablet computer.

  The terminal device 2 according to the present embodiment accesses the service server 3 based on a predetermined protocol as a function realized by a computer program that operates a computer used as the terminal device 2, and provides the card service from the service server 3. A client unit 20 is provided, and a display 21 for displaying data is further provided.

  The client unit 20 of the terminal device 2 can be realized by one or a plurality of applications installed in the terminal device 2. In the present embodiment, the client unit 20 is realized by the web browser 200 and the mail client 201. The web browser 200 is an application for accessing the service server 3 based on the HTTP protocol. The mail client 201 is an application for receiving a challenge code from the service server 3.

  The token 1 is a device that is realized by a physical device including a CPU, a memory, and the like. The token 1 according to the present embodiment stores a token ID that is data unique to each token 1 in a memory. As a function realized by a computer program for operating a physical device used as the token 1, a personal identification number generator 11 and an OTP generator 10 are provided. In addition, the token 1 according to the present embodiment includes a number input unit 12 (here, a numeric keypad) used for inputting a challenge code, a display 13 for displaying a personal identification number generated using at least the challenge code, a service, A clock circuit 14 that measures time in the same unit time as the clock circuit 32 of the server 3 and is synchronized with the clock circuit 32 of the service server 3 is provided. Although not shown in FIG. 2, the token 1 has a built-in battery so that it can operate stand-alone.

  As described above, the service server 3 searches for a challenge code using a function whose parameters are the password of the card member 5, the token ID of the token 1, and the time when the challenge code is searched. 1 is used in common with the service server 3 by using the token ID stored in itself, the time obtained from the clock circuit 14 at this time, and the token ID input to the token 1. Using this function, a password is generated, and the generated password is displayed on the display 13.

  The OTP generation unit 10 of the token 1 generates a time synchronous OTP used for login authentication. Specifically, when an OTP generation operation is performed, the OTP generation unit 10 of the token 1 converts a message including the token ID and the time at this time by a predetermined function (for example, a one-way hash function). A time synchronous OTP is generated, and a process of displaying the time synchronous OTP on the display is performed.

  From here, the process performed by the personal identification number inquiry system 6 which concerns on this embodiment is demonstrated. FIG. 3 is a diagram for explaining processing executed by the personal identification number inquiry system 6.

  When the card member 5 requests the card issuing company to ask for a password, the card member 5 performs an operation for accessing the service server 3 operated by the card issuing company on the terminal device 2, and the terminal device 2 performs service. The server 3 is accessed (S1). In this embodiment, the operation of accessing the service server 3 is performed by activating the web browser 200 of the terminal device 2 and then using the bookmark of the web browser 200 or the like to the URL of the service server 3 as the access destination URL. It becomes an operation to set.

  When accessed from the terminal device 2, the service server 3 transmits a login page including an input form of a card number and authentication information (here, OTP in the time synchronization method) to the terminal device 2 (S2). The web browser 200 of the terminal device 2 displays the login page received from the service server 3 on the display 21 of the terminal device 2 (S3).

  When the login page is displayed on the display 21 of the terminal device 2, the card member 5 performs an operation for generating a time synchronization type OTP with the token 1, and the OTP generation unit 10 of the token 1 performs the time synchronization type OTP. Generated and displayed on the display 13 (S4).

  The card member 5 inputs the card number of the card possessed by the card member 5 and the time-synchronized OTP displayed on the token 1 display in the login form displayed on the display 21 of the terminal device 2 ( S5) An operation for requesting login is performed. When an operation for requesting login is performed, the web browser 200 of the terminal device 2 transmits the card number and the time synchronization type OTP to the service server 3 (S6).

  When the card number and the time synchronization type OTP are transmitted from the terminal device 2, the login authentication unit 30 of the service server 3 is activated, and the login authentication unit 30 performs login authentication of the card member 5 using these (S7). . When performing login authentication, the login authentication unit 30 of the service server 3 generates a time-synchronized OTP using the token ID of the token 1 possessed by the card member 5 and the time at this time, and receives it from the terminal device 2. Check OTP of time synchronization method. Note that the token ID of the token 1 possessed by the card member 5 is stored in the card member DB 33 in a state associated with the card number transmitted from the terminal device 2.

  When the login authentication unit 30 of the service server 3 succeeds in the login authentication of the card member 5, the service server 3 transmits a service selection page that allows the card member 5 to select the card service to the terminal device 2 (S8). The web browser 200 of the terminal device 2 displays the service selection page received from the service server 3 on the display 21 of the terminal device 2 (S9).

  When the card member 5 selects a password reference service from the card services that can be selected using the service selection page (S10), the web browser 200 of the terminal device 2 transmits a password reference request to the service server 3. (S11).

  When a personal identification number inquiry request is transmitted from the terminal device 2, the personal identification number inquiry unit 31 is activated, and the personal identification number inquiry unit 31 of the service server 3 includes the token ID of the token 1 possessed by the card member 5 and the time at this time. Then, a challenge code whose value obtained from the function using the challenge code as a parameter matches the password of the card member 5 is searched (S12). The password of the logged-in card member 5 is stored in the card member DB 33 in a state associated with the card number transmitted from the terminal device 2. Further, the token ID of the token 1 possessed by the logged-in card member 5 has already been acquired.

  The personal identification number inquiry unit 31 of the service server 3 transmits the challenge code to the terminal device 2 in a predetermined format (S13). In the present embodiment, since the terminal device 2 includes the mail client 201, the personal identification number inquiry unit 31 of the service server 3 transmits an e-mail with a challenge code to the e-mail address of the card member 5.

  In the mail client 201 of the terminal device 2, the mail address of the card member 5 is set in the mail account, and the mail client 201 of the terminal device 2 receives the e-mail with the challenge code from the service server 3 (S14). ).

  When the mail client 201 of the terminal device 2 receives this e-mail, the card member 5 displays the e-mail on the display 21 of the terminal device 2 and then operates the number input unit 12 of the token 1 to operate the e-mail. Is entered in token 1 (S15).

  The secret code number generation unit 11 of the token 1 uses the token ID stored in itself, the time obtained from the clock circuit 14 at this time, and the token ID input to the token 1, and functions common to the service server 3. Is used to generate a password (S16), and the generated password is displayed on the display 13 (S17). As described above, when the token ID used by the service server 3 matches the token ID of the token 1 and the time when the token 1 generates the password is the time when the service server 3 searches for the challenge code If the time is not changed, the correct password is displayed on the display 13 of the token 1.

  As described above, the service server 3 according to the present embodiment transmits only the challenge code, which is a meaningless numeric string, to the terminal device 2 because it is data that is required when generating the password on the token 1 side. The password of the card member 5 is not leaked from the data transmitted from the service server 3 to the terminal device 2. Further, when the token 1 generates the password, if the time when the token 1 generates the password is not different from the time when the service server 3 searches for the challenge code, the correct password is excluded except for coincidence. A number cannot be generated. Furthermore, when the token 1 generates the password from the challenge code, if the token ID used by the service server 3 does not match the token ID of the token 1, a correct password cannot be generated except for a coincidence.

  That is, in the personal identification number inquiry system 6 according to the present embodiment, the token 1 that can generate a correct personal identification number is set with the same function as the service server 3, and stores the token ID used by the service server 3 when searching for a challenge code. It is limited to token 1 Further, the period during which the correct password can be generated is limited to the time when the service server 3 generates the challenge code. The unit time generally used for a one-time password is 30 seconds or 1 minute. Assuming that time synchronization will occur between the service server 3 and the token 1, the service server 3 and the token 1 It is considered that the unit time for measuring time is preferably 2 minutes or 3 minutes.

DESCRIPTION OF SYMBOLS 1 Token 10 One-time password (OTP) production | generation part 11 Security code generation part 12 Number input part 13 Display 14 Clock circuit 2 Terminal device 20 Client part 200 Web browser 201 Mail client 3 Service server 30 Login authentication part 31 Security code reference part 32 Clock circuit 33 Card member DB
4 Network 5 Card member 6 PIN reference system

Claims (2)

When a password reference request is received from a terminal device possessed by a card member, an operation is performed using a function having the token ID of the token possessed by the card member, the time at this time, and a challenge code as parameters. A service server provided with a personal identification number inquiry unit for searching for the challenge code when a value to be matched with the personal identification number of the card member and executing the process of transmitting the retrieved challenge code to the terminal device;
When the challenge code is input using the number input unit for inputting numbers and the number input unit, the token ID stored by itself using the function common to the service server, A token having a password generation unit for generating a password from the time and the challenge code and displaying the generated password on a display;
A password reference system characterized by comprising: The service server according to claim 1.

Images