JP2018200715A - Authentication proxy server and authentication proxy system - Google Patents

Abstract

To allow more financial institutions to provide service using an account processing instruction device.SOLUTION: An authentication proxy server which a financial institution A has includes: authentication proxy management data 5 managing an account of the financial institution A, an account of a financial institution B, and a personal identification number set to the account of the financial institution B in association with one another; and an authentication proxy processing part 33 which receives first account data that identifies a first account to be a user's account in the financial institution A, makes a user input the personal identification number about a second account to be the account of the financial institution B associated therewith when the account of the financial institution B is associated with the first account, determines whether or not the authentication data inputted by the user matches the personal identification number set to the second account managed in association with the first account, when they match, generates instruction data in accordance with an instruction of account processing for the second account received from the user, and transmits the generated instruction data to a processing server of the financial institution B.SELECTED DRAWING: Figure 1

Description

The present invention relates to a technique for performing account processing for an account opened in a financial institution using an account processing instruction device such as an ATM (automated teller machine), and more particularly to an authentication technique for account processing.

For example, a technique is known that withdraws money from an account of a financial institution and charges electronic money corresponding to the withdrawal amount to an electronic money medium such as an IC card or a mobile phone (for example, Patent Document 1).

JP 2009-48308 A

By the way, a financial institution is an account processing instructing device (a device that instructs account processing such as deposit processing and withdrawal processing for an account of a financial institution in response to a user request. For example, an ATM (automatic teller machine) In order to provide a service using)) to the user, it is usually necessary for the financial institution to install an account processing instruction device or issue a cash card. However, installation of an account processing instruction device and issuance of a cash card are expensive. For this reason, there are financial institutions that are unable to provide the service even though they want to provide a service using the account processing instruction device.

Therefore, an object of the present invention is to enable more financial institutions to provide a service using an account processing instruction device.

The authentication proxy server according to one embodiment of the present invention is a server possessed by a first financial institution, and performs authentication for account processing for an account of a second financial institution different from the first financial institution. The second financial institution has a processing server for performing account processing for the account of the second financial institution in accordance with instruction data for instructing account processing, and the first financial institution Management means for associating and managing an account of a financial institution, an account of the second financial institution, and authentication data set in the account of the second financial institution, and use in the first financial institution Account data receiving means for receiving first account data for specifying a first account that is a user's account, and the second financial institution in the first account specified by the received first account data No accounts Authentication data input instruction means for causing the user to input authentication data related to a second account that is an account of the second financial institution associated with the first account, Authentication data receiving means for receiving authentication data relating to the second account input by a user, and the second account in which the received authentication data is managed in association with the first account Authentication means for determining whether or not it matches the authentication data set in the above, and if a determination result that matches in the determination is obtained, an instruction for account processing for the second account is received from the user Accepting account processing instruction receiving means, and generating instruction data corresponding to the received account processing instruction, and transmitting the generated instruction data to the processing server of the second financial institution Comprising an instruction data transmission unit.

According to the above configuration, the authentication proxy server can perform the authentication for the account processing for the account of the second financial institution, and the account processing for the second account accepted from the user. Instruction data according to the instruction can be transmitted to the processing server of the second financial institution. Thereby, even if the second financial institution is a financial institution that does not install an account processing instruction device (for example, ATM) or issue a recording medium (for example, a cash card), for example, It becomes possible to provide users with services using.

In a preferred embodiment according to the present invention, an account processing instruction device having input / output means is connected to the authentication proxy server, and the first financial institution is an account opener of the first financial institution. In response, the account data specifying means is used to issue a recording medium in which the account data is recorded, and the account data receiving means uses the account processing instruction device from the recording medium issued to the user. The read account data is received as the first account data from the account processing instruction device, and the authentication data input instruction means displays a screen for inputting authentication data related to the second account. The authentication data receiving means receives the authentication data input by the user via the input / output means from the account processing instruction device, and the account processing The display accepting means displays the screen for instructing account processing for the second account on the input / output means of the account processing instructing device, and then the account processing instructed by the user via the input / output means. May be received from the account processing instruction device.

An authentication agent system according to an embodiment of the present invention is a server included in a first financial institution and performs authentication for account processing for an account of a second financial institution different from the first financial institution. An authentication agency system comprising: an authentication agency server that performs authentication; and an account processing instruction device connected to the authentication agency server, wherein the first financial institution is an account opener of the first financial institution. On the other hand, a recording medium in which account data for specifying the account of the account opener is recorded is issued, and the second financial institution accounts for the account of the second financial institution according to instruction data instructing account processing. The account processing instructing device includes input / output means, and the authentication proxy server includes the account of the first financial institution and the account of the second financial institution. And the relevant Management means that associates and manages authentication data set in an account of a second financial institution, and the account processing instruction device reads out from the recording medium issued to the user, the first financial institution in the first financial institution Account data receiving means for receiving first account data specifying a first account that is a user's account from the account processing instruction device; and the first account specified by the received first account data. When the account of the second financial institution is associated with an account, the use of the authentication data relating to the second account that is the account of the second financial institution associated with the first account A screen for the user to input, an authentication data input instruction means for displaying on the input / output means of the account processing instruction device, and the second account input by the user via the input / output means Authentication data receiving means for receiving certificate data from the account processing instruction device, and authentication received in the second account, wherein the received authentication data is managed in association with the first account A screen for instructing account processing for the second account when a determination result that matches with the authentication means for determining whether or not the data matches is obtained in the determination; An account processing instruction receiving means for receiving from the account processing instruction device notification data for notifying the account processing instructed by the user via the input / output means after being displayed on the input / output means; and the notification Instruction data transmitting means for generating instruction data corresponding to the account processing and transmitting the generated instruction data to the processing server of the second financial institution.

It is a figure which shows the structural example of the computer system provided with the authentication proxy server which concerns on this embodiment. It is a figure which shows an example of authentication agency management data. It is a flowchart explaining an authentication agency process. It is a figure which shows an example of the service menu screen of the financial institution A. It is a figure which shows an example of an authentication screen. It is a figure which shows an example of the service menu screen of the financial institution B. FIG. It is a figure which shows an example of a result screen.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a diagram illustrating a configuration example of a computer system including an authentication proxy server according to the present embodiment.

There are a plurality of financial institutions (in this embodiment, two financial institutions A and B). The financial institution A has one or more ATMs (automated teller machines) 1 installed in its premises or convenience store. The financial institution A issues an ATM card to an account opener of the financial institution A (a person who has opened an account with the financial institution A). Here, the ATM card means that the ATM card owner uses the ATM 1 to perform various processes on the ATM card owner's account (for example, deposit process, withdrawal process, balance inquiry process, Hereinafter, it refers to a card (for example, a cash card) that can be instructed (account processing). On the other hand, financial institution B does not have ATM1. Financial institution B does not issue an ATM card to an account opener of financial institution B (a person who opened an account in financial institution B).

The financial institution A has a financial institution A server 3. The financial institution B has a financial institution B server 4. The financial institution A server 3 is a server machine used by the financial institution A to manage its account (an account opened in the financial institution A). On the other hand, the financial institution B server 4 is a server machine used by the financial institution B to manage its account (an account opened in the financial institution B). The financial institution A server 3 and the financial institution B server 4
It is connected to a communication network (hereinafter “ATM network”) 2 for communicating with M1. A
One or more ATMs 1 are connected to the TM network 2. The ATM 1 shown in FIG. 1 is an ATM installed by the financial institution A, for example. In the following description, financial institution A server 3 and financial institution B
The server 4 is collectively referred to as a “financial institution server”.

The financial institution servers 3 and 4 include, for example, ATM message processing units 31 and 41 and memories 32 and 4.
2 is provided. The functions of the ATM message processing units 31, 41 are, for example, financial institution servers 3, 4
The CPU (not shown) included in the computer is realized by executing a predetermined program stored in the memories 32 and 42.

The ATM message processing units 31 and 41 are processing units that perform account processing for a specified account in accordance with the received ATM message. Here, the ATM telegram refers to instruction data transmitted to the financial institution servers 3 and 4 to instruct the ATM 1 to perform a specific account process. For example, the financial institution A server 3 sends an ATM message (hereinafter, “
When the withdrawal instruction message ") is received from the ATM 1, the ATM message processing unit 31 of the financial institution A server 3 performs the specified financial institution A account (at the operator of the ATM 1) according to the received withdrawal instruction message. (Withdrawal of a specified amount from the account of the ATM1 operator).

When account processing is performed in accordance with the ATM telegram, the AT that instructed the account processing
Authentication is performed as to whether or not the operator of M1 is a valid person (an account opener of a designated account). For example, when the financial institution A server 3 performs account processing in accordance with the received ATM instruction message, whether or not the operator of the ATM 1 instructing the account processing is a valid account opener of the financial institution A. Authentication (hereinafter, “account opening person authentication of financial institution A”) is performed. The account holder authentication of the financial institution A is performed by, for example, the ATM message processing unit 31 of the financial institution A server 3. The ATM message processing unit 31 of the financial institution A server 3 is, for example, an AT inserted in the ATM 1.
The data (hereinafter referred to as “recorded data”) recorded on the M card (issued by the financial institution A) and the PIN number (specified account (specified by the ATM 1 operator)
Based on the personal identification number set in the account of financial institution A), the account opener authentication of financial institution A is performed.

The financial institution A server 3 corresponds to the authentication proxy server according to the present embodiment. The financial institution A server 3 performs processing other than the financial institution A in addition to the processing performed by the ATM telegram processing unit 31 (that is, account processing for the account of the financial institution A according to the received ATM telegram). The account opener of the institution (for example, financial institution B, hereinafter referred to as “other financial institution”)
Using M1, a process for enabling the other financial institution to instruct account processing for its own account is performed. Specifically, the financial institution A server 3 operates the ATM 1 and the person (or the person who has instructed) who is instructing the account processing for the account of another financial institution is a valid account opener of the other financial institution. (Hereinafter referred to as “account opener authentication of other financial institutions”). Then, when the financial institution A server 3 succeeds in the account opener authentication of the other financial institution, the financial institution server of the other financial institution sends an ATM message instructing the account processing designated by the operator of the ATM 1. 4 is transmitted. Hereinafter, processing performed by the financial institution A server 3 (processing for allowing an account opener of another financial institution to instruct account processing using ATM 1) is referred to as “authentication proxy processing”.

Normally, for financial institutions that do not install ATM1 or issue ATM cards, such as financial institution B, the account opener cannot use ATM1 to instruct account processing for that account, but authentication By performing the proxy process, it becomes possible to instruct account processing using ATM1 for such a financial institution.

The account opener authentication of other financial institutions in the authentication agency process is the ATM inserted in ATM1.
The recorded data of the card (issued by financial institution A) and the ATM1 operator
This is performed based on the password entered for 1 (the password set in the designated account (an account of another financial institution)). That is, an ATM card issued by the financial institution A is used for account establishment authentication of other financial institutions. Therefore, in this embodiment, a function provided by the financial institution A server 3 (a function realized by an authentication proxy process, hereinafter referred to as “authentication proxy function”).
The person who can instruct account processing for an account of another financial institution using the above is a person who has opened an account in each of the other financial institution and financial institution A. Details of the authentication proxy process will be described later with reference to FIG.

In addition to the ATM message processing unit 31 and the memory 32, the financial institution A server 3 includes an authentication agent processing unit 33 that performs the authentication agent processing. In addition, authentication proxy management data 5 is stored in the memory 32 of the financial institution A server 3. The function of the authentication agent processing unit 33 is ATM.
Similar to the telegram processing unit 31, the CPU provided in the financial institution A server 3 is implemented by executing a predetermined program stored in the memory 32.

  FIG. 2 is a diagram illustrating an example of the authentication proxy management data 5.

The authentication proxy management data 5 is data that is referred to when the authentication proxy processing unit 33 performs the authentication proxy processing. As shown in FIG. 2, the authentication agency management data 5 includes data relating to an account of a financial institution A (hereinafter “account data of financial institution A”) 51 and data relating to an account of another financial institution (hereinafter referred to as “others”). Financial institution account data ") 52, and the data 51 and 52 are managed in association with each other. The account data 51 of the financial institution A includes, for example, data (for example, a branch name 511 and an account number 512) for specifying an account opened in the financial institution A. The account data 52 of another financial institution includes, for example, data for specifying an account opened in another financial institution (for example, the financial institution name 521, the branch name 522, and the account number 523 of the other financial institution).
) Is included. The account data 52 of another financial institution also includes a password 524 set for the account specified by the account data 52.

As for the account data 52 of another financial institution, the account opener of the account indicated by the account data 51 of the financial institution A associated with the data 52 can instruct account processing using the authentication proxy function. Indicates an account of another financial institution (hereinafter referred to as “authentication agency account”).
That is, in the example of FIG. 2, the data 53 in the first column indicates that the account opener of the account with the account number “XXX” uses the authentication proxy function to set the account number “XXX” of the financial institution B. This indicates that it is possible to instruct account processing for an account of “×”.

For example, the account opener of the financial institution A can register the specified account in advance in the financial institution A server 3 as an authentication proxy account by applying to the financial institution A for registration of the authentication proxy account. Then, at the time of registration (or after that), a password is set in the registered authentication proxy account (the password 524 indicates the password set in the authentication proxy account).

In the example of FIG. 2, one authentication agency account is associated with one financial institution A account, but a plurality of authentication agency accounts are associated with one financial institution A account. It may be attached. That is, one account opener of the financial institution A can register a plurality of authentication agency accounts.

FIG. 3 is a flowchart illustrating the authentication proxy process. FIG. 3 shows that an ATM 1 operator uses an ATM card issued by financial institution A and operates ATM 1 to operate another financial institution (
In this example, an example is shown in which account processing is performed for the financial institution B's own account.

First, the ATM operator inserts an ATM card issued by the financial institution A into ATM1 (S1).

The ATM 1 that accepts the insertion of the ATM card reads the recorded data of the inserted ATM card. The record data includes, for example, data indicating that the ATM card is issued by the financial institution A, and data indicating the account of the owner of the ATM card (an account of the financial institution A) (for example, a branch name) And account number). The ATM 1 notifies the read record data to the financial institution A server 3 (S2).

When the financial institution A server 3 receives the recorded data from the ATM 1, the ATM message processing unit 31 of the financial institution A transmits the data that is the basis of the service menu screen 110 of the financial institution A to the ATM1.
The service menu screen 110 of the financial institution A is displayed on the input / output unit 11 of the ATM 1 (S3). The service menu screen 110 of the financial institution A is a screen for instructing an operator of the ATM 1 to perform account processing for the account of the financial institution A, for example, as shown in FIG. As shown in FIG. 4, the service menu screen 110 of the financial institution A has
For example, a menu item for instructing account processing (payment processing, withdrawal processing, balance inquiry processing, etc.) is displayed. In addition to the menu items described above, the service menu screen 110 of the financial institution A is a screen for instructing the ATM 1 operator to perform account processing for an account (authentication agency account) of another financial institution (hereinafter referred to as “others”. A menu item (“other financial institution” in the example of FIG. 4) 111 for screen transition to the “service menu screen of financial institution”) is also displayed.

Here, the operator of ATM 1 selects the menu item 111 of “other financial institution” on the service menu screen 110 of the financial institution A (S4).

The ATM 1 that has received the selection of the “other financial institution” menu item 111 notifies the financial institution A server 3 that the screen transition to the service menu screen of the other financial institution has been instructed (S
5).

When the financial institution A server 3 receives the notification of step S5 from the ATM 1, the authentication agency processing unit 33 of the financial institution A server 3 refers to the authentication agency management data 5 and is indicated by the recording data notified in step S2. The account data 52 of another financial institution associated with the account (the account of the financial institution A of the operator of ATM 1) is acquired. The account data 52 of another financial institution acquired here indicates an authentication agency account (authentication agency account of the ATM1 operator) registered in advance by the ATM1 operator. In this example, the authentication agent account of the ATM1 operator is
Assume that it is an account of financial institution B.

If the account data 52 of another financial institution is not associated with the account indicated by the recording data notified in step S2 (the account of the financial institution A of the operator of ATM1), there is no authentication agent account. The authentication agent processing unit 33 cannot perform the authentication agent processing (that is, the ATM1 operator cannot use the authentication agent function). Accordingly, in order to inform the ATM 1 operator in advance of this, for example, when there is no authentication agent account, the authentication agent processor 33 displays the service menu screen 110 of the financial institution A displayed in step S3. The menu item 111 of “other financial institution” can be prevented from being displayed.

Based on the acquired account data 52 of another financial institution, the authentication agent processing unit 33 authenticates the authentication screen 12.
Data that is the basis of 0 is generated, the generated data is transmitted to ATM1, and the authentication screen 120 is displayed on the input / output unit 11 of ATM1 (S6). As shown in FIG. 5, the authentication screen 12
In 0, the display area 121 of information (for example, financial institution name (in this example, financial institution B), branch name, account number, etc.) indicating the authentication agent account of the operator of the ATM 1, and a password for inputting the password An area 122 and a confirmation button 123 for confirming the input of the password are displayed.

Thereafter, the ATM1 operator inputs the password set in the authentication account of the ATM1 operator (in this example, the account of the financial institution B) displayed in the display area 121 on the authentication screen 120, The confirmation button 123 is pressed (S7).

The ATM 1 that has received the input of the personal identification number notifies the financial institution A server 3 of the accepted personal identification number (S8).

When the financial institution A server 3 receives the password notification from the ATM 1, the authentication agent processing unit 33 of the financial institution A performs account opener authentication of another financial institution (financial institution B) (S9). Specifically, the authentication agent processing unit 33 determines whether or not the personal identification number notified from the ATM 1 matches the personal identification number 524 included in the account data 52 of the other financial institution acquired in step S6. judge. Then, the authentication agent processing unit 33 reads the ATM1 when both passwords match.
Is determined to be a legitimate account opener of financial institution B (that is, the account opener authentication of another financial institution (financial institution B) has succeeded).

If the account opener authentication of the other financial institution (financial institution B) is successful, the authentication agent processing unit 33 transmits the data that is the basis of the service menu screen 130 of the financial institution B to the ATM 1, and the AT
The service menu screen 130 of the financial institution B is displayed on the input / output unit 11 of M1 (S10).
. The service menu screen 130 of the financial institution B is a screen for instructing the operator of the ATM 1 to perform account processing for the account of the financial institution B (authentication agency account), and is, for example, shown in FIG. As shown in FIG. 6, on the service menu screen 130 of the financial institution B, for example, information indicating an authentication agent account of an operator of the ATM 1 (for example, a branch name, an account number, etc.)
Display area 131 and a menu item 132 for instructing account processing (payment processing, withdrawal processing, balance inquiry processing, etc.).

Here, the operator of ATM 1 selects one of the menu items 131 for instructing any account processing on the service menu screen 130 of the financial institution B (S11). Hereinafter, the account processing instructed in step S11 is referred to as “designated account processing”.

The ATM 1 that has received the selection of the menu item 131 for instructing the designated account processing notifies the financial institution A server 3 that the designated account processing has been instructed (S12).

When the financial institution A server 3 receives the notification in step S12 from the ATM 1, the authentication agency processing unit 33 of the financial institution A server 3 instructs the ATM 1 operator to perform designated account processing on the authentication agency account. A telegram is generated, and the generated ATM telegram is transferred to the financial institution B.
It transmits to the server 4 (S13, S14).

When the financial institution B server 4 receives the ATM telegram from the financial institution A server 3, the financial institution B
The ATM message processing unit 41 of the server 4 performs specified account processing on the authentication proxy account of the ATM1 operator according to the received ATM message (for example, if the specified account processing is withdrawal processing, ATM1 (Withdrawn the specified amount from the authentication agent account of the operator) (S15)
. Then, the ATM message processing unit 41 of the financial institution B server 4 transmits result data indicating the result of the designated account processing to the financial institution A server 3. The result data includes, for example, information indicating whether or not the designated account processing is successful, a balance after the designated account processing, and the like.

When the financial institution A server 3 receives the result data from the financial institution B server 4, the authentication agent processing unit 33 of the financial institution A server 3 transmits the data that is the basis of the result screen 140 to the ATM 1,
The result screen 140 is displayed on the input / output unit 11 of the ATM 1 (S16). As shown in FIG. 7, on the result screen 140, for example, when the designated account processing is successful, a message display area 141 and a balance display area 142 after the designated account processing are displayed. Is done.

The above is the description of the authentication proxy process. As a result of the above processing, even for other financial institutions such as financial institution B that do not install ATM1 or issue ATM cards, their account holders use ATM1 to make their own account at the other financial institution. It becomes possible to instruct the account processing for the account. In other words, even for other financial institutions that do not install ATM1 or issue ATM cards, it is possible to provide services using ATM1 to their account openers without installing ATM1 or issuing ATM cards. Become.

The above-described embodiments of the present invention are examples for explaining the present invention, and are not intended to limit the scope of the present invention only to those embodiments. The present invention can be implemented in various other modes without departing from the gist thereof.

For example, in this embodiment, it is assumed that the person who can instruct account processing for an account of another financial institution using the authentication proxy function is a person who has opened an account in each of the other financial institution and financial institution A. However, for example, by performing the following, the financial institution A server 3 can provide an authentication proxy function to an account opener of another financial institution that has not opened an account in the financial institution A.

That is, the financial institution A issues an ATM card to a person who does not have an account with the financial institution A but wants to use the authentication proxy function (function user). For example, an ID for specifying a function user is recorded on the ATM card. Then, the financial institution A manages the association between the functional user and the authentication surrogate account by using the ID for specifying the functional user in the authentication surrogate management data 5 instead of the account data 51 of the financial institution A. Keep it. This
The financial institution A server 3 executes the processing flow similar to that in FIG. 3 so that an authentication agency function can be provided to account openers of other financial institutions that have not opened an account in the financial institution A. Become.

  1 ... ATM, 2 ... ATM network, 3 ... Financial institution A server, 4 ... Financial institution B server

Claims (2)

The financial institution server of the first financial institution, connected to a processing server that performs account processing for an account of a second financial institution different from the first financial institution, the financial institution server,
The first financial institution is a financial institution that issues a recording medium in which account data specifying the account opener's account is recorded to an account opener of the first financial institution;
The second financial institution has a processing server for performing account processing for the account of the second financial institution according to instruction data for instructing account processing, and for an account opener of the second financial institution , A financial institution that has not issued a recording medium in which account data for identifying the account of the account opener is recorded;
The account opener of the first financial institution is the account opener of the second financial institution,
Account data receiving means for receiving first account data for identifying a first account which is a user account in the first financial institution;
Instruction data transmission for generating instruction data for the account of the second financial institution associated with the account of the first financial institution of the user based on an instruction of the user of the first financial institution Means, and
An account processing instruction device having an input / output means is connected to the financial institution server via a communication network,
The said account data receiving means is a financial institution server which receives the account data which the said account process instruction apparatus read from the said recording medium issued to the said user from the said account process instruction apparatus. A financial institution server possessed by a first financial institution, which is realized by the financial institution server connected to a processing server that performs account processing for an account of a second financial institution different from the first financial institution There is a way,
The first financial institution is a financial institution that issues a recording medium in which account data specifying the account opener's account is recorded to an account opener of the first financial institution;
The second financial institution has a processing server for performing account processing for the account of the second financial institution according to instruction data for instructing account processing, and for an account opener of the second financial institution , A financial institution that has not issued a recording medium in which account data for identifying the account of the account opener is recorded;
The account opener of the first financial institution and the account opener of the second financial institution are the same,
Receiving first account data identifying a first account that is a user account at the first financial institution;
Generating instruction data for the account of the second financial institution associated with the account of the first financial institution of the user based on an instruction of the user of the first financial institution;
An account processing instruction device having an input / output means is connected to the financial institution server via a communication network,
Receiving the first account data is a method of receiving, from the account processing instruction device, account data read by the account processing instruction device from the recording medium issued to the user.

Images