JP2019191627A - Authentication apparatus, authentication system and authentication method - Google Patents

Abstract

To make it possible to preferably use an ATM without a cash card.SOLUTION: An authentication apparatus 10 includes an identifier reception unit 11 that receives an ATM identifier for identifying an ATM 20 used by a user from a communication terminal 30 owned by the user, a transaction identifier generation unit 12 that dynamically generates a transaction identifier for identifying a transaction, a transaction identifier transmission unit 13 that transmits the transaction identifier generated by the transaction identifier generation unit 12 to the communication terminal 30, a user input transaction identifier reception unit 14 that receives the transaction identifier input at the ATM 20 from the ATM 20 identified by the ATM identifier received by the identifier reception unit 11 after the transaction identifier transmission unit 13 transmits the transaction identifier to the communication terminal 30, and an authentication unit 15 that authenticates the transaction based on the transaction identifier received by the user input transaction identifier reception unit 14 and the transaction identifier generated by the transaction identifier generation unit 12.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an authentication device, an authentication system, and an authentication method.

  Automatic teller machines (ATMs) have been installed not only at financial institutions such as banks but also at stations and convenience stores, so users can find ATMs relatively easily. Is becoming possible. In ATM, if there is only a cash card, cash can be deposited without using a passbook or seal, but development of a system capable of depositing and cashing without using even a cash card is underway. For example, in Patent Document 1, an ATM information and a one-time password existing near the current position of the user are transmitted to a mobile phone possessed by the user, and the user inputs the one-time password into the ATM. A banking processing method is disclosed in which cash can be withdrawn without using a cash card.

JP 2004-303057 A

  In the banking processing method disclosed in Patent Document 1, a user can withdraw cash without using a cash card, but before that, the user must go to an ATM guided by a mobile phone. . Even if the user is in front of an ATM guided by a mobile phone, an operation for selecting the ATM must be performed on the mobile phone, which is complicated. That is, there is room for improvement from the viewpoint of suitably using ATM without using a cash card.

  The present invention has been made in view of the above circumstances, and an object thereof is to provide an authentication device, an authentication system, and an authentication method capable of suitably using ATM without using a cash card.

In order to achieve the above object, an authentication apparatus according to the first aspect of the present invention provides:
Identifier receiving means for receiving an ATM identifier for identifying an ATM used by the user from a communication terminal possessed by the user;
Transaction identifier generating means for dynamically generating a transaction identifier for identifying a transaction;
Transaction identifier transmitting means for transmitting the transaction identifier generated by the transaction identifier generating means to the communication terminal;
User input transaction identifier receiving means for receiving the transaction identifier input by the ATM from the ATM identified by the ATM identifier received by the identifier receiving means after the transaction identifier transmitting means has transmitted the transaction identifier to the communication terminal. When,
Authentication means for authenticating a transaction based on the transaction identifier received by the user input transaction identifier receiving means and the transaction identifier generated by the transaction identifier generating means;
Is provided.

The transaction identifier generating means dynamically generates the transaction identifier in association with the ATM identifier received by the identifier receiving means.
You may do it.

The identifier receiving means further receives a user identifier for identifying the user;
The transaction identifier generating means generates the transaction identifier after confirming that the user has an account for the transaction based on the user identifier.
You may do it.

The transaction identifier generation means invalidates the transaction identifier used for the authentication after the authentication means authenticates the transaction.
You may do it.

The transaction identifier generating means sets an expiration date when generating the transaction identifier, and does not generate a transaction identifier that matches the transaction identifier within the expiration date.
You may do it.

The transaction identifier generation means does not generate a transaction identifier that matches the transaction identifier until the expiration date has passed, even after invalidating the transaction identifier used for the authentication.
You may do it.

In order to achieve the above object, an authentication system according to the second aspect of the present invention provides:
An authentication system comprising an ATM and an authentication device,
The ATM is
ATM code display means for displaying an ATM code including information of an ATM identifier for identifying the ATM;
User input transaction identifier acquisition means for acquiring a transaction identifier input by the user;
User input transaction identifier transmission means for transmitting the transaction identifier acquired by the user input transaction identifier acquisition means to the authentication device;
With
The authentication device
Identifier receiving means for receiving the ATM identifier obtained by the communication terminal reading the ATM code displayed by the ATM code display means from the communication terminal possessed by the user;
Transaction identifier generating means for dynamically generating a transaction identifier for identifying a transaction;
Transaction identifier transmitting means for transmitting the transaction identifier generated by the transaction identifier generating means to the communication terminal;
User input for receiving the transaction identifier transmitted by the user input transaction identifier transmitting unit from the ATM identified by the ATM identifier received by the identifier receiving unit after the transaction identifier transmitting unit has transmitted the transaction identifier to the communication terminal. A transaction identifier receiving means;
Authentication means for authenticating a transaction based on the transaction identifier received by the user input transaction identifier receiving means and the transaction identifier generated by the transaction identifier generating means;
Is provided.

In order to achieve the above object, an authentication method according to the third aspect of the present invention includes:
An identifier receiving step of receiving an ATM identifier for identifying an ATM used by the user from a communication terminal possessed by the user;
A transaction identifier generating step for dynamically generating a transaction identifier for identifying the transaction;
A transaction identifier transmission step of transmitting the transaction identifier generated in the transaction identifier generation step to the communication terminal;
A user input transaction identifier receiving step for receiving a transaction identifier input in the ATM from the ATM identified by the ATM identifier received in the identifier receiving step after transmitting the transaction identifier to the communication terminal in the transaction identifier transmitting step. When,
An authentication step for authenticating a transaction based on the transaction identifier received in the user input transaction identifier reception step and the transaction identifier generated in the transaction identifier generation step;
Is provided.

  According to the present invention, it is possible to provide an authentication device, an authentication system, and an authentication method capable of suitably using ATM without using a cash card.

It is a functional block diagram of the authentication system which concerns on Embodiment 1 of this invention. 2 is a hardware configuration diagram of an authentication system according to Embodiment 1. FIG. It is a figure which shows an example of the user account information which the communication terminal which concerns on Embodiment 1 memorize | stores. It is a figure which shows an example of the account information for authentication which the authentication apparatus which concerns on Embodiment 1 memorize | stores. It is a figure which shows an example of the ATM information for authentication which the authentication apparatus which concerns on Embodiment 1 memorize | stores. 6 is a sequence diagram of authentication processing of the authentication system according to Embodiment 1. FIG. It is a figure which shows an example of the transaction identifier log | history information which the authentication apparatus which concerns on Embodiment 1 memorize | stores. It is a functional block diagram of the authentication system which concerns on Embodiment 2 of this invention. 6 is a hardware configuration diagram of an authentication system according to Embodiment 2. FIG. FIG. 10 is a sequence diagram of authentication processing of the authentication system according to the second embodiment.

  Hereinafter, an embodiment in which an authentication apparatus of the present invention is applied to an authentication system that provides a service that can use an ATM without using a cash card will be described with reference to the drawings.

(Embodiment 1)
The authentication system 1 according to the first embodiment is a system that provides a service (cardless ATM service) in which an ATM can be suitably used without a cash card. As shown in FIG. 1, the authentication system 1 includes an authentication device 10 and an ATM 20, and communicates with a communication terminal 30 possessed by the user so that the user can use the cardless ATM service. The authentication device 10 communicates with the ATM 20 and the communication terminal 30 and issues a transaction identifier (one-time password) for using the cardless ATM service to the communication terminal 30 when the user uses the communication terminal 30. When the user inputs the transaction identifier to the ATM 20, the ATM 20 transmits the input transaction identifier to the authentication device 10. When the transaction identifier issued to the communication terminal 30 matches the transaction identifier received from the ATM 20, the ATM 20 To start a cardless ATM service. By starting the cardless ATM service in such a procedure, a safe transaction is possible even without a cash card.

  The communication terminal 30 is installed with application software (ATM application) for cardless ATM service, and the user activates the ATM application and uses the cardless ATM service. The ATM application may be dedicated application software or general-purpose application software such as a WEB browser. The user in this embodiment has an account of a financial institution (cardless ATM service use account), and the user's account information and personal information are transferred to the communication terminal 30 and the authentication device 10 via the ATM application. It is assumed that it is registered.

  Specifically, as illustrated in FIG. 1, the authentication device 10 includes an identifier receiving unit 11, a transaction identifier generating unit 12, a transaction identifier transmitting unit 13, a user input transaction identifier receiving unit 14, and an authentication unit 15. .

  The identifier receiving unit 11 receives a user identifier and an ATM identifier that the communication terminal 30 (ATM application) transmits to the authentication device 10. The identifier receiving unit 11 functions as an identifier receiving unit. The user identifier uniquely identifies the user, and is information including, for example, the account number of the user's financial institution, the bank's financial institution code, and the ID (Identifier) of the communication terminal 30. A user identifier is memorize | stored in the communication terminal 30 by the account registration process by the ATM application mentioned later. The user identifier includes at least information of the user's financial institution account number, or the user identifier so that the authentication device 10 can obtain the user's financial institution account number from the user identifier. The authentication device 10 stores a table that associates the account number of the user's financial institution. The ATM identifier uniquely identifies the ATM 20, and is information including, for example, a bank's financial institution code and branch code, and a unique code assigned to each ATM 20 in the branch. The ATM identifier is acquired from an ATM code described later.

  The transaction identifier generation unit 12 dynamically generates a transaction identifier in association with the ATM identifier received by the identifier reception unit 11. The transaction identifier generation unit 12 functions as a transaction identifier generation unit. The transaction identifier uniquely identifies a transaction performed by the user at the ATM 20, and is, for example, a 4-digit number. However, since a 4-digit number can identify only 10,000 transactions from “0000” to “9999”, the “uniquely identified” here is actually “within a predetermined time (for example, the last 10 minutes)” It means "uniquely identify transactions in". The transaction identifier has an expiration date, and the transaction identifier that has passed the expiration date becomes invalid (that is, the transaction identifier of the same number is not generated until the expiration date, and after the expiration date, A transaction identifier of the same number may be generated).

  The transaction identifier transmission unit 13 transmits the transaction identifier generated by the transaction identifier generation unit 12 to the communication terminal 30. When the transaction identifier is transmitted from the authentication device 10, the ATM application executed on the communication terminal 30 displays the transaction identifier on the screen of the communication terminal 30. The transaction identifier transmission unit 13 functions as a transaction identifier transmission unit.

  The user input transaction identifier receiving unit 14 receives a user input transaction identifier transmitted from the ATM 20 to the authentication device 10. The user input transaction identifier receiving unit 14 functions as a user input transaction identifier receiving unit. The user input transaction identifier is a transaction identifier input to the ATM 20 by the user. The user input transaction identifier will be further described. When the transaction identifier transmission unit 13 transmits the transaction identifier to the communication terminal 30, the transaction identifier is displayed on the screen of the communication terminal 30, the user inputs the transaction identifier displayed on the screen of the communication terminal 30 to the ATM 20, and the ATM 20 The transaction identifier input by is transmitted to the authentication device 10. The “transaction identifier input by the user” transmitted by the ATM 20 is a user input transaction identifier.

  The authentication unit 15 authenticates the transaction by verifying that the user input transaction identifier received by the user input transaction identifier receiving unit 14 and the transaction identifier generated by the transaction identifier generation unit 12 are the same. Since the transaction identifier has an expiration date as described above, if the user input transaction identifier receiving unit 14 has not received the user input transaction identifier within the expiration date of the transaction identifier, the authentication of the transaction fails. . Of course, even when the user input transaction identifier received by the user input transaction identifier receiving unit 14 and the transaction identifier generated by the transaction identifier generation unit 12 are different, the authentication of the transaction fails. The authentication unit 15 functions as an authentication unit.

  As shown in FIG. 1, the ATM 20 includes an ATM code display unit 21, a user input transaction identifier acquisition unit 22, a user input transaction identifier transmission unit 23, and an ATM process execution unit 24.

  The ATM code display unit 21 displays an ATM code including ATM identifier information on a display provided in the ATM 20. The ATM code is information representing ATM identifiers, for example, a two-dimensional code (QR code code (registered trademark), etc.), and the ATM application of the communication terminal 30 reads the ATM code displayed on the display of the ATM 20. Thus, the ATM identifier of the ATM 20 can be acquired. The ATM code display unit 21 functions as ATM code display means.

  The user input transaction identifier acquisition unit 22 acquires a user input transaction identifier input by the user on the touch panel included in the ATM 20. The user input transaction identifier is a transaction identifier input to the ATM 20 by the user as described above. The user input transaction identifier acquisition unit 22 functions as a user input transaction identifier acquisition unit.

  The user input transaction identifier transmission unit 23 transmits the user input transaction identifier acquired by the user input transaction identifier acquisition unit 22 to the authentication device 10. The user input transaction identifier transmission unit 23 functions as a user input transaction identifier transmission unit.

  When notified from the authentication device 10 that the authentication is successful, the ATM process execution unit 24 executes normal ATM processes such as a deposit process and a withdrawal process in accordance with an input instruction by the user.

  The communication terminal 30 is an information communication device such as a smartphone, a tablet, a PC (Personal Computer), a mobile phone, or a PDA (Personal Digital Assistant) operated by a user (user) of the cardless ATM service. The communication terminal 30 is installed with an ATM application as described above, and includes an ATM code reading unit 31 and a communication unit 32. The said ATM application is started based on operation (user operation) with respect to the communication terminal 30 by a user. The communication terminal 30 starts an authentication process to be described later based on a user operation in the ATM application. The authentication process is a process performed in cooperation with the communication terminal 30, the authentication device 10, and the ATM 20. Note that an ATM application is preinstalled in the communication terminal 30 in this embodiment, and accordingly, the cardless ATM service usage account and the personal information of the user are transmitted via the ATM application to the communication terminal 30 and It is assumed that it is registered in the authentication device 10.

  The ATM code reading unit 31 reads the ATM code displayed on the display of the ATM 20 and acquires information on the ATM identifier of the ATM 20.

  The communication unit 32 communicates with the authentication device 10. Specifically, the user identifier and the ATM identifier are transmitted to the authentication device 10.

  The host computer 40 is a computer of a financial institution and has a function of holding information related to the user's account and executing processing for the account. In the present embodiment, the host computer 40 receives and executes processing for an account such as deposit and withdrawal from the ATM 20 and returns the processing result to the ATM 20.

  Next, the hardware configuration of the authentication system 1 will be described with reference to FIG. The authentication apparatus 10 includes a CPU (Central Processing Unit) 101, a RAM (Random Access Memory) 102, a ROM (Read Only Memory) 103, a hard disk drive 104, and a network card 105.

  The CPU 101 executes the above-described various processes by reading the program stored in the hard disk drive 104 into the RAM 102 and executing it.

  The RAM 102 is a volatile memory, and is used as a work area for the CPU 101 and an area for storing variables used in programs executed by the CPU 101.

  The ROM 103 is a non-volatile memory, and stores a control program for basic operation of the authentication device 10 executed by the CPU 101, BIOS (Basic Input Output System), and the like.

  The hard disk drive 104 stores various information stored in the authentication device 10 and a program executed by the CPU 101.

  The network card 105 is an interface with a communication line, and is communicably connected to a communication card 30 and a network card 205 provided in the ATM 20 described later. The network card 105 and the communication terminal 30 and the network card 205 may be directly connected, and are connected via a network such as the Internet, an intranet, a VPN (Virtual Private Network), a LAN (Local Area Network), or the like. Also good.

  The CPU 101, the RAM 102, the ROM 103, the hard disk drive 104, and the network card 105 cooperate with each other, and the identifier receiving unit 11, the transaction identifier generating unit 12, the transaction identifier transmitting unit 13, the user input transaction identifier receiving unit 14 or the authentication unit 15 described above. Function as.

  The ATM 20 includes a CPU 201, a RAM 202, a ROM 203, a network card 205, a display 206, and a touch panel 207.

  The CPU 201 reads the program stored in the ROM 203 to the RAM 202 and executes it, thereby executing the authentication process and various processes described above. Note that the program may be executed as it is on the ROM 203 without being read into the RAM 202.

  The RAM 202 is a volatile memory, and is used as a work area for the CPU 201 and an area for storing variables used in programs executed by the CPU 201.

  The ROM 203 is a non-volatile memory, and stores various information stored in the ATM 20, programs executed by the CPU 201, and the like in addition to a control program and BIOS for the basic operation of the ATM 20 executed by the CPU 201.

  The network card 205 is an interface with a communication line, and is communicably connected to the network card 105 included in the host computer 40 and the authentication device 10. The network card 205 and the host computer 40 and the network card 105 may be directly connected, or may be connected via a network such as the Internet, an intranet, a VPN, or a LAN.

  The CPU 201, the RAM 202, the ROM 203, the network card 205, the display 206, and the touch panel 207 cooperate with the above-described ATM code display unit 21, user input transaction identifier acquisition unit 22, user input transaction identifier transmission unit 23, or ATM process execution unit. 24 functions.

  Next, authentication processing by the authentication system 1 will be described. As described above, the authentication process is performed in cooperation with the communication terminal 30, the ATM 20, and the authentication device 10. Prior to the authentication process, information on the account number of the user is registered in advance in the communication terminal 30, and the authentication device 10 includes address information (for example, IP (Internet Protocol) address) used when communicating with the ATM 20, Information such as the user's account number is registered.

  Registration of the user's account number in the communication terminal 30 is performed by an ATM application installed in the communication terminal 30. First, a user who has an account at a financial institution installs and activates an ATM application in the communication terminal 30 owned by the user. When the ATM application is activated by a user operation on the communication terminal 30, if the activation is the first activation, the ATM application accepts an input such as a user account number. In addition to the first activation, the ATM application starts the account number registration process and accepts input of the user's account number and the like by a user operation such as touching the account number registration button. When the user performs an input operation such as an account number, user account information including information such as the user's name, account number, and user identifier as shown in FIG. 3 is registered in the communication terminal 30. Then, the ATM application transmits user account information to the authentication device 10 and collects the user account information transmitted from the ATM application, whereby the authentication device 10 creates authentication account information to be described later.

  In FIG. 3, the user identifier is defined as “financial institution code (4 digits)” + “branch code (3 digits)” + “account number (7 digits)”, but is not limited thereto. For example, when the ATM application transmits a user identifier issuance request to the authentication device 10, the authentication device 10 may return a user identifier generated based on information such as an account number transmitted from the ATM application to the ATM application. .

  The authentication apparatus 10 includes authentication account information including information such as the user's name, account number, and user identifier as shown in FIG. 4, the ATM identifier of each ATM 20 and each ATM 20 as shown in FIG. Authentication ATM information including information on an address (IP address in FIG. 5) used for communication is stored. Among these pieces of information, as described above, the account information for authentication is registered in the authentication device 10 by transmitting the user account information of each user to the authentication device 10 when the ATM application performs an account number registration process. The Also, the authentication ATM information can be created in advance by collecting information on the ATM 20 owned by the financial institution.

  In addition, when the ATM application performs account number registration processing, if the user account information is not transmitted to the authentication device 10 (cannot be performed), the authentication device 10 displays information such as the account number of each user owned by the financial institution. Collect and create account information for authentication. Further, the authentication device 10 may communicate with the host computer 40 to acquire information such as a user's account number and address information used when communicating with the ATM 20. In this case, the authentication device 10 communicates with the host computer 40 as necessary during the authentication process without storing the authentication account information and the authentication ATM information. Can be obtained.

  Next, authentication processing by the authentication system 1 will be described with reference to FIG. First, when the user touches and selects “cardless deposit / withdrawal” displayed on the display 206 of the ATM 20, the ATM code display unit 21 of the ATM 20 displays the ATM code on the display 206 of the ATM 20 (step S101). “Cardless deposit / withdrawal” refers to the process of depositing and withdrawing cash into the account for using the cardless ATM service without using a cash card. There is also a menu for making deposits and withdrawals.

  When the user reads the ATM code displayed on the display 206 of the ATM 20 with the ATM application of the communication terminal 30 (step S102), the ATM application acquires information on the ATM identifier included in the ATM code. And the communication terminal 30 transmits the ATM identifier which the ATM application acquired, and the user identifier contained in the user account information memorize | stored in the communication terminal 30 to the authentication apparatus 10 (step S103). Then, the identifier receiving unit 11 of the authentication device 10 receives the transmitted ATM identifier and user identifier (step S104). Step S104 is also called an identifier receiving step. Then, the authentication device 10 checks the ATM identifier transmitted from the communication terminal 30 based on the pre-stored authentication ATM information, confirms that the ATM actually exists, and performs authentication. It is confirmed that the user identifier transmitted from the communication terminal 30 based on the account information and the account number of the user indicated by the user identifier are usage accounts of the cardless ATM service (step S105).

  When the presence of both the ATM identifier and the account number can be confirmed, the transaction identifier generation unit 12 of the authentication apparatus 10 generates a randomly generated four-digit number as a transaction identifier in association with the ATM identifier (step S106). . Step S106 is also called a transaction identifier generation step. The transaction identifier generation unit 12 sets an expiration date (for example, 10 minutes after generation) when generating the transaction identifier so that the transaction identifier whose expiration date has passed can be invalidated. Moreover, the transaction identifier production | generation part 12 does not produce | generate the same thing as the transaction identifier produced | generated most recently (within the time (for example, 10 minutes) set as an expiration date). Therefore, the authentication device 10 stores the history information of the most recently generated transaction identifier as shown in FIG. 7, and the transaction identifier generating unit 12 generates the same transaction identifier as the most recent transaction identifier of the same ATM identifier. Regenerates until it produces a different one.

  In FIG. 7, only the transaction identifiers at the top of each ATM identifier (in FIG. 7, “1246” and “3975”) are valid until the expiration date, and other transaction identifiers are invalid. is there. As shown in FIG. 7, a valid transaction identifier is associated with an ATM identifier. Further, when the transaction identifier generation unit 12 generates not only the associated ATM identifier but also the same transaction identifier as any of the most recent transaction identifiers, it regenerates until a different one is generated. It may be. In this way, it is only necessary to confirm the matching of valid transaction identifiers in the authentication step described later.

  Next, the transaction identifier transmission unit 13 of the authentication device 10 transmits the transaction identifier generated by the transaction identifier generation unit 12 to the communication terminal 30 (step S107). Step S107 is also called a transaction identifier transmission step. Then, the ATM application of the communication terminal 30 displays the transaction identifier on the display of the communication terminal 30 (step S108). The user views it and inputs a transaction identifier on the touch panel 207 of the ATM 20. When the user inputs a transaction identifier to the ATM 20 and touches “Confirm” displayed on the display 206 of the ATM 20, the user input transaction identifier acquisition unit 22 of the ATM 20 displays the transaction identifier (user input input by the user on the touch panel 207). (Transaction identifier) is acquired (step S109).

  And the user input transaction identifier transmission part 23 of ATM20 transmits the user input transaction identifier which the user input transaction identifier acquisition part 22 acquired to the authentication apparatus 10 (step S110).

  Then, the user input transaction identifier receiving unit 14 of the authentication device 10 receives the user input transaction identifier transmitted by the ATM 20 (step S111). Step S111 is also referred to as a user input transaction identifier receiving step. And the authentication part 15 authenticates this transaction by comparing the user input transaction identifier which the user input transaction identifier receiving part 14 received with the transaction identifier which the transaction identifier production | generation part 12 produced | generated most recently (step S112). ). Step S112 is also called an authentication step.

  Specifically, the authentication unit 15 uses the IP address of the ATM 20 in which the IP address of the transmission source when the user input transaction identifier receiving unit 14 receives the user input transaction identifier is indicated by the ATM identifier confirmed in step S105. It confirms that it is an address based on the ATM information for authentication. Further, the authentication unit 15 confirms that the user input transaction identifier received by the user input transaction identifier receiving unit 14 is the same as the transaction identifier generated by the transaction identifier generation unit, and that the transaction identifier is based on the authentication ATM information. The latest transaction identifier information in the transaction identifier history information indicates that the time when the user input transaction identifier is received is within the validity period of the transaction identifier history information. Confirm based on. If it can be confirmed that all of these conditions are satisfied, the authentication is successful. If even one of the conditions is not satisfied, the authentication fails. In addition, when producing | generating a transaction identifier uniquely in the transaction in all ATM20, it is good also as a successful authentication because the valid transaction identifier corresponds.

  Then, the authentication device 10 transmits an authentication result (authentication success or authentication failure) to the ATM 20 and the communication terminal 30 (step S113), and the transaction identifier generation unit 12 invalidates the transaction identifier used for the current authentication ( For example, the item “valid / invalid” of the transaction identifier history information is set to “invalid”), and the authentication process is terminated.

  And ATM20 changes a screen based on the authentication result transmitted from the authentication apparatus 10 (step S114). Specifically, in the case of successful authentication, the ATM 20 ends the authentication process, and transitions to display of a transaction screen (a screen for prompting input of an amount and a cash card PIN). In the case of authentication failure, the ATM 20 displays an error message such as “authentication failed” on the display and returns to the initial screen (screen displaying the “cardless deposit / withdrawal” menu). In addition, the communication terminal 30 will complete | finish an authentication process, if the authentication result transmitted from the authentication apparatus 10 is received.

  When the authentication is successful, the ATM processing execution unit 24 of the ATM 20 displays a transaction screen, and the user inputs an amount and the like from the transaction screen (input of the deposit amount in the case of deposit, withdrawal amount and cash card in the case of withdrawal) When the password is input, the ATM process execution unit 24 communicates with the host computer 40 and executes the ATM process according to the content input by the user (step S115). For example, if the user performs a withdrawal process, the withdrawal is performed and the transaction is terminated.

  The ATM 20 displays a confirmation screen such as “Do you want to continue the transaction?” On the display before completely ending the transaction, and if the user answers “Yes” to this confirmation screen, the communication terminal 30 again. Even without reading the ATM code, the transaction processing after the end of the authentication processing may be continued.

  If authentication by the authentication unit 15 of the authentication device 10 fails, the ATM 20 returns to the initial screen display. If the user wants to use the cardless ATM service, the “cardless deposit / withdrawal” displayed on the ATM 20 display is displayed. ”Will start again from where you select the menu.

  The authentication process in the authentication system 1 has been described above. As described above, by using the authentication system 1, the financial institution can confirm that the user is about to start a transaction at the ATM 20 without using a cash card, and the user can use the ATM 20 without a cash card. It can be preferably used.

  In the authentication process shown in FIG. 6, when the user inputs a transaction identifier to the ATM 20, the transaction details (separate deposit / withdrawal, amount, and cash card PIN) may be input. In this case, in step S109, the ATM 20 can acquire not only the user input transaction identifier but also the transaction contents. Therefore, even if the user does not input anything into the ATM 20 after the authentication process, the ATM 20 performs the ATM process (step S115). It can be carried out. And ATM20 can perform payment, for example as a result of ATM processing. As described above, by enabling the transaction content to be input when the transaction identifier is input, the user can receive the cardless ATM service (at the transaction identifier and the transaction content) once with respect to the ATM 20, and the authentication system. 1 can improve user convenience. When such processing is performed, when authentication is successful, the ATM 20 displays on the display 206 a message screen explaining the contents of the ATM processing performed in step S115, such as “I will perform withdrawal processing” in step S114. It may be displayed.

(Embodiment 2)
In the first embodiment, the ATM 20 performs normal ATM processing after the end of the authentication processing, but the ATM application obtains the transaction contents (payment processing, withdrawal processing, etc.) in the ATM 20 from the user in advance. Also good. Thus, Embodiment 2 in which an ATM application acquires transaction contents in advance will be described.

  As shown in FIG. 8, in the authentication system 2 according to the second embodiment, in addition to the configuration of the authentication system 1, the communication terminal 30 includes a transaction content acquisition unit 33 and a terminal code display unit 34, and the ATM 20 A terminal code reading unit 25 is provided. The transaction content acquisition unit 33 and the terminal code display unit 34 are added as functions of the ATM application of the communication terminal 30.

  The transaction content acquisition unit 33 receives and acquires input of transaction content (payment processing, withdrawal processing, etc.) used in the cardless ATM service from the user. The transaction content acquisition unit 33 may accept and acquire a cash card PIN in addition to the transaction content.

  The terminal code display unit 34 displays the terminal code including the transaction content information acquired by the transaction content acquisition unit 33 on the display of the communication terminal 30. Here, the terminal code is, for example, a two-dimensional code (such as a QR code (registered trademark)). When the transaction content acquisition unit 33 has also acquired the cash card password, the terminal code may include the information on the cash card password.

  The terminal code reading unit 25 reads the terminal code displayed by the terminal code display unit 34 of the communication terminal 30 and acquires the transaction content (payment process, withdrawal process, etc.) input by the user to the ATM application of the communication terminal 30. .

  As shown in FIG. 9, in addition to the hardware configuration of the authentication system 1, the authentication system 2 includes a camera 208. The CPU 201, the RAM 202, the ROM 203, and the camera 208 cooperate to read the terminal code. The unit 25 functions.

  Next, an authentication process by the authentication system 2 will be described with reference to FIG. Since this authentication process has many parts that are the same as the authentication process performed by the authentication system 1 described with reference to FIG.

  First, when the user touches “cardless deposit / withdrawal” displayed on the display 206 of the ATM 20, the ATM code display unit 21 of the ATM 20 displays the ATM code on the display 206 of the ATM 20 (step S101). Same as system 1. In the authentication system 2, the user performs an operation on the ATM 20 (“cardless deposit / withdrawal” touch) and inputs transaction details (payment processing, withdrawal processing, etc.) to the ATM application of the communication terminal 30. Then, the transaction content acquisition unit 33 of the communication terminal 30 acquires the transaction content input by the user (step S121). The processing from step S102 to step S114 is the same as that of the authentication system 1.

  In FIG. 10, the process of step S121 is shown to be performed between the operation of the user selecting “cardless deposit / withdrawal” and the operation of reading the ATM code, but is not limited thereto. The process of step S121 may be performed before the user selects “cardless deposit / withdrawal”, or the process of step S121 may be performed after the authentication device 10 transmits the authentication result “authentication successful”. The process of step 121 may be performed after the user reads the ATM code and before the authentication apparatus 10 transmits the authentication result “authentication successful”.

  When the authentication process (step S112) in the authentication device 10 fails, the ATM 20 displays an error message such as “Could not be authenticated” on the display, and displays an initial screen (“cardless deposit / withdrawal” menu). The communication terminal 30 returns to before the transaction content acquisition (step S121).

  When the authentication process in the authentication device 10 is successful, the terminal code display unit 34 of the communication terminal 30 displays the terminal code including the transaction content information acquired by the transaction content acquisition unit 33 on the display of the communication terminal 30. (Step S122). When the user holds the terminal code displayed on the display of the communication terminal 30 over the camera 208 of the ATM 20, the terminal code reading unit 25 of the ATM 20 reads the terminal code (step S123) and acquires the transaction content. And the ATM process execution part 24 communicates with the host computer 40, and performs the ATM process according to the transaction content which the terminal code reading part 25 read and acquired (step S115). Then, if the user has input, for example, a withdrawal process as the transaction content in step S121, the withdrawal is performed and the transaction is terminated.

  The authentication process in the authentication system 2 has been described above. As described above, by using the authentication system 2, the financial institution can confirm that the user is about to start a transaction at the ATM 20 without using a cash card, and the user can use the ATM 20 without a cash card. Can be used. And in the authentication system 2, since the user can input the transaction content in ATM20 into the communication terminal 30, even if it does not operate on the touchscreen of ATM20, it is in the camera 208 of ATM20 in the communication terminal 30. Transactions can be made simply by holding the displayed terminal code.

  In the second embodiment, the communication unit 32 of the communication terminal 30 may be communicable with the ATM 20. In this case, the communication terminal 30 can transmit the transaction content acquired by the transaction content acquisition unit 33 to the ATM 20 via the communication unit 32. Therefore, in this case, the ATM 20 does not need to include the camera 208 (terminal code reading unit 25), and the communication terminal 30 does not need to include the terminal code display unit 34. Then, in the authentication process shown in FIG. 10, instead of steps S <b> 122 and S <b> 123, the communication terminal 30 may perform a process of transmitting the transaction content information to the ATM 20 via the communication unit 32.

(Modification)
The present invention is not limited to the embodiment described above, and various other modifications are possible. For example, the authentication systems 1 and 2 do not have to include all the technical features described in the above embodiment, and have been described in the above embodiment so that at least one problem in the conventional technology can be solved. A part of the configuration may be provided. Further, at least some of the following modifications may be combined.

  For example, in the above-described embodiment, the ATM code includes an ATM identifier that uniquely identifies the ATM 20, but further includes information indicating transaction contents (payment processing, withdrawal processing, etc.) at the ATM 20. You may make it. For this purpose, the ATM 20 displays a menu for selecting what kind of transaction is to be performed when the user selects the “cardless deposit / withdrawal” menu, and allows the user to input the transaction details. Like that. And the ATM code display part 21 displays the ATM code containing the information of the transaction content which the user input.

  As described above, when the ATM code display unit 21 displays the ATM code including the transaction content information, the authentication device 10, the ATM 20, and the communication terminal 30 can know in advance what kind of transaction the user performs. it can. Therefore, the authentication device 10 can change the strictness of authentication according to the transaction content. Further, the ATM 20 and the communication terminal 30 do not need to acquire information that has already been acquired (for example, whether it is a deposit process or a withdrawal process) in the input of transaction details after successful authentication. Can be reduced.

  In the above-described embodiment, the transaction is authenticated based on the transaction identifier. However, in addition to the transaction identifier, the ATM identifier, other information (for example, biometric information such as fingerprint, face, retina, transaction amount, The transaction may be authenticated using the transaction results so far. In this case, the ATM identifier and other information are used to further improve the security of authentication, and at least if the authentication based on the transaction identifier fails, the transaction is not allowed.

  In the above-described embodiment, the authentication device 10 is realized by one computer (server). However, the present invention is not limited to this, and the authentication device 10 may be realized by being distributed to a plurality of computers (servers). For example, when the authentication apparatus 10 is realized by being distributed to two computers of a relay server and an authentication server, the relay server directly communicates with the ATM 20 and the communication terminal 30, and the ATM 20 and the communication terminal 30 need to communicate with the authentication server. The relay server may relay the communication between the ATM 20 or the communication terminal 30 and the authentication server. In this case, the above-described authentication process may be performed by the authentication server or the relay server.

  Various information including the user's name, account number, user identifier, ATM 20 ATM identifier, IP address, transaction identifier of each transaction in the above-described embodiment is encrypted by various methods in transmission / reception or storage. Or it may be decoded.

  The authentication device 10, the ATM 20, and the communication terminal 30 can be realized using a normal computer without depending on a dedicated device. For example, the authentication device 10, the ATM 20, and the communication terminal 30 that perform the above-described processing may be configured by installing the program in a computer from a recording medium that stores the program for executing any of the above-described in the computer. Good. Moreover, you may comprise one authentication apparatus 10, ATM20, or the communication terminal 30 by a some computer operating in cooperation.

  A method for supplying the program to the computer is arbitrary. For example, it may be supplied via a communication line, a communication network, a communication system, or the like.

  In addition, when an OS (Operating System) provides a part of the functions described above, a part other than the function provided by the OS may be provided by a program.

DESCRIPTION OF SYMBOLS 1, 2 ... Authentication system, 10 ... Authentication apparatus, 11 ... Identifier receiving part, 12 ... Transaction identifier production | generation part, 13 ... Transaction identifier transmission part, 14 ... User input transaction identifier reception part, 15 ... Authentication part, 20 ... ATM, DESCRIPTION OF SYMBOLS 21 ... ATM code display part, 22 ... User input transaction identifier acquisition part, 23 ... User input transaction identifier transmission part, 24 ... ATM process execution part, 25 ... Terminal code reading part, 30 ... Communication terminal, 31 ... ATM code reading part 32 ... Communication unit 33 ... Transaction content acquisition unit 34 ... Terminal code display unit 40 ... Host computer 101, 201 ... CPU, 102, 202 ... RAM, 103, 203 ... ROM, 104 ... Hard disk drive, 105, 205 ... Network card, 206 ... Display, 207 ... Touch panel, 208 ... Camera

Claims (8)

Identifier receiving means for receiving an ATM identifier for identifying an ATM used by the user from a communication terminal possessed by the user;
Transaction identifier generating means for dynamically generating a transaction identifier for identifying a transaction;
Transaction identifier transmitting means for transmitting the transaction identifier generated by the transaction identifier generating means to the communication terminal;
User input transaction identifier receiving means for receiving the transaction identifier input by the ATM from the ATM identified by the ATM identifier received by the identifier receiving means after the transaction identifier transmitting means has transmitted the transaction identifier to the communication terminal. When,
Authentication means for authenticating a transaction based on the transaction identifier received by the user input transaction identifier receiving means and the transaction identifier generated by the transaction identifier generating means;
An authentication device comprising: The transaction identifier generating means dynamically generates the transaction identifier in association with the ATM identifier received by the identifier receiving means.
The authentication device according to claim 1. The identifier receiving means further receives a user identifier for identifying the user;
The transaction identifier generating means generates the transaction identifier after confirming that the user has an account for the transaction based on the user identifier.
The authentication device according to claim 1 or 2. The transaction identifier generation means invalidates the transaction identifier used for the authentication after the authentication means authenticates the transaction.
The authentication device according to any one of claims 1 to 3. The transaction identifier generating means sets an expiration date when generating the transaction identifier, and does not generate a transaction identifier that matches the transaction identifier within the expiration date.
The authentication device according to any one of claims 1 to 4. The transaction identifier generation means does not generate a transaction identifier that matches the transaction identifier until the expiration date has passed, even after invalidating the transaction identifier used for the authentication.
The authentication device according to claim 5. An authentication system comprising an ATM and an authentication device,
The ATM is
ATM code display means for displaying an ATM code including information of an ATM identifier for identifying the ATM;
User input transaction identifier acquisition means for acquiring a transaction identifier input by the user;
User input transaction identifier transmission means for transmitting the transaction identifier acquired by the user input transaction identifier acquisition means to the authentication device;
With
The authentication device
Identifier receiving means for receiving the ATM identifier obtained by the communication terminal reading the ATM code displayed by the ATM code display means from the communication terminal possessed by the user;
Transaction identifier generating means for dynamically generating a transaction identifier for identifying a transaction;
Transaction identifier transmitting means for transmitting the transaction identifier generated by the transaction identifier generating means to the communication terminal;
User input for receiving the transaction identifier transmitted by the user input transaction identifier transmitting unit from the ATM identified by the ATM identifier received by the identifier receiving unit after the transaction identifier transmitting unit has transmitted the transaction identifier to the communication terminal. A transaction identifier receiving means;
Authentication means for authenticating a transaction based on the transaction identifier received by the user input transaction identifier receiving means and the transaction identifier generated by the transaction identifier generating means;
Comprising
Authentication system. An identifier receiving step of receiving an ATM identifier for identifying an ATM used by the user from a communication terminal possessed by the user;
A transaction identifier generating step for dynamically generating a transaction identifier for identifying the transaction;
A transaction identifier transmission step of transmitting the transaction identifier generated in the transaction identifier generation step to the communication terminal;
A user input transaction identifier receiving step for receiving a transaction identifier input in the ATM from the ATM identified by the ATM identifier received in the identifier receiving step after transmitting the transaction identifier to the communication terminal in the transaction identifier transmitting step. When,
An authentication step for authenticating a transaction based on the transaction identifier received in the user input transaction identifier reception step and the transaction identifier generated in the transaction identifier generation step;
An authentication method comprising:

Images