JP3939312B2 - Personal electronic payment system - Google Patents

Description

  The present invention relates to an electronic payment system that provides a payment function in a retail sales transaction represented by a credit card (bank card), and in particular, ensures the safety of payment and enables smooth payment processing.

In recent years, with the spread of bank cards represented by credit cards, credit card settlement in retail sales has become common. On the other hand, however, troubles such as forgery of credit cards, unauthorized use by others, and unauthorized charges by dealers are increasing, and there is a demand for improvement in safety as a payment system. Recently, an IC card type credit card has also appeared as one of the measures for preventing forgery of the credit card.
Hereinafter, a conventional credit card settlement system including an IC card type credit card will be described.
Conventionally, in settlement by a bank card represented by a credit card, as disclosed in the following Patent Document 1, data communication is performed between a terminal of a store and a control center to perform credit inquiry and credit settlement. Many settlement systems have been proposed and used (see Patent Document 2 below).

FIG. 42 shows a configuration of a conventional general payment system.
In FIG. 42, a credit settlement terminal 4201 is a terminal that is installed in a store and performs a credit settlement operation at the store. The credit settlement terminal 4201 is connected to a remote settlement system 4202 via a telephone line 4204, a public network 4203, and a communication line 4205. The credit settlement terminal 4201 is provided with a card reader for reading information stored in the credit card 4200, a modem for connecting to the public network 4203, and a printer for printing calculation sheets.
The payment system 4202 is an information processing system that performs credit payment processing. The payment system 4202 manages consumer credit information and account information under a credit service contract with the consumer.
In the credit card 4200, the name of the owner, the stamp of the credit card number, and the signature of the owner are written on the surface of the card, and ID information is stored inside. There are two types of credit card 4200: magnetic card type and IC card type, but the difference between them is the difference in the external interface. Requires a reader. Some types of cards can store various types of personal information in addition to credit card ID information.

In the settlement system configured as described above, credit settlement is performed according to the following procedure.
First, a consumer gives a credit card 4200 to a store clerk and requests credit settlement. The store clerk causes the credit card 4200 to be read by the card reader of the credit card settlement terminal 4201 and performs a credit card settlement operation.
Then, the credit payment terminal 4201 reads the ID information from the credit card 4200, and transmits a message requesting credit inquiry and credit payment to the payment system 4202 by data communication using a modem. The payment system 4202 performs credit inquiry processing and credit payment processing based on the ID information and amount information included in the message, and transmits a payment completion message to the credit payment terminal 4201. Then, the credit settlement terminal 4201 prints a calculation form from the printer.
The store clerk asks the consumer to sign the calculation sheet, and further checks and verifies the sign written on the calculation sheet and the sign written on the credit card 4200, and consumes the credit card 4200 together with the usage allowance. The credit card payment is completed.
Japanese Patent Publication No. 3-32100 JP-A-8-96043

However, in the conventional settlement system, since the credit card is handed over to the store clerk, the credit card number is known to the store and the credit card number may be misused.
Also, in the conventional payment system, since the dealers lead the payment processing work, the dealers may trick the consumer and perform payment processing at a higher price than the actual product price. It was.
In addition, in the conventional payment system, the credit card is set directly on the credit payment terminal installed in the store, so the store modifies the credit payment terminal and alters the information in the card, or Personal information other than credit card ID information may be read illegally.
Further, in the conventional payment system, a consumer needs to carry one credit card for one credit service. To contract with a plurality of credit card companies and receive a plurality of credit services, Consumers were inconvenient because they had to carry several cards.

In addition, in the conventional payment system, a physical card called a credit card is used as an authentication means. Therefore, in order to cancel the transaction once the credit card has been settled later, the consumer has made another transaction. There was an inconvenience that I had to go there.
Further, in the conventional settlement system, it is necessary to print a calculation form on paper, and the printing time has become a bottleneck for improving sales efficiency. On the other hand, the credit settlement terminal needs to be equipped with a printer, which has been a bottleneck between downsizing the credit settlement terminal and reducing costs.
In addition, in the conventional payment system, it is necessary for the consumer to sign the calculation sheet, and the time it takes for the store clerk to ask the consumer to sign and actually have it signed takes credit payment. It took up most of the time, and was a bottleneck in sales efficiency.

  An object of the present invention is to solve such problems of the conventional settlement system, and to provide a settlement means excellent in safety and convenience.

The present invention is a personal electronic payment system comprising a payment means, a billing means, and a service providing means,
The claim means is:
Holding first data indicating completion of the payment process with the payment means, the first data includes identification information of the payment process;
Generating second data as data for requesting cancellation of the settlement processing including the first data, and transmitting the second data to the service providing means;
The payment means is:
Holding third data indicating completion of the settlement process with the billing means, the third data includes identification information of the settlement process;
Generating fourth data as data for requesting cancellation of the settlement process including the third data, and transmitting the fourth data to the service providing means;
The service providing means includes:
Holding the first data and the third data;
A first collation process for collating the first data included in the second data received from the billing unit and the first data held by the service providing unit;
A second verification process for verifying third data included in the fourth data received from the payment means and third data held by the service providing means;
Performing a third matching process for matching the identification information of the payment process included in the first data and the identification information of the payment process included in the third data;
When the first collation process, the second collation process, and the third collation process are successful, the settlement process is canceled.
The present invention also provides a CPU for executing a settlement process between the payment means and the billing means;
Communication means;
First data indicating completion of settlement processing between the payment means and the billing means transmitted by the CPU to the billing means via the communication means, and the CPU via the communication means the payment means Storage means for storing third data indicating completion of settlement processing between the payment means and the billing means transmitted to
A service providing means comprising:
Each of the first data and the third data includes identification information of a settlement process executed by the CPU,
Receiving second data as data for requesting cancellation of the settlement process including the first data from the billing means via the communication means; and receiving the third data from the payment means via the communication means. When receiving fourth data as data for requesting cancellation of the settlement process including data,
A first collation process for collating the first data included in the second data received from the billing unit and the first data held by the service providing unit;
A second verification process for verifying third data included in the fourth data received from the payment means and third data held by the service providing means;
Performing a third matching process for matching the identification information of the payment process included in the first data and the identification information of the payment process included in the third data;
When the first collation process, the second collation process, and the third collation process are successful, the settlement process is canceled .

According to the present invention, it is possible to easily cancel a settlement.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

(Embodiment 1)
A first embodiment of the present invention will be described with reference to FIGS.
The credit settlement system according to the first embodiment directly receives a credit card, a usage statement, etc. between a consumer and a retail store when an individual consumer purchases a product at a general retail store. It is a system for performing credit settlement by wireless communication without passing it, this is called a personal remote credit settlement system, and a credit settlement service provided by this system is called a personal remote credit settlement service To do.

As shown in the system configuration diagram of FIG. 1, the personal remote credit settlement system includes a personal credit terminal 100 having two systems of two-way wireless communication functions and an electronic credit card function, and a retail store. At the center of a communication network that connects a credit settlement device 101 that performs credit settlement processing, a settlement system 103 that performs credit settlement processing in a credit service company or a settlement processing company, and a personal credit terminal 100, credit settlement device 101, and settlement system 103 A service providing system 102 that is located to provide a personal remote credit settlement service, a digital public network 108 that provides a data transmission path in the network, and a wireless telephone base that connects the personal credit terminal 100 to the digital public network 108 With station 104 It is provided.
The personal credit terminal 100 is a portable wireless telephone terminal having two-way bidirectional wireless communication functions of infrared and digital wireless telephones and an electronic credit card function. The credit settlement apparatus 101 that performs credit settlement processing at a retail store also has two-way bidirectional communication functions of infrared communication and digital telephone communication.

  In FIG. 1, 105 is a transmission path for infrared communication between the personal credit terminal 100 and the credit card settlement apparatus 101, and 106 is a digital wireless communication performed between the personal credit terminal 100 and the base station 104. 107 is a digital communication line connecting the base station 104 and the digital public network 108, 109 is a digital communication line connecting the digital public network 108 and the service providing system 102, and 110 is a credit card settlement apparatus 101. And a digital telephone communication line 111 connecting the digital public network 108 and a digital communication line 111 connecting the service providing system 102 and the payment system 103.

The following forms are assumed as normal operation forms of the personal remote credit settlement service.
The payment system 103 is installed in a credit card company or a payment processing company, and the credit payment apparatus 101 is installed in a retail store. A consumer carries the personal credit terminal 100 with him. The service providing system 102 is installed in a company that provides a personal remote credit settlement service. When the credit card company provides a personal remote credit settlement service, the service providing system 102 is installed in a credit card company. Is done.
In addition, as a premise, the consumer must sign a credit service membership contract with a credit card company, and a personal remote credit settlement service membership contract with a company that provides a personal remote credit settlement service. In addition, we have a wireless telephone service contract with a telephone company. Similarly, a retail store also has a credit service merchant contract with a credit card company, and a personal remote credit payment service merchant with a company that provides a personal remote credit payment service. The company also has a contract for a digital telephony service with a telephone company.
In addition, when the personal remote credit settlement service is provided by a company different from the credit card company, the company providing the personal remote credit settlement service will enter into the credit service with the credit card company. For contracted members, instead of a credit card company, an electronic credit card is issued and a contract is made to operate a personal remote credit settlement service.
Further, when the payment processing company performs credit payment processing using the payment system 103, the credit card company has a contract with the payment processing company for the payment processing company to perform the credit payment processing. .

In the following, in order to simplify the description of the system, the consumer owned by the personal credit terminal 100 is a user, the retail store where the credit settlement apparatus 101 is installed is a merchant, and the credit settlement apparatus 101 The sales clerk who operates the service, the operator (Operator), the company that provides the personal remote credit payment service (Service Provider), the credit card company or the payment processing company that performs the credit payment processing using the payment system 103 Is referred to as a transaction processor.
In this system, when the user pays the merchandise for the merchandise by credit, the payment information is electronically exchanged between the three parties of the personal credit terminal 100, the credit settlement device 101 and the service providing system 102, Credit settlement processing is performed by electronically exchanging settlement information between the service providing system 102 and the settlement system 103.
Basically, the service providing system 102 receives a payment request and a payment request from the personal credit terminal 100 and the credit payment device 101, and collates the payment request and the payment request, and sends them to the user and the merchant. Instead, it requests payment processing from the payment system 103. Then, the payment system performs actual payment processing.

At this time, the personal credit terminal 100 and the credit settlement device 101 perform infrared communication using the transmission path 105, and the personal credit terminal 100 and the service providing system 102 include the transmission path 106, the base station 104, and , Digital telephone communication by digital wireless telephone is performed via the digital communication line 107, the digital public network 108, and the digital communication line 109. The credit settlement apparatus 101 and the service providing system 102 are a digital telephone communication line 110, a digital public network Digital telephone communication is performed via 108 and the digital communication line 109. The service providing system 102 and the payment system 103 perform digital data communication via the digital communication line 111.
In the communication between the personal credit terminal 100 and the service providing system 102, the communication between the credit settlement device 101 and the service providing system 102, and the communication between the service providing system 102 and the settlement system 103, all the settlement information exchanged , Encrypt and communicate. For encryption, information is electronically sealed and communicated by combining secret key encryption processing and public key encryption processing.

Next, each component which comprises this system is demonstrated.
First, the personal credit terminal 100 will be described.
2A and 2B are external views of the front side and the back side of the personal credit terminal 100, respectively.
In FIG. 2A, 200 is an infrared communication port (infrared light receiving and emitting unit) for performing infrared communication with the credit card settlement apparatus 101, 201 is an antenna for receiving and transmitting radio waves of a digital wireless telephone, 202 is a receiver / speaker, 203 is a 120 × 160 pixel color liquid crystal display (LCD), 204 is a mode switch for switching the operation mode of the personal credit terminal 100, 205 is a digital radio telephone call switch, and 206 is the end of the digital radio telephone. A switch 207 is a function switch, 208 is a numeric keypad switch, 209 is a power switch, and 210 is a microphone.
Further, in FIG. 2B, 211 is an execution switch that prompts execution of processing with user confirmation, such as payment of payment, confirmation of settlement contents, cancellation of credit transaction, etc., 212 for connecting a headset This is a headset jack.
The personal credit terminal 100 has two operation modes, a credit card mode and a digital radio telephone mode, which are switched by a mode switch 204. The personal credit terminal 100 operates as a digital wireless telephone in the digital wireless telephone mode, and operates as an electronic credit settlement means, that is, an electronic credit card in the credit card mode.
The electronic credit card is registered in the personal credit terminal 100 on the assumption that the user has a credit service membership contract with the credit card company. When the user has a membership contract for a plurality of credit services, a plurality of credit cards are registered in the terminal 100.
For example, when making a call using the personal credit terminal 100, the user first sets the operation mode to the digital wireless telephone mode with the mode switch 204, and then inputs the telephone number with the numeric key switch 208. Then, press the call switch 205. With the above operation, the user can make a call to the input telephone number.
Further, when a call is made to the personal credit terminal 100, the personal credit terminal 100 emits a ring tone regardless of the operation mode at that time. In this case, pressing the call switch 205 automatically switches to the digital wireless telephone mode, and the user can receive a call.
When paying the merchant with credit, first, the mode switch 204 sets the operation mode to the credit card mode, and the function switch 207 selects the credit card used for payment. Next, with the numeric keypad switch 208, the amount to be paid is input, the infrared communication port 200 is directed toward the merchant's credit payment apparatus 101, and the execution switch 211 is pressed. Through the above operation, the personal credit terminal 100 performs infrared communication with the credit settlement apparatus 101, and also performs digital wireless telephone communication with the service providing system 102, and exchanges settlement information respectively. Execute credit settlement processing. The internal configuration and detailed operation of the personal credit terminal 100 will be described later.

Next, the credit settlement apparatus 101 will be described.
FIG. 3 is an external view of the credit card settlement apparatus 101. This device includes a credit settlement terminal 300 having a credit settlement processing function and a digital telephone function, a cash register 311 for calculating the price of a product, and an RS-232C cable connecting the credit settlement terminal 300 and the cash register 301. 313 and an infrared light emitting / receiving module 301 connected to the credit card payment terminal 300 via a serial cable 310.
In FIG. 3, 302 is a 320 × 240 pixel color liquid crystal display (LCD), 303 is a receiver, 304 is a mode switch for switching the operation mode of the credit payment terminal 300, 305 is a telephone hook switch, 306 is , A function switch, 307 is a numeric key switch, 308 is an execution switch that prompts execution of a process with merchant confirmation such as payment, confirmation of settlement contents, cancellation of credit transaction, 309 is a power switch, Reference numeral 312 denotes a credit settlement switch that designates settlement processing by credit in the cash register 311.
The credit settlement terminal 300 has two operation modes, a credit settlement mode and a digital telephone mode, which are switched by a mode switch 304. In the digital telephone mode, it operates as a digital telephone, and in the credit settlement mode, it operates as a credit settlement processing terminal of a personal remote credit settlement service.
When making a call from the credit settlement terminal 300, for example, the person in charge first sets the operation mode to the digital telephone mode with the mode switch 304, and then inputs the telephone number with the numeric key switch 307. By the above operation, the person in charge can make a call to the entered telephone number.
Further, when a call is made to the credit settlement terminal 300, the credit settlement terminal 300 emits a ring tone regardless of the operation mode. In this case, when the telephone 303 is raised or the hook switch 305 is pressed, the telephone mode is automatically switched, and the person in charge can receive a call.
In the case of performing credit settlement processing, first, the cash register 311 calculates the total amount from the product price and the tax, and notifies the user of the amount. Next, the credit settlement switch 312 of the cash register 311 is pushed according to the request of the user who wishes to pay by credit, and the user waits for the user to perform a payment operation at the personal credit terminal 100. When the user performs a payment operation, the payment amount input by the user is displayed on the LCD 302, and further the result of the user's credit inquiry is displayed. The person in charge confirms the content and presses the execution switch 308.
Through the above operation, the credit settlement apparatus 101 exchanges settlement information with the personal credit terminal 100 and the service providing system 102, and performs credit settlement processing. The internal configuration and detailed operation of the credit settlement terminal 300 will be described later.

Next, the service providing system 102 will be described.
FIG. 4 is a block configuration diagram of the service providing system 102. The service providing system 102 performs data processing of payment information exchanged with each of the personal credit terminal 100, the credit payment device 101, and the payment system 103 and control of data communication at that time in the personal remote credit payment service. A service server 400 to perform, a service director information server 401 for managing attribute information on users, merchants, and payment processing institutions and service history information provided by the service providing system 102, user attribute information, and personal credit terminal 100 A user information server 402 that manages data in the client, a merchant information server 403 that manages merchant attribute information and data in the credit payment terminal 300, and attribute information of the payment processing organization and history information of payment processing Payment processing institution information server 404 Bis provider has a management system 407 for performing management of the service providing system 102, the servers 400 to 404 and management system 407 is composed of one or more computers.
The service server 400, the service director information server 401, the user information server 402, the merchant information server 403, and the payment processing organization information server 404 are connected to the ATM-LAN switch 405 by ATM-LAN cables 409, 410, 411, 412, 413, respectively. Accesses the service director information server 401, the user information server 402, the merchant information server 403, or the payment processing institution information server 404 via the ATM-LAN switch 405.
The ATM-LAN switch 405 is connected to the ATM switch 406 by an ATM-LAN cable 415. A digital communication line 109 connected to the digital public network 108 and a digital communication line 111 connected to the payment system 103 are connected to the ATM switch 404, and the service server 400 is connected via the ATM-LAN switch 405 and the ATM switch 406. It communicates with the personal credit terminal 100, the credit settlement apparatus 101, and the settlement system 103.
The management system 407 is connected to the ATM-LAN switch 406 by an ATM-LAN cable 414 and further connected to the ATM switch 406 by an ATM-LAN cable 416. The management system 407 is connected to the service server 400, the service director information server 401, the user information server 402, the merchant information server 403, or payment processing organization information via the ATM-LAN switch 408, the ATM switch 406, and the ATM-LAN switch 405. The server 404 is accessed to manage the operation of the service providing system 102.
The ATM switch 406 operates as a data communication switch in communication between the outside and inside of the service providing system 102 and communication between the inside of the service providing system 102. Further, the ATM switch 406 corresponds to a plurality of communication methods and has a function of a communication adapter. For example, in the communication between the service server 400 and the credit settlement apparatus 101, first, the ISDN data packet is exchanged between the credit settlement apparatus 101 and the ATM switch 406, and the ATM switch 406 converts the ATM packet from the ISDN data packet. The ATM packet is exchanged between the ATM exchange 406 and the service server 400. Similarly, in the communication between the service server 400 and the personal credit terminal 100 and the communication between the service server 400 and the settlement system 103, the ATM switch 406 corresponds to each communication method, and the communication data Perform conversion.
Further, in order to reduce the communication cost between the personal credit terminal 100 and the service providing system 102 and between the credit settlement apparatus 101 and the service providing system 102, the service providing system 102 usually provides a personal remote credit settlement service. It is installed for each area to provide. Therefore, the ATM switch 406 is connected with a dedicated digital communication line 417 that connects with service providing systems in other regions. In this case, the service providing systems 102 share data with each other and perform data processing in cooperation.

Next, the payment system 103 will be briefly described.
FIG. 5 is a block configuration diagram of the payment system 103. The payment system 103 includes a transaction processing server 500 that processes data of payment information exchanged with the service providing system 102 in a personal remote credit payment service, and a subscriber information server 501 that manages personal information of credit service subscribers. A merchant information server 502 that manages information on the merchant of the credit service, a transaction information server 503 that manages credit payment transaction information, and a management system 506 in which the payment processing organization manages the operation of the payment system 103. The servers 500 to 503 and the management system 506 are configured by one or a plurality of computers.
Further, the transaction processing server 500, the subscriber information server 501, the member store information server 502, and the transaction information server 503 are connected to the ATM-LAN switch 504 by ATM-LAN cables 508, 509, 510, 511, respectively. -Access the subscriber information server 501, member store information server 502, or transaction information server 503 via the LAN switch 504.
The ATM-LAN switch 504 is connected to the ATM switch 505 by an ATM-LAN cable 513. A digital communication line 111 connected to the service providing system 102 is connected to the ATM switch 505, and the transaction processing server communicates with the service providing system 102 via the ATM-LAN switch 504 and the ATM switch 505.
In the personal remote credit settlement service, the credit settlement processing performed by the settlement system 103 is performed by the transaction processing server 500 in response to a settlement request from the service providing system 102, the subscriber information server 501, the member store information server 502, and It is established by updating the information in the transaction information server 503, respectively.
In addition to the digital communication line 111 connected to the service providing system 102, the ATM switch 505 includes a bank dedicated line 515 connected to the bank online system, and a dedicated digital line 516 connected to a payment system of another payment processing institution. Connected, the payment system 103 communicates with the bank online system and the payment systems of other payment processing institutions to perform payment processing between financial institutions.
The management system 506 is connected to the ATM-LAN switch 507 via an ATM-LAN cable 512 and further connected to the ATM switch 505 via an ATM-LAN cable 514. The management system 506 accesses the transaction processing server 500, the subscriber information server 501, the member store information server 502, or the transaction information server 503 via the ATM-LAN switch 507, the ATM switch 505, and the ATM-LAN switch 504. The operational management of the settlement system 103 is performed.
The ATM switch 505 operates as a data communication switch in communication between the outside and the inside of the payment system 103 and communication between the inside of the payment system 103. Further, the ATM switch 505 has a function of a communication adapter corresponding to a plurality of communication methods, communication between the transaction processing server 500 and the service providing system 102, and communication between the transaction processing server 500 and the bank online system. In the communication between the transaction processing server 500 and the payment system of another payment processing organization, the ATM switch 505 converts communication data corresponding to each communication method.

Next, the personal remote credit settlement service provided by this system will be described.
The personal remote credit settlement service is roughly divided into four processes: “settlement”, “cancellation”, “customer service call”, and “inquiry call”.
“Payment” is a process in which the user pays the merchant with credit, using a wireless communication without directly transferring the credit card or statement of use, etc. “Cancel” is a personal remote credit payment The transaction completed by the service “payment” process is canceled by wireless communication based on the agreement between the user and the merchant. The “customer service call” is the “payment process” of the personal remote credit settlement service. The process of enabling telephone contact even if the merchant does not know the user's phone number, and the “inquiry call” is the “settlement” of the personal remote credit payment service. For merchants who had transactions during processing, Without The are known your phone number, it is a process that enables the phone of inquiry.

First, the processing flow of “settlement” will be described.
FIG. 6 shows the flow of “settlement” processing of the personal remote credit settlement service. 7A to 7H show examples of display on the LCD 203 of the personal credit terminal 100 in the above “settlement” process, and FIGS. 8A to 8G show credit settlement. The example of a display of LCD302 of the terminal 300 is shown.
7A is an initial screen when the personal credit terminal is in the digital wireless telephone mode, FIG. 7B is an initial screen when in the credit card mode, and FIG. 8A is a credit settlement terminal. Is an initial screen when in the digital telephone mode, and FIG. 8B is an initial screen when in the credit settlement mode.
The “settlement” process starts when the user presents what to purchase to the person in charge and the person in charge calculates the amount of the product.
In FIG. 6, first, the person in charge calculates the total amount of money using the cash register 311 of the credit card settlement apparatus (calculates the amount charged by the cash register 600). Then, the cash register displays the calculated total amount (display billing amount 601). The person in charge tells the user the total price of the product and asks for the payment method (shows the amount to be charged and asks for the payment method 602). The user desires “settlement” of the personal remote credit settlement service (instruct 603 “settlement” of the personal remote credit settlement service), and the person in charge responds to the credit settlement switch 312 of the credit settlement apparatus. Press (604 to press the credit settlement switch) to instruct the user to start the payment operation of the personal credit terminal 100 (instruction 606 to start the payment operation). At this time, a credit settlement command is transmitted from the cash register 311 to the credit settlement terminal 300 via the RS-232C cable 313. The credit settlement terminal 300 automatically enters the credit settlement mode, and displays a screen as shown in FIG. 8C on the LCD 302 (payment operation waiting display 605).
The user switches the personal credit terminal 100 to the credit card mode with the mode switch 204, switches the credit card displayed on the LCD 203 with the function switch 207, and selects the credit card to be used for payment. At this time, the personal credit terminal 100 changes from the screen of FIG. 7B to the screen of FIG. Further, the function switch 207 selects “payment” from the menu and presses the execution switch 211. Then, the personal credit terminal 100 becomes the screen of FIG. As shown in FIG. 7E, the user inputs the amount to be paid with the numeric keypad switch 208, designates a payment option with the function switch 207, and presses the execution switch 211. Then, the confirmation screen of FIG. 7F is displayed, and the user presses the execution switch 21 with the infrared communication port 200 facing the credit settlement terminal 300 (payment operation 607). Then, the personal credit terminal 100 transmits a message indicating the payment amount and a payment offer 608 to the credit card settlement apparatus 101 by infrared communication.

The credit settlement terminal 300 receives the payment offer 608 from the infrared light receiving and emitting module 301, collates the payment amount and the billing amount therein, and sends a response message for the payment offer, the payment offer response 609 to the personal by infrared communication.・ Send to credit terminal 100. Further, the credit settlement terminal 300 transmits a message for requesting a credit inquiry of the user, a credit inquiry request 610, to the service providing system 102 by digital telephone communication. At this time, the credit settlement terminal 300 becomes the screen of FIG. 8D (credit inquiry display 611).
On the other hand, the personal credit terminal 100 receives the payment offer response 609 from the infrared communication port 200, collates the billing amount and the payment amount, and requests a payment request 613, a message requesting payment of the price by credit. The data is transmitted to the service providing system 102 by digital wireless telephone communication. At this time, the personal credit terminal 100 displays the screen of FIG. 7G (payment process in progress display 612).
The service providing system 102 receives each of the credit inquiry request 610 from the credit settlement terminal 300 and the payment request 613 from the personal credit terminal 100, collates their contents, and further checks the credit status of the user, A response message for the credit inquiry request and a credit inquiry response 614 are generated and transmitted to the credit settlement terminal 300.
The credit settlement terminal 300 receives the credit inquiry response 614 from the service providing system 102, displays the content of the credit inquiry response 614 as shown in FIG. 8 (e), and informs the person in charge of the result of the credit inquiry ( Credit inquiry result display 615).
The person in charge confirms the credit inquiry result, presses the execution button 308 of the credit settlement terminal 300, and instructs the start of the settlement process (settlement process request operation 616). Then, the credit settlement terminal 300 transmits a message requesting settlement processing and a settlement request 617 to the service providing system 102 by digital telephone communication, and displays the screen of FIG. 8F (settlement execution display 618). .
The service providing system 102 receives the payment request 617 from the credit payment terminal 300, and transmits a payment request 619 to the payment system 103 and a message for requesting payment processing to the payment system 103. A Payment system 103 receives payment request 619 from service providing system 102, performs payment processing, and transmits a message indicating that payment processing has been completed and payment completion notification 620 to service providing system 102.
The service providing system 102 receives the payment completion notification 620 from the payment system 103, and transmits a payment completion notification 621 and a message indicating that the payment processing is completed to the credit payment terminal 300.
The credit settlement terminal 300 receives the settlement completion notification 621, displays the content of the settlement completion notification 621 as shown in FIG. 8G, and notifies the person in charge that the settlement processing has been completed (settlement completion display). 622). Further, the credit settlement terminal 300 issues an electronic receipt 623 and transmits it to the service providing system 102 by digital telephone communication.
The service providing system 102 receives the receipt 623 issued by the credit settlement terminal 300, generates a receipt 624 converted into a data format for the personal credit terminal, and uses the digital wireless telephone communication to receive the personal credit terminal 100. Send to.
The personal credit terminal 100 receives the receipt 624 from the service providing system 102, displays the contents of the receipt 624 as shown in FIG. 7 (h), and informs the user that the settlement processing is completed. (Receipt display 625).
As described above, the “settlement” process of the personal remote credit settlement service is performed. Details of the contents of data exchanged between devices in the above “settlement” process will be described later.

Next, the flow of “cancel” processing will be described.
FIG. 9 shows a flow of “cancel” processing of the personal remote credit settlement service.
FIGS. 10A to 10H show examples of display on the LCD 203 of the personal credit terminal 100 in the “cancel” process, and FIGS. 11A to 11G show credit settlement. The example of a display of LCD302 of the terminal 300 is shown.
The situation where the process of “cancellation” of the personal remote credit settlement service is performed includes a case where the user and the merchant are close enough to reach each other and a case where they are separated from each other. The difference between the two cases is whether the agreement between the user and the merchant regarding the first “cancel” process is made through a real voice conversation or by telephone. The same. Therefore, here, a case where both are remote from each other will be described.
The “cancel” process starts when the user and the merchant person in charge agree to perform the “cancel” process on the transaction once completed by the “settlement” process.
In FIG. 9, first, the user and the person in charge of the merchant agree to perform “cancel” processing by telephone (voice call 900), and both start a cancel operation.
First, the person in charge of the merchant uses the mode switch 304 to set the credit settlement terminal 300 to the credit settlement mode, and displays the screen of FIG. With the function switch 306, as shown in the screen of FIG. 11B, “Sale Cancel” is selected from the menu, and the execution switch 307 is pressed. Then, the sales history list of FIG. 11C is displayed on the credit settlement terminal 300, and the person in charge selects and executes the transaction to be canceled with the function switch 306 as shown in the screen of FIG. 11D. Press switch 308. Then, the confirmation screen shown in FIG. 11E is displayed, and the person in charge presses the execution switch 308 (cancel operation 901).
Then, the credit settlement terminal 300 transmits a cancel request 903, a message requesting the “cancel” process, to the service providing system 102 by digital telephone communication. At this time, the credit settlement terminal 300 displays the screen shown in FIG. 11F (cancellation display 902).

On the other hand, the user switches the personal credit terminal 100 to the credit card mode with the mode switch 204, switches the credit card displayed on the LCD 203 with the function switch 207, and selects the credit card used for payment. Further, with the function switch 207, as shown in the screen of FIG. 10A, “Cancel” is selected from the menu, and the execution switch 211 is pressed. Then, a purchase history list screen shown in FIG. 10B is displayed on the personal credit terminal 100, and the user selects a transaction to be canceled with the function switch 207 and presses the execution switch 211. Then, the confirmation screen shown in FIG. 10C is displayed, and the user presses the execution switch 211 (cancel operation 904).
The personal credit terminal 100 transmits a message requesting “cancel” processing, a cancel request 906 to the service providing system 102 by digital wireless telephone communication. At this time, the personal credit terminal 100 displays the screen of FIG. 10D (cancellation processing display 905).
The service providing system 102 receives the cancellation request 903 from the credit settlement terminal 300 and the cancellation request 903 from the personal credit terminal 100, respectively, collates their contents, and “cancel” to the settlement system 103. A message requesting the above process and a cancel request 907 are transmitted.
The settlement system 103 receives the cancellation request 907 from the service providing system 102, cancels the requested transaction, and transmits a message indicating that the cancellation processing is completed and a cancellation completion notification 908 to the service providing system 102. .
The service providing system 102 receives the cancellation completion notification 908 from the settlement system 103, transmits a message indicating that the cancellation processing is completed, and the cancellation completion notification 909 to the credit settlement terminal 300 by digital telephone communication. A message indicating that the cancellation process is completed and a cancellation process receipt 910 are generated and transmitted to the credit terminal 100 through digital wireless telephone communication.
The credit settlement terminal 300 receives the cancellation completion notification, displays the content of the cancellation completion notification as shown in FIG. 11G, and notifies the person in charge that the cancellation processing is completed (cancel processing completion display 911 ).
The personal credit terminal 100 receives the cancellation processing receipt, displays the cancellation processing receipt as shown in FIG. 10E, and notifies the user that the cancellation processing has been completed (cancel processing receipt display). 912).
As described above, the “cancel” process of the personal remote credit settlement service is performed. Thereafter, the person in charge can make another telephone call (voice call 914) with the user by operating the customer service call (customer service call 913). The customer service call will be described later. The details of the data exchanged between devices in the “cancel” process will be described later.

Next, the processing flow of “customer service call” will be described.
FIG. 12A shows a flow of processing of “customer service call” of the personal remote credit settlement service. FIGS. 13A to 13B show examples of display on the LCD 203 of the personal credit terminal 100 in the above-mentioned “customer service call” process, and FIGS. The example of a display of LCD302 of the credit payment terminal 300 is shown.
A “customer service call” is a process that enables a telephone contact to a user who has made a transaction through the “settlement” process of a personal remote credit settlement service, even if the merchant does not know the user's phone number. is there. Therefore, the “customer service call” is based on the assumption that there has been a transaction between the user and the merchant by the “settlement” process of the personal remote credit settlement service before.
The processing of “customer service call” starts when the person in charge of the merchant starts the operation of “customer service call” at the credit settlement terminal 300.
12A, first, the merchant person in charge uses the mode switch 304 to set the credit settlement terminal 300 to the credit settlement mode and display the screen of FIG. 14A. Next, the person in charge selects “sales history” from the menu with the function switch 306 and presses the execution switch 308. Then, the sales history list of FIG. 14B is displayed on the credit settlement terminal 300. The person in charge uses the function switch 306 to select a transaction exchanged with the user who wants to make a telephone contact, as shown in the screen of FIG. 14 (c), and click “telephone” from the operation menu at the bottom of the screen. Select and press the execution switch 308 (customer service call operation 1200). Then, the credit settlement terminal 300 automatically enters the digital telephone mode, displays the screen of FIG. 14D (display during execution of connection process 1201), and makes a “customer service call” to the service providing system 102. A message requesting the processing of the customer, a customer service call request 1202 is transmitted by digital telephone communication.
The service providing system 102 receives the customer service call request 1202, compares it with the access control information set by the user, calls a user call message, the customer service call 1203, and the user's personal credit terminal 100 by digital wireless telephone communication. Send to. Further, the service providing system 102 transmits a message permitting a call with the user and a customer service call request response 1204 to the credit settlement terminal 300 by digital telephone communication.
The credit settlement terminal 300 receives the customer service call request response 1204 from the service providing system 102, displays the screen of FIG. 14 (e), and informs the person in charge that the user is called (calling display 1206). .

On the other hand, the personal credit terminal 100 receives the customer service call 1203, outputs a ringtone, displays the screen of FIG. 13 (a), and informs the user that a call is received from the merchant (incoming call). Display 1205). When the user presses the call switch 205 (call operation 1207), the personal credit terminal 100 transmits a message indicating that the user has accepted the incoming call, an incoming call response 1208 to the service providing system 102 by digital wireless telephone communication, The screen shown in FIG. 13B is displayed (display during call 1209).
The service providing system 102 receives the incoming response 1208, and transmits a message indicating that the user has accepted the call, a call response 1210, to the credit card payment terminal 300 through digital telephone communication.
The credit settlement terminal 300 receives the call response 1210, displays the screen of FIG. 14F (display during call 1211), and the merchant enters a call state with the user (voice call 1212).
As described above, the “customer service call” process of the personal remote credit settlement service is performed.
As for the customer service call, the person in charge of the merchant selects “telephone” from the operation menu at the bottom of the sales history detailed screen of FIG. 14G and presses the execution switch 308 (customer service call operation 1200 ) To start the process, and on the completion screen of the “cancel” process in FIG. 11G, select “customer service call” from the operation menu at the bottom of the screen and press the execution switch 308. The processing can also be started by (customer service call operation 1200).
Details of the contents of data exchanged between devices in the above-mentioned “customer service call” processing will be described later.

Next, the processing flow of “inquiry call” will be described.
FIG. 12B shows a flow of processing of “inquiry call” of the personal remote credit settlement service.
FIGS. 13B to 13F show examples of display on the LCD 203 of the personal credit terminal 100 in the above-described “inquiry call” process, and FIGS. 14H and 14F show credits. The display example of LCD302 of the payment terminal 300 is shown.
An “inquiry call” is a process that allows a merchant who has made a transaction through the “settlement” process of a personal remote credit settlement service to make an inquiry call without the user having to know his / her phone number. is there.
The “inquiry call” process starts when the user starts the “inquiry call” operation on the personal credit terminal 100.
In FIG. 12B, first, the user switches the personal credit terminal 100 to the credit card mode with the mode switch 204 and displays the screen of FIG. 13C. Next, as shown in the screen of FIG. 13D, the user selects “usage history” from the menu with the function switch 207 and presses the execution switch 211. Then, on the personal credit terminal 100, the sales history list of FIG. Using the function switch 207, the user selects a transaction exchanged with the merchant trying to make a telephone contact as shown in the screen of FIG. 13 (f), and selects "inquiry" from the operation menu at the bottom of the screen. Then, the execution switch 211 is pressed (inquiry call operation 1213). Then, the personal credit terminal 100 automatically enters the digital wireless telephone mode, displays the screen of FIG. 13G (display during execution of connection process 1214), and makes an “inquiry call” to the service providing system 102. A message requesting the processing "" and an inquiry call request 1215 are transmitted by digital wireless telephone communication.
The service providing system 102 receives the inquiry call request 1215, and transmits a message for calling the merchant, an inquiry call 1216, to the merchant's credit settlement terminal 300 by digital telephone communication. Furthermore, the service providing system 102 transmits a message permitting a call with the merchant and an inquiry call request response 1217 to the personal credit terminal 100 by digital wireless telephone communication.
The personal credit terminal 100 receives the inquiry call request response 1217 from the service providing system 102, displays the screen of FIG. 13 (h), and informs the user that the merchant is called (calling display 1219).

On the other hand, the credit settlement terminal 300 receives the inquiry call 1216, outputs a ringtone, displays the screen of FIG. 14 (h), and informs the merchant that a call is received from the user (incoming display 1218). ). When the merchant person in charge picks up the handset 303 (call operation 1220), the credit settlement terminal 300 sends a message indicating that the merchant has accepted the incoming call, an incoming call response 1221 to the service providing system 102 by digital telephone communication, The screen shown in FIG. 14F is displayed (in-call display 1222).
The service providing system 102 receives the incoming response 1221, and transmits a message indicating that the merchant has accepted the call, a call response 1223, to the personal credit terminal 100 by digital wireless telephone communication.
The personal credit terminal 100 receives the call response 1223, displays the screen of FIG. 13B (in-call display 1224), and the user enters a call state with the merchant (voice call 1225).
As described above, the “inquiry call” process of the personal remote credit settlement service is performed.
The inquiry call is processed by the user selecting “inquiry” from the operation menu at the bottom of the screen in FIG. 13 (i) and pressing the execution switch 211 (inquiry call operation 1213). You can also start.
Details of the contents of data exchanged between devices in the above-described “inquiry call” processing will be described later.

Next, the internal configuration of the personal credit terminal 100 will be described.
FIG. 15A is a block diagram of the personal credit terminal 100. This terminal includes a CPU (Central Processing Unit) 1500 that performs processing of transmission data and reception data and control of other components via a bus 1529 in accordance with a program stored in a ROM (Read Only Memory) 1501. Data processed by CPU 1500, RAM (Random Access Memory) 1502 storing data processed by CPU 1500, terminal ID of personal credit terminal 100, telephone number, user ID of user, private key and public key And the operation of the LCD 203 in accordance with the control of the EEPROM (Electric Erasable Programmable Read Only Memory) 1503 in which the service provider ID, the telephone number, and the service provider's public key of the service providing system 102 are stored, and the CPU 1500. LCD controller 1504 for displaying an image set by CPU 1500 on LCD, and control of CPU 1500 Encryption processor 1505 that performs data encryption processing and decryption processing according to the above, data codec 1506 that encodes transmission data and decrypts received data according to the control of CPU 1500, and infrared transmission during infrared communication And an infrared communication module 1507 that performs reception, and a key operation control unit that detects switch operations of a mode switch 204, a call switch 205, an end switch 206, a function switch 207, a numeric key switch 208, a power switch 209, and an execution switch 211 by the user 1509, a speaker 1510, a receiver 202 or a headset jack 212, an audio processing unit 1511 for amplifying an analog audio signal input from the microphone 210 or the headset jack 212, and a code for the digital audio data of the analog audio signal 1542 And digital audio data analog Voice codec 1512 for decoding to voice signal 1543, channel codec 1513 for generating transmission data on the wireless channel and extracting data addressed to itself from received data, and serial code input from channel codec 1513 A modulator 1514 that converts the digital signal 1547 into an analog transmission signal 1549 that uses the oscillation electric signal 1552 supplied from the PLL 1516 as a baseband, and an oscillation electric signal 1553 that is supplied from the PLL 1516 as the baseband of the analog reception signal 1550 Demodulate analog reception signal 1550, demodulator 1515 that supplies serial digital signal 1548 to channel codec 1513, analog transmission signal 1549 supplied from modulator 1514 is converted to radio waves and output from antenna 201, and vice versa When the radio wave is received by the antenna 201, the analog reception signal 1550 is input to the demodulation unit 1515. 1517, battery capacity detection unit 1518 for detecting the battery capacity of the personal credit terminal 100, start control of the channel codec 1513, PLL 1516 and RF unit 1517, key operation control unit 1509, channel codec 1513 and battery capacity detection unit 1518 And a control logic unit 1508 serving as an interface when the CPU 1500 accesses a key operation control unit 1509, an audio processing unit 1511, and a register inside the channel codec.
The cryptographic processor 1505 has a secret key encryption / decryption function and a public key encryption / decryption function, and is set by the CPU 1500 with the encryption method and key set by the CPU 1500. Data is encrypted or decrypted.
The data codec 1506 performs encoding of transmission data and decoding of reception data according to the control of the CPU 1500. In this case, the encoding is actually transmitted including communication control information and error correction information. Decoding is a process that performs error correction processing on received data, removes unnecessary communication control information, and generates data that the sender originally intended to transmit To do. The data codec 1506 has a data encoding / decoding function in data communication of a digital wireless telephone and a data encoding / decoding function in infrared communication. The data set by the CPU 1500 The encoding process and the decoding process set by the above are performed.
Further, as shown in FIG. 15B, the infrared communication module 1507 includes therein a serial-parallel conversion circuit 1560 that performs bidirectional conversion between parallel data and serial data, and a serial-parallel conversion circuit 1560. The digital signal 1562 converted into serial data is modulated into a signal that is actually transmitted as infrared light, and the modulation / demodulation circuit 1561 that demodulates the received analog signal 1565 into the serial digital signal 1563 and the modulation / demodulation circuit 1561 An infrared light receiving and emitting unit 200 that converts the signal 1564 into infrared rays to emit light and converts the received infrared rays into an analog signal 1565 is provided.
In addition, the key operation control unit 1509 that detects the switch operation by the user allows the user to select one of the mode switch 204, the call switch 205, the end switch 206, the function switch 207, the numeric key switch 208, the power switch 209, or the execution switch 211. When pressed, the key operation control unit 1509 asserts an interrupt signal 1538 that prompts the CPU 1500 to perform processing corresponding to the switch operation. Further, the key operation control unit 1509 includes a key operation control register (KEYCTL) 1812 for setting validity / invalidity of each switch, as shown in FIG.
Further, as shown in FIG. 18A, the voice processing unit 1511 includes a voice processing unit control register (SCTL) that controls a voice processing operation.
The audio codec 1512 also encodes the analog audio signal 1542 input from the audio processing unit 1511 into digital audio data and decodes the digital audio data input from the channel codec 1513 into the analog audio signal 1543. The analog audio signal 1543 is supplied to the audio processing unit 1511. The audio processing unit 1511 amplifies the analog audio signal 1543 and drives the receiver 202, so that audio is output from the receiver 202. The digital audio data generated by the encoding is supplied to the channel codec 1513 and actually converted into transmission data on the radio channel.
In addition, two types of data are input to the channel codec 1513 as data to be transmitted. One is digital audio data input from the audio codec 1512, and the other is data communication data input from the CPU 1500 via the control logic unit 1508.

The channel codec 1513 adds identification information between digital audio data and data communication data to each data as header information, and further converts the data into a digital radio telephone data format to modulate the serial digital signal 1547. Part 1514.
Conversely, the channel codec 1513 first checks the terminal ID against the serial digital signal 1548 input from the demodulator 1515, extracts only the data addressed to itself, and further controls the communication of the digital radio telephone. The information is removed, the digital audio data and the data communication data are identified from the header information of the data, and supplied to the audio codec 1512 and the control logic unit 1508, respectively. The channel codec 1513 asserts an interrupt signal 1554 when a digital wireless telephone is received and when data communication data is received. The interrupt signal 1554 is an interrupt signal that prompts the CPU 1500 to perform processing upon arrival of a digital wireless telephone and processing of data communication data.
In order to perform such operations, the channel codec 1513 performs an ID register (ID) 1805 for storing a terminal ID and a channel codec control register (CHCTL) for controlling the operation of the channel codec 1513, as shown in FIG. 1806, an audio transmission buffer 1807 for storing digital audio data input from the audio codec 1512, an audio reception buffer 1808 for storing digital audio data extracted from the received data, and data input from the control logic unit 1508 A data transmission buffer 1809 for storing communication data and a data reception buffer 1810 for storing data communication data extracted from the received data are provided.

The modulation unit 1514 converts the serial digital signal 1547 input from the channel codec 1513 into an analog transmission signal 1549 using the oscillation electric signal 1552 supplied from the PLL 1516 as a baseband, and supplies the analog transmission signal 1549 to the RF unit. The analog transmission signal 1549 supplied to the RF unit is output from the antenna 201 as a radio wave.
Conversely, when the antenna 201 receives a radio wave, the analog reception signal 1550 is input from the RF unit 1517 to the demodulation unit 1515. The demodulation unit 1515 demodulates the analog reception signal 1550 using the oscillation electric signal 1553 supplied from the PLL 1516 as a baseband of the analog reception signal 1550 and supplies the serial digital signal 1548 to the channel codec 1513.
The battery capacity detection unit 1518 that detects the battery capacity asserts the interrupt signal 1557 when the battery capacity of the personal credit terminal 100 becomes equal to or less than the value Q (Q> 0) set by the CPU 1500. The interrupt signal 1557 is an interrupt signal that prompts the CPU 1500 to back up the data on the RAM 1502, and Q is a value sufficient for the personal credit terminal 100 to perform the backup process.
Further, as shown in FIG. 18A, the control logic unit 1508 includes a frame counter (FRAMEC) 1800, a start frame register (FRAME) 1801, a clock counter (CLOCKC) 1802, and an update time register (UPTIME). Five registers, 1803 and interrupt register (INT) 1804, are incorporated.
The frame counter 1800 is a counter that counts the number of frames of the digital radio telephone, the activation frame register 1801 is a register that stores a frame number to be activated next time, the clock counter 1802 is a counter that counts the current time, and an update time register 1803 Is a register that stores the time when the personal credit terminal 100 communicates with the service providing system 102 to update the data on the RAM 1502 (update process), and an interrupt register 1804 is used to interrupt the CPU 1500. This is a register indicating the cause.

In general, in a digital radio telephone, incoming control of the control channel of the digital radio telephone is intermittently received and collated with a terminal ID to realize an incoming call for the telephone addressed to itself. This personal credit terminal 100 uses the frame counter 1800 and the activation frame register 1801 to receive control data intermittently. The frame number to be activated next time is stored in the activation frame register 1801 in advance, and when the frame counter 1800 counts up and becomes equal to the value of the activation frame register 1801, the control logic unit 1508 Via the signal line 1558, the channel codec 1513, PLL 1516, and RF unit 1517 are activated to receive control data.
In addition, when one of the interrupt signals 1538, 1554, and 1557 is asserted, the control logic unit 1508 sets the interrupt factor in the interrupt register (INT) 1804, asserts the interrupt signal 1519, The CPU 1500 is prompted for interrupt processing. The CPU 1500 reads the interrupt register 1804 in the interrupt process and performs a process according to the interrupt factor.

Each bit field of the interrupt register (INT) 1804 has a meaning as shown in FIG.
Bit 31 indicates the state of the power switch 209. When the value is 0, it indicates that the power is off. When the value is 1, it indicates that the power is on.
Bit 30 indicates the state of digital wireless telephone communication. When the value is 0, the digital wireless telephone communication is not performed. When the value is 1, the digital wireless telephone communication is performed. Indicates that there is.
Bit 29 indicates the occurrence of a frame interrupt that encourages intermittent reception of control data. When the value is 1, it indicates that a frame interrupt has occurred. In this bit field, 1 is set when the value of the frame counter 1800 matches the value of the activation frame register 1801.
Bit 28 indicates the occurrence of an incoming call interrupt. When the value is 1, it indicates that a digital wireless telephone has been received. In this bit field, 1 is set when the terminal ID matches and the interrupt signal 1554 is asserted in the intermittent reception of control data of the digital radio telephone.
Bit 27 indicates the occurrence of a data reception interrupt. When the value is 1, it indicates that data reception data has been received. In this bit field, 1 is set when data communication data is received and an interrupt signal 1554 is asserted in digital wireless telephone communication.
Bit 26 indicates the occurrence of an update interrupt that prompts the data update process. When the value is 1, it indicates that an update interrupt has occurred. In this bit field, 1 is set when the value of the clock counter 1802 matches the value of the update time register 1803.
Bit 25 indicates the occurrence of a battery interrupt that prompts backup processing. When the value is 1, it indicates that a battery interrupt has occurred. This bit field is set to 1 when the interrupt signal 1557 input from the battery capacity detection unit 1518 is asserted.
Bit 24 indicates the occurrence of a key interrupt due to a switch operation. When the value is 1, it indicates that a key interrupt has occurred.
Bits 0 to 9 correspond to switches 0 to 9 of the numeric keypad 208, and bits 10 and 11 correspond to “*” and “#” switches of the numeric keypad, respectively. , Bits 12 to 15 correspond to the “F1” to “F4” switches of the function switch 207, respectively, and bits 16 to 20 respectively include the power switch 209, the execution switch 211, the mode switch 204, and the call switch. 205, corresponding to the end switch 206, when the bit value is 1, it indicates that the switch corresponding to that bit has been pressed.

Next, data stored in the RAM 1502 will be described.
FIG. 16 is a schematic diagram of a RAM map of data stored in the RAM 1502.
The RAM 1502 has five areas: a basic program area 1600, a service data area 1601, a user area 1602, a work area 1603, and a temporary area 1604. The basic program area 1600 stores a version-upgraded module stored in the ROM 1501 and a patch program.
The user area 1602 is an area that can be freely used by the user, the work 1603 area is a work area used when the CPU 100 executes a program, and the temporary area 1604 is a temporary information received by the personal credit terminal 100. This is the area to be stored. The service data area 1601 is an area for storing ID information, credit card information, history information, etc. of the personal remote credit settlement service, and the data in this area is managed by the service providing system 102.
The service data area 1601 further includes eight areas of data management information 1605, personal information 1606, photo data 1607, user setting information 1608, telephone information 1609, credit card list 1610, usage history list 1611, and actual data area 1612. There is. The data management information 1605 is an area for storing management information of information stored in the service data area 1601, the personal information 1606 is an area for storing information such as the user's name, age, and sex, and the photo data area 1607 is An area for storing user face photo data, user setting information 1608 is an area for storing user setting information related to the personal remote credit settlement service, and telephone information 1609 is for storing information related to a digital wireless telephone. Area, credit card list 1610 is an area for storing list information of credit cards registered by the user, usage history list 1611 is an area for storing usage history information of personal remote credit settlement service, actual data area 1612 is This is an area for storing entity data of information managed in the other seven areas.

Next, information stored in the service data area 1601 will be described in detail.
FIG. 17 is a schematic diagram showing in detail the relationship of information stored in the service data area 1601.
Data management information 1605 includes update date 1700, next update date 1701, terminal status 1702, personal information address 1703, photo data address 1704, user setting information address 1705, telephone information address 1706, credit card list address 1707, and usage It is composed of nine pieces of information of a history list address 1708.
The update date and time 1700 indicates the date and time when the service providing system 102 updated the data in the service data area 1601 last time, and the next update date and time 1701 indicates the scheduled date and time when the service providing system 102 will update the data in the service data area 1601 next time. Indicates. The personal credit terminal 100 automatically starts data update processing when the next update date and time 1701 is set.
The data update process is a process in which the service providing system 102 updates the data in the service data area 1601. The data update process will be described in detail later.
The terminal status 1702 indicates the status of the personal credit terminal 100, and includes a personal information address 1703, a photo data address 1704, a user setting information address 1705, a telephone information address 1706, a credit card list address 1707, and a usage history list address. Reference numeral 1708 denotes the start address of an area in which personal information 1606, photo data 1607, user setting information 1608, telephone information 1609, credit card list 1610, and usage history list 1611 are stored.
The telephone information 1609 is further composed of three pieces of information: a calling telephone number 1709, a telephone directory address 1710, and a speed dial setting file address 1711. The outgoing telephone number 1709 indicates the telephone number of the telephone that the user made last time, and this information is used when the digital wireless telephone is retransmitted. The phone book address 1710 and the speed dial setting file address 1711 indicate addresses on the substantial data area in which the phone book information and the speed dial setting file are stored, respectively.
The credit card list 1610 stores credit card list information registered by the user. In credit card list 1610, credit card name 1712 (1719), credit card number 1713 (1720), expiration date 1714 (1721), credit card status 1715 (1722), image data Seven pieces of information of an address 1716 (1723), an object data address 1717 (1724), and an access time 1718 (1725) are stored.
The credit card status 1715 (1722) indicates whether or not the credit card is valid and the limit of use, and the image data address 1716 (1723) is an entity data area in which the image data of the credit card is stored. Indicates the address on 1612. The object data address 1717 (1724) indicates the address where the object data of the credit card program is stored, and the access time 1718 (1725) indicates the latest time when the user used the credit card. .
The object data address 1717 (1724) stores a local address indicating an address on the actual data area 1612 or a remote address indicating an address on the user information server 402 of the service providing system 102. When the remote address is stored in the object data address 1717 (1724), when the user selects and uses the credit card, the personal credit terminal 100 receives the object data from the service providing system 102. Data is downloaded to a temporary area 1604 and a credit card program is executed. If only the credit card is displayed, the image data in the actual data area 1612 indicated by the image data address 1716 (1723) is displayed, and the object data is not downloaded.
The address stored in the object data address 1717 (1724) is determined by the service providing system 102. During the data update process, the access times of the credit cards are compared, and a local address is assigned to the credit card with the latest access time. However, if the capacity of the actual data area 1612 is sufficient, the object data address of all credit cards may be a local address.

In the usage history list 1611, the request number 1726 (1730), service code 1727 (1731), usage time 1728 (1732), and usage information address 1729 (1733) are used for the usage of one personal remote credit settlement service. Are stored.
The request number 1726 (1730) is a number uniquely indicating a transaction with the merchant, and the number issued by the personal credit terminal 100 when generating the payment offer 608, and the service code 1727 (1731) is the credit used. A code number indicating the type of card service, use time 1728 (1732) indicates the time when the personal / remote credit settlement service is used, and use information address 1729 (1733) indicates an address where the receipt is stored.
In the usage information address 1729 (1733), a local address indicating an address on the entity data area 1612 or a remote address indicating an address on the user information server 402 of the service providing system 102 is stored.
When a remote address is stored in the usage information address 1729 (1733), when the user accesses the usage history information, the personal credit terminal 100 downloads the usage information from the service providing system 102 to the temporary area 1604. And displayed on the LCD 203.
The address stored in the usage information address 1729 (1733) is also determined by the service providing system. During the data update process, the usage times of the usage information are compared, and a local address is assigned to the usage information with the latest usage time. However, if the capacity of the actual data area 1612 has a margin, all the usage information addresses may be local addresses.

Next, processing performed by the CPU 1500 will be described.
FIG. 19 is a conceptual diagram of a flow of processing performed by the CPU 1500.
As shown in FIG. 19, the processing of the CPU 1500 can be roughly divided into 10 types of processes and interrupt processing 1901.
The ten types of processes are power-on process, wireless telephone process, credit card process, inquiry call process, customer service call process, data update process, backup process, remote access process, session establishment process, and power-off process. These ten kinds of processes are executed in the main loop 1900.
Corresponding to each process, each process has a word field indicating the status (state) of the process on the RAM 1502, and the CPU 1500 executes each process according to the value of the process status.
The power-on process is a process for performing an initial operation when the user turns on the power switch, the wireless telephone process is a process for performing processing in the digital wireless telephone mode, and the credit card process is performing processing in the credit card mode Process, inquiry call process, "inquiry call" process, customer service call process, "customer service call" process, data update process, data update process, backup process, The backup process, the remote access process is a process for accessing data on the user information server of the service providing system, and the session establishment process is a process for accessing the service providing system. Process for performing a process of establishing a trust session, the power-off process is a process for performing termination processing when the user turns off the power switch.

In FIG. 19, when the personal credit terminal is reset, the process proceeds to step 1902 where the CPU 1500 sets the power-on process to “active”.
Next, in step 1903, it is checked whether or not the power-on process is “active”. If “inactive”, the process proceeds to step 1905. If “active”, the process proceeds to step 1904, and the power-on process is executed for a certain period of time. Then, the process proceeds to Step 1905.
In step 1905, it is checked whether or not the wireless telephone process is “active”. If “inactive”, the process proceeds to step 1907. If “active”, the process proceeds to step 1906, and the wireless telephone process is executed for a certain period of time. Proceed to step 1907.
In step 1907, it is checked whether or not the credit card process is “active”. If “inactive”, the process proceeds to step 1909. If “active”, the process proceeds to step 1908, and the credit card process is executed for a certain time. Proceed to step 1909. In step 1909, it is checked whether the inquiry call process is “active”. If “inactive”, the process proceeds to step 1911. If “active”, the process proceeds to step 1910, and the inquiry call process is executed for a certain period of time. Go to step 1911. In step 1911, it is checked whether or not the customer service call process is “active”. If “inactive”, the process proceeds to step 1913. If “active”, the process proceeds to step 1912 and the customer service call process is executed for a certain period of time. Then, the process proceeds to Step 1913.
In step 1913, it is checked whether or not the data update process is “active”. If “inactive”, the process proceeds to step 1915. If “active”, the process proceeds to step 1914, and the data update process is executed for a predetermined time. Go to step 1915.
In step 1915, it is checked whether or not the backup process is “active”. If “inactive”, the process proceeds to step 1917. If “active”, the process proceeds to step 1916. Proceed to 1917.
In step 1917, it is checked whether or not the remote access process is “active”. If “inactive”, the process proceeds to step 1919. If “active”, the process proceeds to step 1918, and the remote access process is executed for a certain period of time. Go to step 1919. In step 1919, it is checked whether or not the session establishment process is “active”. If “inactive”, the process proceeds to step 1921. If “active”, the process proceeds to step 1920, and the session establishment process is executed for a certain period of time. The process proceeds to step 1921.
In Step 1921, it is checked whether or not the power-off process is “active”. If “active”, the process proceeds to Step 1922, the power-off process is executed, and if “inactive”, the process returns to Step 1903. When the interrupt signal 1518 is asserted, the CPU executes the interrupt process 1901 and returns to the process of the original main loop 1900.
In the interrupt processing 1901, first, in step 1923, the CPU 1500 reads the interrupt register (INT) 1804 and copies it to a word interrupt on the RAM (work area). At this time, the interrupt register (INT) 1804 read to the CPU is echo reset.
Next, in step 1924, it is checked from the value of bit 28 of interrupt whether or not it is an incoming interrupt. If it is not an incoming interrupt (interrupt (bit28) = 0), the process proceeds to step 1926. (bit28) = 1) goes to Step 1925, sets the process status of the radio telephone process to “active”, and goes to Step 1926.
In step 1926, it is checked from the value of bit 26 of interrupt whether or not it is an update interrupt. If it is not an update interrupt (interrupt (bit26) = 0), the process proceeds to step 1928. = 1) proceeds to step 1927, sets the process status of the data update process to “active”, and proceeds to step 1928.
In step 1924, it is checked from the value of interrupt bit 25 whether or not it is a backup interrupt. If it is not a backup interrupt (interrupt (bit25) = 0), the process proceeds to step 1930, and if a backup interrupt occurs (interrupt (bit25) = 1) proceeds to step 1929, sets the process status of the backup process to “active”, and proceeds to step 1930.
In step 1930, it is checked from the value of bit 24 of interrupt whether or not it is a key interrupt. If it is not a key interrupt (interrupt (bit24) = 0), the interrupt process is terminated and the process returns to the original main loop process. In the case of a key interrupt (interrupt (bit 24) = 1), the process proceeds to step 1931.
In step 1931, the value of the interrupt “power” bit (bit 16) is checked. If it is 0, the interrupt processing is terminated and the processing returns to the main loop processing. In case of 1, the power switch is operated. The process proceeds to step 1932.
In step 1932, the value of the “power display” bit (bit 31) of interrupt is checked. If it is 0, it is determined that the power-off operation has been performed, and the process proceeds to step 1934. It is determined that the operation has been performed, and the process proceeds to Step 1933.
In step 1933, the process status of the power-on process is set to “active”, the interrupt process is terminated, and the process returns to the original main loop process.
In step 1934, the process status of the power-off process is set to “active”, the interrupt process is terminated, and the process returns to the original main loop process.
In the interrupt process 1901, the process whose process status is “active” returns to the main loop and is executed in the main loop.

Next, digital signature processing and sealed processing performed when the personal credit terminal generates a message to be transmitted to the credit settlement terminal and the service providing system will be described.
Since digital signature processing and sealed processing are performed in the same manner at the credit settlement terminal, the characters are not called users, merchants, or service providers in the following. Generalize the characters and explain them.
A digital signature is an electronic signature on a message using the property that “a message encrypted with a private key can only be decrypted with the public key corresponding to the private key” of public key encryption processing. It is processing to apply.
FIGS. 20A and 20B are a flow diagram illustrating a procedure of digital signature processing when a digital signature of Mr. A is added to a message (Message), and a conceptual explanatory diagram of the flow, respectively.
First, in step 2000, the CPU performs a hash function operation on the message 2003 to generate a message digest 2004.
Next, in step 2001, the CPU encrypts the message digest 2004 with Mr. A's private key using a cryptographic processor to generate a digital signature 2005.
Next, in step 2002, the CPU adds the digital signature 2005 to the original message 2003. Through the above procedure, the CPU generates a message 2006 with Mr. A's digital signature.
In FIG. 20B, 2006 shows a message with Mr. A's digital signature. In the following, the digitally signed message is shown as 2006 in the drawing.

Next, the sealing process will be described. The sealed process uses the property that “a message encrypted with a public key can be decrypted only with a private key corresponding to the public key” of the public key encryption process. It is a process that makes it readable only by people.
FIGS. 21A and 21B are a flow diagram showing a processing procedure for sealing a message with Mr. A's digital signature to Mr. B as a destination, and a conceptual explanation diagram of the flow.
First, in step 2100, the CPU generates a secret key type encryption key, a secret key 2104, using a random function. Next, in step 2101, the CPU encrypts the digitally signed message 2006 with the secret key 2104 using the cryptographic processor.
Next, in step 2102, the CPU encrypts the secret key 2104 with the public key of the destination B using the cryptographic processor.
Next, in step 2103, the CPU adds the output 2106 of step 2102 to the output 2105 of step 2101. The message 2107 sealed to Mr. B is generated by the above procedure.
2007 in FIG. 21 (b) illustrates a sealed message addressed to Mr. B. In the following, the sealed message is illustrated in the drawing as 2007. To do.

Next, a process for decrypting a sealed message and a process for verifying a digital signature performed when the personal credit terminal receives a message from the service providing system will be described. Even in this case, the characters are generalized and described.
First, the decoding process will be described.
FIGS. 22A and 22B are a flow diagram illustrating a procedure for decrypting a message sealed to Mr. B and a conceptual explanation diagram of the flow, respectively.
First, in step 2200, the CPU divides the message 2202 sealed to Mr. B into a part 2203 in which the private key is encrypted with Mr. B's public key and a part 2204 of the message encrypted with the private key. Using a cryptographic processor, the portion 2203 obtained by encrypting the secret key with Mr. B's public key is decrypted with Mr. B's private key, and the secret key 2205 is extracted.
Next, in step 2201, the CPU uses the cryptographic processor to decrypt the message portion 2204 encrypted with the secret key with the secret key 2205.

The sealed message is decrypted by the above procedure.
Next, digital signature verification processing will be described.
FIG. 23A and FIG. 23B are a flow diagram showing a procedure for verifying a digital signature of a message with a digital signature of the message sender A and a conceptual explanation diagram of the flow.
First, in step 2300, the CPU performs a hash function operation on the message part (Message ′ 2303) in the message 2206 with a digital signature to generate a message digest 2305.
Next, in Step 2301, the CPU decrypts the digital signature portion 2304 in the digitally signed message 2206 with Mr. A's public key using the cryptographic processor.
Next, in step 2302, the CPU compares the output 2305 of step 2300 with the output 2304 of step 2301, and if the contents match, the CPU determines that the verification has passed. It is determined that it has occurred.
The digital signature verification process is performed by the above procedure.

Next, the internal configuration of the credit settlement terminal 300 will be described.
FIG. 24A is a block diagram of the credit settlement terminal 300. This terminal 300 includes a CPU (Central Processing Unit) 2400 that processes transmission data and reception data and controls other components via a bus 2429 according to a program stored in a ROM (Read Only Memory) 2401. A RAM (Random Access Memory) 2402 in which data processed by the CPU 2400 and data processed by the CPU 2400 are stored, a hard disk 2403 in which entity data specified by data management information on the RAM 2402 is stored, a credit An EEPROM (Electric that stores the terminal ID, telephone number, merchant ID, private key and public key of the payment terminal 300, and the service provider ID, telephone number, and service provider public key of the service providing system 102 are stored. Erasable Programmable Read Only Memory) 2404 and the control of the LCD 302 according to the control of the CPU 2400 The LCD controller 2405 displays the image set by the CPU 2400 on the LCD 302, the encryption processor 2406 performs the data encryption process and the decryption process according to the control of the CPU 2400, and the sign of the transmission data according to the control of the CPU 2400. A data codec 2407 that performs conversion and decoding of received data, and a serial-parallel conversion circuit 2460 that is connected to the infrared module 301 via a serial port 2409 via a serial cable 310 and performs bidirectional conversion between parallel data and serial data A circuit and a key operation control unit 2411 for detecting a switch operation of a mode switch 304, a hook switch 305, a function switch 306, a numeric key switch 307, an execution switch 308 or a power switch 309 and asserting an interrupt signal 2439, and a speaker 2412 And receiver 303 receiver And an audio processing unit 2413 for amplifying an analog audio signal input from the microphone of the receiver 303, encoding of the analog audio signal 2444 into digital audio data, and decoding of the digital audio data into an analog audio signal 2443 Audio codec 2414, channel codec 2415 that generates transmission data on the communication channel and separates digital audio data and data communication data from the received data, and converts the digital signal 2448 to the data format of digital telephone communication In addition, the digital communication adapter 2416 that performs the reverse conversion, the RS-232C interface 2417 that connects the RS-232C cable 313, the interrupt signal input from the key operation control unit 2411, the channel codec 2415, or the RS-232C interface 2417 Processing and CPU2400 key operation Control unit 2411, and a serving control logic unit 2410 of the interface when accessing the internal registers of the audio processing unit 2413 or the channel codec 2415.

The cryptographic processor 2406 has functions of encryption and decryption of a secret key method and encryption and decryption of a public key method, and data set by the CPU 2400 with the encryption method and key set by the CPU 2400. Are encrypted or decrypted.
The data codec 2407 performs encoding of transmission data and decoding of reception data according to control of the CPU 2400. In this case, encoding includes communication control information and error correction information. Decoding means processing that generates data to be transmitted. Decoding is processing that performs error correction processing on received data, removes unnecessary communication control information, and generates data originally intended to be transmitted by the sender. Means. The data codec 2407 has a data encoding / decoding function in digital telephone data communication and a data encoding / decoding function in infrared communication. The data set in the CPU 2400 is stored in the CPU 2400. The set encoding process and decoding process are performed.
The infrared module 301 connected to the serial-parallel conversion circuit 2408 via the serial cable 310 and the serial port 2409 includes a serial port 2455 that is an interface with the credit settlement terminal 300, as shown in FIG. Modulation / demodulation circuit 2456 that modulates the digital signal 2458 input from the serial-parallel conversion circuit 2408 into a signal 2460 that is actually transmitted as infrared rays, or demodulates the received analog signal 2461 into a serial digital signal 2459, and modulation / demodulation An infrared light receiving and emitting unit 2457 for converting the signal 2460 modulated by the circuit 2456 into infrared rays to emit light, or converting the received infrared rays into an analog signal 2461 is provided.

The infrared module 301 performs infrared transmission and reception during infrared communication. The infrared module 301 converts the transmission data set by the CPU 2400 to infrared rays and transmits the infrared data, and converts the received infrared rays into reception data.
Further, when the merchant presses any of the mode switch 304, hook switch 305, function switch 306, numeric key switch 307, execution switch 308 or power switch 209, the key operation control unit 2411 asserts an interrupt signal 2439. This interrupt signal 2439 prompts the CPU 2400 to perform processing corresponding to the switch operation. In addition, the key operation control unit 2411 includes a key operation control register (KEYCTL) 2710 for setting validity / invalidity of each switch as shown in FIG. The CPU 2400 accesses this key operation control register (KEYCTL) 2710 to set validity / invalidity of each switch.
As shown in FIG. 27A, the voice processing unit 2413 includes a voice processing unit control register (SCTL) 2709 for controlling the voice processing operation. The CPU 2400 accesses the sound processing unit control register (SCTL) 2709 to control the operation of the sound processing unit 2413. For example, when an incoming call request for a digital telephone is received, the CPU 2400 accesses the voice processing unit control register (SCTL) 2709 and makes a setting for outputting a digital telephone ring tone. By doing so, the voice processing unit 2413 drives the speaker 2412 and the ring tone of the digital telephone is output.

The audio codec 2414 encodes the analog audio signal 2444 input from the audio processing unit 2413 into digital audio data, and decodes the digital audio data input from the channel codec 2415 into the analog audio signal 2443. The analog audio signal 2443 is supplied to the audio processing unit 2413. The audio processing unit 2413 amplifies the analog audio signal 2443 and drives the receiver of the receiver 303, so that audio is output from the receiver. On the other hand, the digital audio data generated by encoding is supplied to the channel codec 2415 and converted into transmission data on the communication channel.
Two types of data are input to the channel codec 2415 as data to be transmitted. One is digital audio data input from the audio codec 2414, and the other is data communication data input from the CPU via the control logic unit 2410.
The channel codec 2415 adds identification information between digital audio data and data communication data as header information to each data, and converts a digital signal 2448 obtained by multiplexing the digital audio data and data communication data into a digital communication adapter. Supply to 2416.
Conversely, the channel codec 2415 first checks the terminal ID against the digital signal 2448 input from the digital communication adapter 2416, and then identifies digital audio data and data communication data from the header information of the data. And supplied to the audio codec 2412 and the control logic unit 2410, respectively. Further, the channel codec 2415 asserts an interrupt signal 2449 when receiving a digital phone call and when receiving data communication data. The interrupt signal 2449 prompts the CPU 2400 to perform processing upon arrival of a digital telephone and processing of data communication data.
In order to perform such operations, the channel codec 2415 performs an ID register (ID) 2703 for storing a terminal ID and a channel codec control register (CHCTL) for controlling the operation of the channel codec 2415 as shown in FIG. 2704, an audio transmission buffer 2705 for storing digital audio data input from the audio codec 2414, an audio reception buffer 2706 for storing digital audio data extracted from the received data, and data input from the control logic unit 2410 A data transmission buffer 2707 for storing communication data and a data reception buffer 2708 for storing data communication data extracted from the reception data are provided.

The digital communication adapter 2416 encodes the digital signal 2448 into a digital telephone communication format and outputs it to the digital telephone communication line 110. Conversely, the digital communication adapter 2416 decodes the signal received from the digital telephone communication line 110 and supplies the digital signal 2448 to the channel codec 2415.
The RS-232C interface 2417 is an interface circuit for connecting the RS-232C cable 313, and the credit settlement terminal communicates with the cash register 311 via the RS-232C interface 2417. When receiving data from the cash register 311, the RS-232C interface 2417 asserts an interrupt signal 2452. The interrupt signal 2452 prompts the CPU 2400 to process data communication with the cash register 311 via the RS-232C interface 2417.
In addition, as shown in FIG. 27A, the control logic unit 2410 includes three registers, a clock counter (CLOCKC) 2700, an update time register (UPTIME) 2701, and an interrupt register (INT) 2702. To do.
The clock counter is a counter that counts the current time, and the update time register is the time at which the credit settlement terminal 300 performs processing (data update processing) for updating data on the RAM 2402 and the hard disk 2403 by communicating with the service providing system. Is a register indicating an interrupt factor to the CPU 2400.
When one of the interrupt signals 2439, 2449, and 2452 is asserted, the control logic unit 2410 sets the interrupt factor in the interrupt register (INT) 2702, asserts the interrupt signal 2418, and sends it to the CPU. Encourage interrupt handling. The CPU 2400 reads the interrupt register in the interrupt process, and performs a process according to the interrupt factor.
Each bit field of the interrupt register (INT) has a meaning as shown in FIG.
Bit 31 indicates the state of the power switch. When the value is 0, it indicates that the power is off. When the value is 1, it indicates that the power is on.
Bit 30 indicates the state of digital telephone communication. When the value is 0, the digital telephone communication is not performed. When the value is 1, the digital telephone communication is performed. Show.
Bit 28 indicates the occurrence of an incoming call interrupt. When the value is 1, it indicates that a digital phone call has been received. This bit field is set to 1 when a digital telephone is received and the interrupt signal 2449 is asserted.
Bit 27 indicates the occurrence of a data reception interrupt. When the value is 1, it indicates that data reception data has been received. This bit field is set to 1 when data communication data is received and the interrupt signal 2449 is asserted in digital telephone communication.
Bit 26 indicates the occurrence of an update interrupt that prompts the data update process. When the value is 1, it indicates that an update interrupt has occurred. In this bit field, 1 is set when the value of the clock counter matches the value of the update time register.
Bit 25 indicates the occurrence of an external IF interrupt that prompts the processing of data communication with the cash register 311. When the value is 1, it indicates that an external IF interrupt has occurred. This bit field is set to 1 when the interrupt signal 2452 input from the RS-232C interface 2417 is asserted.
Bit 24 indicates the occurrence of a key interrupt due to a switch operation. When the value is 1, it indicates that a key interrupt has occurred.
Bits 0 to 9 correspond to the numeric keypad switches 0 to 9, respectively. Bits 10 and 11 correspond to the numeric keypad “*” and “#” switches, respectively. To bit 15 correspond to the function switches “F1” to “F4”, respectively, bit 16 to bit 18 correspond to the power switch, execution switch, mode switch, and call switch, respectively, and bit 20 to , Corresponding to the hook switch, when the bit value is 1, it indicates that the switch corresponding to the bit is pressed.

Next, data stored in the RAM 2402 will be described.
FIG. 25 is a schematic diagram of a RAM map of data stored in the RAM 2402.
The RAM 2402 has five areas: a basic program area 2500, a service data area 2501, a merchant area 2502, a work area 2503, and a temporary area 2504. In the basic program area 2500, a version-upgraded module stored in the ROM 2401 and a patch program are stored. The merchant area 2502 is an area that the merchant can freely use, the work 2503 area is a work area that the CPU 100 uses when executing the program, and the temporary area 2504 temporarily stores information received by the credit card payment terminal. This is the storage area.
The service data area 2501 is an area for storing personal remote remote credit settlement service ID information, handling credit card information, and history information. Data in this area is managed by the service providing system.
The service data area 2501 further includes five areas: data management information 2505, merchant setting information 2506, telephone information 2507, credit card list 2508, and sales history list 2509.
Data management information 2505 is an area for storing management information of information stored in the service data area 2501, and merchant setting information 2506 is an area for storing merchant setting information related to the personal remote credit settlement service, telephone information 2507 is an area for storing information related to digital telephones, credit card list 2508 is an area for storing list information of credit cards that can be handled by merchants, and sales history list 2509 is a personal remote credit settlement service This is an area for storing the sales history information.

Next, information stored in the service data area 2501 will be described in detail.
FIG. 26 is a schematic diagram showing in detail the relationship of information stored in the service data area 2501.
The data management information 2505 is based on seven pieces of information: update date / time 2600, next update date / time 2601, terminal status 2602, merchant setting information address 2603, telephone information address 2604, credit card list address 2605, and sales history list address 2606. Composed.
The update date and time 2600 indicates the date and time when the service providing system 102 updated the data in the service data area 2501 last time, and the next update date and time 2601 indicates the scheduled update date and time of the data in the service data area 2501 by the next service providing system 102 Indicates. The credit settlement terminal automatically starts the data update process when the next update date and time 2601 is set. The data update process is a process in which the service providing system 102 updates the data in the service data area 2501. The data update process will be described in detail later.
The terminal status 2602 indicates the status of the credit settlement terminal. The merchant setting information address 2603, the telephone information address 2604, the credit card list address 2605, and the sales history list address 2606 are respectively the merchant setting information 2506 and the telephone information 2507. The first address of the area where the credit card list 2508 and the usage history list 2509 are stored.
The telephone information 2507 is further composed of three pieces of information: a calling telephone number 2607, a telephone directory address 2608, and a speed dial setting file address 2609. The outgoing telephone number 2607 indicates the telephone number of the telephone that the merchant made last time, and this information is used when the digital wireless telephone is retransmitted. The phone book address 2608 and the speed dial setting file address 2609 indicate addresses on the hard disk 2403 in which the phone book information and the speed dial setting file are stored, respectively.
The credit card list 2508 stores credit card list information that can be handled by the merchant. In the credit card list 2508, two pieces of information of a credit card name 2610 (2612, 2614) and a service code list address 2611 (2613, 2615) are stored for one credit card. The credit card name 2610 (2612, 2614) indicates the name of the credit card that the merchant can handle, and the service code list address 2611 (2613, 2615) is the merchant of the services provided by the credit card. Indicates an address on the hard disk 2403 in which a service code list indicating the types of services that can be handled is stored.
The sales history list 2509 is an area for storing sales history information in the personal remote credit settlement service. In the sales history list 2509, transaction number 2616 (2620), service code 2617 (2621), sales time 2618 (2622), sales information address 2619 (2623) are sold for sales of one personal remote credit settlement service. Four pieces of information are stored.
The transaction number 2616 (2620) is a number uniquely indicating a transaction with the user. The number issued by the credit settlement terminal when the payment offer response 609 is generated, and the service code 2617 (2621) is the credit used by the user. The code number indicating the type of card service, the sales time 2618 (2622) indicates the time when the personal / remote credit payment service is sold, and the sales information address 2619 (2623) indicates the address where the payment completion notification is stored.
In the sales information address 2619 (2623), a local address indicating an address on the hard disk 2403 or a remote address indicating an address on the merchant information server 402 of the service providing system 102 is stored. When a remote address is stored in the sales information address 2619 (2623), when the merchant accesses the sales history information, the credit settlement terminal downloads the sales information from the service providing system to the temporary area and displays the LCD. To display.
The address stored in the sales information address 2619 (2623) is determined by the service providing system. In the data update process, the sales times of the sales information are compared, and a local address is assigned to the sales information with the latest sales time. However, if the hard disk 2403 has a sufficient capacity, all sales information addresses may be local addresses.

Next, processing performed by the CPU 2400 will be described.
FIG. 28 is a conceptual flow chart of processing performed by the CPU 2400.
As shown in FIG. 28, the CPU processing can be roughly divided into 10 types of processes and interrupt processing 2801.
The ten types of processes are power-on process, telephone process, credit settlement process, customer service call process, inquiry call process, data update process, remote access process, session establishment process, external IF communication process, and power-off process. These 10 kinds of processes are executed in the main loop 2800. Corresponding to each process, each process has a word field indicating the process status (state) on the RAM 2402, and the CPU 2400 executes each process according to the value of the process status.
The power-on process is a process that performs initial operation processing when the merchant turns on the power switch, the telephone process is a process that performs processing in the digital telephone mode, and the credit settlement process is a process that performs processing in the credit settlement mode, The customer service call process is the process that handles the “customer service call”, the inquiry call process is the process that handles the “inquiry call”, the data update process is the process that performs the data update process, and the remote access process is the service The process for accessing data on the merchant information server of the providing system and the session establishment process are the process for establishing a communication session with the service providing system, and the external IF communication Process, process, power off process for performing data communication with the cash register 311 is a process that performs termination processing when the merchant has turned off the power switch.
In FIG. 28, when the credit settlement terminal is reset, the process proceeds to step 2802, and the CPU 2400 sets the power-on process to “active”. Next, in step 2803, it is checked whether or not the power-on process is “active”. If “inactive”, the process proceeds to step 2805. If “active”, the process proceeds to step 2804, and the power-on process is executed for a certain period of time. Then, the process proceeds to Step 2805.
In step 2805, it is checked whether or not the telephone process is “active”. If “inactive”, the process proceeds to step 2807. If “active”, the process proceeds to step 2806, and the telephone process is executed for a predetermined time. Proceed to 2807.
In step 2807, it is checked whether or not the credit settlement process is “active”. If “inactive”, the process proceeds to step 2809. If “active”, the process proceeds to step 2808, and the credit settlement process is executed for a certain period of time. Then, go to Step 2809.
In step 2809, it is checked whether or not the customer service call process is “active”. If “inactive”, the process proceeds to step 2811. If “active”, the process proceeds to step 2810, and the customer service call process is executed for a certain period of time. Then, the process proceeds to step 2811.
In step 2811, it is checked whether the inquiry call process is “active”. If “inactive”, the process proceeds to step 2813. If “active”, the process proceeds to step 2812. The process proceeds to step 2813. In step 2813, it is checked whether or not the data update process is “active”. If “inactive”, the process proceeds to step 2815. If “active”, the process proceeds to step 2814. The process proceeds to step 2815.
In step 2815, it is checked whether or not the remote access process is “active”. If it is “inactive”, the process proceeds to step 2817; Then, go to Step 2817. In step 2817, it is checked whether or not the session establishment process is “active”. If “inactive”, the process proceeds to step 2819. Go to step 2819.
In step 2819, it is checked whether or not the external IF communication process is “active”. If “inactive”, the process proceeds to step 2821. If “active”, the process proceeds to step 2820, and the external IF communication process is executed for a predetermined time. Then, the process proceeds to Step 2821.
In step 2821, it is checked whether or not the power-off process is “active”. If “active”, the process proceeds to step 2822, and the power-off process is executed.
Further, when the interrupt signal 2418 is asserted, the CPU 2400 executes the interrupt process 2801 and returns to the process of the main loop 2800.
In interrupt processing 2801, first, the CPU 2400 reads the interrupt register (INT) 2702 in step 2823 and copies it to the word interrupt on the work area 2503 of the RAM 1502. At this time, the interrupt register (INT) 2702 read by the CPU 2400 is echo reset.

Next, in step 2824, it is checked from the value of bit 28 of the interrupt whether it is an incoming interrupt or not. (bit28) = 1) goes to Step 2825, sets the process status of the telephone process to “active”, and goes to Step 2826.
In step 2826, it is checked from the value of bit 26 of interrupt whether or not it is an update interrupt. If it is not an update interrupt (interrupt (bit26) = 0), the process proceeds to step 2828, and if it is an update interrupt (interrupt (bit26) = 1) proceeds to step 2827, sets the process status of the data update process to “active”, and proceeds to step 2828.
In step 2828, it is checked from the value of bit 25 of the interrupt whether or not it is an external IF interrupt. (bit25) = 1) goes to step 2829, sets the process status of the external IF communication process to “active”, and goes to step 2830.
In step 2830, it is checked from the value of bit 24 of interrupt whether or not it is a key interrupt. If it is not a key interrupt (interrupt (bit24) = 0), the interrupt process is terminated and the process returns to the original main loop process In the case of key interruption (interrupt (bit 24) = 1), the process proceeds to step 2831.
In step 2831, the value of the interrupt “power” bit (bit 16) is checked. If it is 0, the interrupt processing is terminated, and the processing returns to the original main loop processing. The process proceeds to step 2832.
In step 2832, the value of the interrupt “power indication” bit (bit 31) is checked. If it is 0, it is determined that the power-off operation has been performed. The process proceeds to step 2834. It is determined that the operation has been performed, and the process proceeds to step 2833.
In step 2833, the process status of the power-on process is set to “active”, the interrupt process is terminated, and the process returns to the original main loop process.
In step 2834, the process status of the power-off process is set to “active”, the interrupt process is terminated, and the process returns to the original main loop process.
In the interrupt process 2801, the process whose process status is “active” returns to the main loop and is executed in the main loop.

Next, information stored in the user information server 402 of the service providing system 102 will be described.
FIG. 29 is a schematic diagram showing information stored in the user information server 402 for one user.
In the user information server 402, for one user, user data management information 2900, personal information 2901, photo data 2902, terminal property 2903, user setting information 2904, access control information 2905, terminal data 2906, telephone information 2907, Ten types of information including a credit card list 2908 and a usage history list 2909 are stored. The user data management information 2900 is management information of information stored in the user information server 402 for one user.
Personal information 2901 is information about the user's individual such as the user's age, date of birth, occupation, account number, contract details, etc., and a part of this information corresponds to the personal information 1606 of the personal credit terminal 100. .
Photo data 2902 is user face photo data, and terminal property 2903 is personal credit terminal 100 attribute information such as personal credit terminal 100 model number, serial number, RAM capacity, and stored program version. is there.
The user setting information 2904 is user setting information regarding the personal remote credit settlement service, and is information corresponding to the user setting information 1608 of the personal credit terminal 100.
Access control information 2905 is user setting information related to access control in customer service calls, terminal data 2906 is RAM data of the personal credit terminal 100, telephone information 2907 is information related to a digital wireless telephone, personal credit This is information corresponding to the telephone information 1609 of the terminal 100.
The credit card list 2908 is credit card list information registered by the user, and the usage history list 2909 is usage history information of the personal remote credit settlement service.

User data management information 2900 includes user name 2910, user ID 2911, user status 2912, personal information address 2913, photo data address 2914, user public key 2915, terminal property address 2916, user setting information address 2917, access control information It consists of 15 pieces of information: address 2918, update date 2919, next update date 2920, terminal data address 2921, telephone information address 2922, credit card list address 2923, and usage history list address 2924.
The user status 2912 indicates the state of the personal credit terminal 100, and is information corresponding to the terminal status 1702 of the personal credit terminal 100.
The update date and time 2919 indicates the date and time when the data in the service data area 1601 of the personal credit terminal 100 was last updated, and the next update date and time 2920 indicates the scheduled date and time for the next update of data in the service data area 1601. -It corresponds to the update date 1700 and the next update date 1701 of the credit terminal 100.
Personal information address 2913, photo data address 2914, terminal property address 2916, user setting information address 2917, access control information address 2918, terminal data address 2921, telephone information address 2922, credit card list address 2923, and usage history List address 2924 includes personal information 2901, photo data 2902, terminal property 2903, user setting information 2904, access control information 2905, terminal data 2906, telephone information 2907, credit card list 2908, and usage history list 2909, respectively. Indicates an address on the user information server 402 in which is stored.
The terminal data 2906 is data on the RAM 1502 of the personal credit terminal 100 at the previous update process, and is used as data comparison and backup data at the next update process.
The credit card list 2908 and the usage history list 2909 are also information corresponding to the credit card list 1610 and the usage history list 1611 of the personal credit terminal 100, respectively. However, the image data address 2944, the object data address 2945, and the usage information address 2954 all indicate addresses on the user information server 402.

Next, information stored in the merchant information server 403 of the service providing system 102 will be described.
FIG. 30 is a schematic diagram showing information stored in the merchant information server 403 for one merchant.
In the merchant information server 403, for one merchant, merchant data management information 3000, merchant information 3001, terminal property 3002, merchant setting information 3003, terminal data 3004, telephone information 3005, credit card list 3006, and sales history 8 types of information in the list 3007 are stored.
The merchant data management information 3000 is management information of information stored in the merchant information server 403 for one merchant.
The merchant information 3001 is information related to the merchant, such as the merchant's address, account number, and contract details. This is attribute information of the credit settlement terminal 300 such as a version.
The merchant setting information 3003 is merchant setting information regarding the personal remote credit payment service, and is information corresponding to the merchant setting information 2506 of the credit payment terminal 300.
The terminal data 3004 is data stored in the RAM 2402 and the hard disk 2403 of the credit settlement terminal 300, and the telephone information 3005 is information related to the digital telephone and is information corresponding to the telephone information 2507 of the credit settlement terminal 300.
The credit card list 3008 is list information of credit cards that can be handled by the merchant, and the sales history list 3007 is sales history information in the personal remote credit settlement service.
The merchant data management information 3000 includes a merchant name 3008, a merchant ID 3009, a merchant status 3010, a merchant information address 3011, a merchant public key 3012, a terminal property address 3013, a merchant setting information address 3014, an update date 3015, and a next update date 3016. Terminal data address 3017, telephone information address 3018, credit card list address 3019, and sales history list address 3020.
The merchant status 3010 indicates the state of the credit payment terminal 300 and is information corresponding to the terminal status 2602 of the credit payment terminal 300.
The update date and time 3015 indicates the date and time when the data in the service data area 2501 of the credit settlement terminal 300 was last updated, and the next update date and time 3016 indicates the scheduled date and time for the next update of data in the service data area 2501. It corresponds to the update date 2600 of 300 and the next update date 2601.
Merchant information address 3011, terminal property address 3013, merchant setting information address 3014, terminal data address 3017, telephone information address 3018, credit card list address 3019, and sales history list address 3020 are respectively merchant information 3001 , Terminal property 3002, merchant setting information 3003, terminal data 3004, telephone information 3005, credit card list 3006, and sales history list 3007 are stored on the merchant information server 403.
The terminal data 3004 is data of the RAM 2402 of the credit settlement terminal 300 and the hard disk 2403 when the update process was performed last time, and is used as data comparison and backup data during the next update process.
The credit card list 3008 and the sales history list 3007 are information corresponding to the credit card list 2508 and the sales history list 2509 of the credit settlement terminal 300, respectively. However, all the sales information addresses 3043 indicate addresses on the merchant information server 403.

Next, information stored in the payment processing organization information server 404 of the service providing system 102 will be described.
FIG. 31 is a schematic diagram showing information stored in the payment processing organization information server 404 for one payment processing organization.
The payment processor information server 404 stores four types of information, ie, payment processor data management information 3100, payment processor information 3101, credit card list 3102, and sales history list 3103, for one payment processor. The
The payment processing organization data management information 3100 is management information of information stored in the payment processing organization information server 404 for one payment processing organization. The payment processing institution information 3101 is information about the payment processing institution such as the address, account number, and contract contents of the payment processing institution, and the credit card list 3102 is a list of credit card information that can be handled by the payment processing institution, payment history A list 3103 shows settlement history information in the personal remote credit settlement service.
Payment processor data management information 3100 includes a payment processor name 3104, a payment processor ID 3105, a payment processor status 3106, a payment processor information address 3107, a payment processor public key 3108, a credit card list address 3109, and a payment. It consists of seven pieces of information of a history list address 3110.
The payment processing institution status 3106 indicates the payment processing service status of the payment system 103, and the payment processing institution information address 3107, the credit card list address 3109, and the payment history list address 3110 are the payment processing institution information 3101, Addresses on the payment processing institution information server 404 in which the credit card list 3102 and the payment history list 3103 are stored are shown.
The credit card list 3102 shows list information of credit cards that can be handled by the payment processing organization. The credit card list 3102 stores two pieces of information of a credit card name 3111 (3113, 3115) and a service code list address 3112 (3114, 3116) for one credit card.
The credit card name 3111 (3113, 3115) indicates the name of the credit card that can be handled by the payment processor, and the service code list address 3112 (3114, 3116) is among the services provided by the credit card. The address on the payment processing institution information server 404 in which a service code list indicating the types of services that can be handled by the payment processing institution is stored.
The settlement history list 3103 is an area for storing settlement history information in the personal remote credit settlement service.
In the payment history list 3103, for the payment of one personal remote credit payment service, the payment number 3117 (3121), service code 3118 (3122), payment time 3119 (3123), payment information address 3120 (3124) Four pieces of information are stored.
The payment number 3117 (3121) is a number issued by the payment system when generating the payment completion notification 620 uniquely indicating the payment processing, and the service code 3118 (3122) is a code indicating the type of credit card service used by the user No., payment time 3119 (3123) is the time when payment was made by the personal / remote credit payment service, and payment information address 3120 (3124) is a payment processing organization information server 404 in which a payment completion notice issued by the payment system 103 is stored. Indicates the address above.

Next, information stored in the service director information server 401 of the service providing system 102 will be described.
FIG. 32 is a schematic diagram showing information stored in the service director information server 401.
The service director information server 401 stores five types of information: a user list 3200, a merchant list 3201, a payment processing organization list 3202, a service provision history list 3203, and a payment processing organization table 3204.
The user list 3200 is a list of attribute information of all users who are contracted with the service provider, the merchant list 3201 is a list of attribute information of all the merchants who are contracted with the service provider, and the payment processing organization list 3202 is , A list of attribute information of all payment processing organizations contracted with the service provider, a service provision history list 3203 is a list of history information of services provided by the personal remote credit payment service, and is a payment processing organization The table 3204 is table information in which an optimal payment processing organization is associated with a request for a personal remote credit payment service from a user and a merchant.
The user list 3200 stores four types of information for one user: a user name 3205 (3209), a user ID 3206 (3210), a user telephone number 3207 (3211), and a service list address 3208 (3212). Has been.
The service list address 3208 (3212) indicates an address on the service director information server 401 in which a list of service codes that can be used by the user is stored.
The merchant list 3201 includes a merchant name 3213 (3218), a merchant ID 3214 (3219), a merchant telephone number 3215 (3220), a service list address 3216 (3221), and a customer table address 3217 ( 3222) are stored.
The service list address 3216 (3221) indicates an address on the service director information server 401 in which a list of service codes that can be handled by the merchant is stored.
The customer table address 3217 (3222) indicates an address on the service director information server 401 in which table information indicating the correspondence between the customer number and the user ID is stored.
The settlement processor list 3202 includes a settlement processor name 3223 (3227), a settlement processor ID 3224 (3228), a settlement processor communication ID 3225 (3229), a service list address 3226 ( 3230) is stored.
The payment processing institution communication ID 3225 (3229) indicates the ID of the payment system 103 when the service providing system 102 communicates with the payment system 103 via the digital communication line 111, and the service list address 3226 (3230) is An address on the service director information server 401 in which a list of service codes that can be handled by the payment processing organization is stored.
The service provision history list 3203 includes a service provision number 3231 (3235), a service code 3232 (3236), a service provision time 3233 (3237), and service provision information for one service provision of the personal remote credit settlement service. Four pieces of information of address 3234 (3238) are stored.
The service provision number 3231 (3235) is a number that uniquely indicates processing in the service provision system 102 in one service provision, the service code 3232 (3236) is a code number that indicates the type of credit card service used by the user, and a service The provision time 3233 (3237) is the time when the personal remote credit settlement service is provided, and the service provision information address 3234 (3238) stores the history information of processing in the service provision system 102 in one service provision. The address on the service director information server 401 is shown.

Next, a description will be given of a download process performed when data at a remote address is accessed in the personal credit terminal 100 or the credit settlement terminal 300. FIG. Hereinafter, this processing is referred to as remote access processing.
FIG. 33A shows the procedure of remote access processing, and FIGS. 34A and 34B show the contents of messages to be exchanged. When the accessed data is at the remote address, the personal credit terminal 100 (credit settlement terminal 300) generates a message requesting the data to the service providing system 102, the remote access request 3300, and transmits it to the service providing system 102 To do.
As shown in FIG. 34A, the remote access request 3300 includes header information indicating that the message is a remote access request 3300, a remote access request header 3400, a data address 3401 indicating a remote address, and a user ID (merchant The data (ID) 3402 and the issuance date and time 3403 indicating the date and time when this remote access request 3300 was issued are digitally signed by the user (merchant) 3404 and sealed to the service provider.
The service providing system 102 receives the remote access request 3300, decrypts the encryption, checks the digital signature, sends a message to the personal credit terminal 100 (credit settlement terminal 300), remote access data 3301 Is transmitted to the personal credit terminal 100 (credit settlement terminal 300).
As shown in FIG. 34 (b), the remote access data 3301 includes header information indicating that the message is remote access data 3301, a remote access data header 3408, requested data 3409, a service provider ID 3410, The data consisting of the issue date 3411 indicating the date when this remote access data 3301 was issued is digitally signed by the service provider and sealed to the user (merchant).
The personal credit terminal 100 (credit settlement terminal 300) receives the remote access data 3301, decrypts the encryption, checks the digital signature, stores it in the temporary area, and accesses the data.

Next, data update processing performed by the personal credit terminal 100 and the credit settlement terminal 300 in the data update process will be described.
FIG. 33B shows the procedure of the data update process, and FIGS. 34C to 34F and FIG. 35A show the contents of messages to be exchanged.
In the data update process, the personal credit terminal 100 (credit settlement terminal 300) first generates and transmits a message for requesting data update processing and a data update request 3302 to the service providing system 102.
As shown in FIG. 34 (c), the data update request 3302 includes header information indicating that the message is a data update request 3302, a data update request header 3416, a user ID (merchant ID) 3417, and the data update request. Data consisting of an issue date and time 3418 indicating the date and time when 3302 is issued is digitally signed by the user (merchant) and sealed to the service provider.
The service providing system 102 receives the data update request 3302, decrypts the encryption, checks the digital signature, generates a message indicating that the request is ready, a data update request response 3303, and generates a personal credit Transmit to terminal 100 (credit settlement terminal 300).

As shown in FIG. 34D, the data update request response 3303 includes header information indicating that the message is a data update request response 3303, a data update request response header 3423, a service provider ID 3424, and the data update request. Data consisting of an issue date and time 3425 indicating the date and time when the response 3303 is issued is digitally signed by the service provider and sealed to the user (merchant).
The personal credit terminal 100 (credit settlement terminal 300) receives the data update request response 3303, decrypts the encryption, checks the digital signature, and stores data in the RAM 1502 (in the case of the credit settlement terminal 300, the RAM 2402 and the hard disk 2403). Message to be uploaded to the service providing system 102 and upload data 3304 are generated and transmitted to the service providing system.

As shown in FIG. 34 (e), upload data 3304 includes header information indicating that the message is upload data 3304, upload data header 3430, and RAM 1502 (in the case of credit settlement terminal 300, RAM 2402 and hard disk 2403). The data (compressed data), terminal data 3431, user ID (merchant ID) 3432, and issuance date and time 3433 indicating the date and time when this upload data 3304 was issued are digitally signed by the user (merchant) It is sealed to the provider.
The service providing system 102 receives the upload data 3304, decrypts the encryption, and checks the digital signature. Then, the compressed terminal data 3431 is decompressed and collated with the terminal data 2906 (terminal data 3004) on the user information server 402 (merchant information server 403).
Then, new terminal data 2906 (terminal data 3004) is generated, a message for updating the data of the personal credit terminal 100 (credit settlement terminal 300), update data 3305 is generated, and the personal credit terminal 100 (credit settlement terminal) is generated. 300).

As shown in FIG. 34 (f), the update data 3305 includes header information indicating that the message is update data 3305, an update data header 3438, data obtained by compressing new terminal data, terminal data 3439, and a service provider. The data consisting of ID 3440 and issue date 3441 indicating the date when this update data 3305 was issued is digitally signed by the service provider and sealed to the user (merchant).
The personal credit terminal 100 (credit settlement terminal 300) receives the update data 3305, decrypts the encryption, checks the digital signature, decompresses the compressed terminal data 3439, and RAM1502 (in the case of the credit settlement terminal 300) Updates the data in the RAM 2402 and the hard disk 2403).
In the generation of new terminal data, the service providing system 102 compares the access time of each credit card when the capacity of the actual data area 1612 is not enough for the personal credit terminal 100, and the access time is the latest. Assign a local address to the object data address of the credit card, compare the usage time of each usage information, assign a local address to the usage information address of the usage information with the latest usage time, and also to the credit payment terminal 300 If the capacity of the hard disk 2403 is not sufficient, the usage times of the sales information are compared, and a local address is assigned to the sales information address of the sales information with the latest usage time.
In addition, the service providing system 102, when checking the uploaded data and the terminal data, finds that the data has been tampered with, the personal credit terminal 100 (credit settlement terminal 300) instead of the update data 3305. ) And a function stop command 3305 ′ are generated and transmitted to the personal credit terminal 100 (credit settlement terminal 300).

As shown in FIG. 35A, the function stop command 3305 ′ includes header information indicating that the message is a function stop command 3305 ′, a function stop command header 3500, a service provider ID 3501, and the function stop command 3305. Data consisting of an issue date and time 3502 indicating the date and time when 'is issued is a digital signature of the service provider and sealed to the user (merchant).
In this case, the personal credit terminal 100 (credit settlement terminal 300) that has received the function stop instruction 3305 ′ decrypts the encryption, checks the digital signature, and “unusable” the terminal status 1702 (terminal status 2602). Change to, and become unusable.
Further, the backup process performed by the personal credit terminal 100 in the backup process is performed in the same procedure as the data update process. However, after receiving the update data 3305 and updating the data in the RAM 1502, the terminal status 1702 is changed to “not writable”, and new data in the RAM is stored until the battery capacity is sufficient. Prohibit input.

Next, details of the contents of data exchanged between devices in the “settlement” process will be described.
36 (a) to 36 (f), 37 (a) to 37 (c), 38 (a), and 38 (b) show the contents of messages to be exchanged in the “settlement” process.
First, when the user performs a payment operation 607, the personal credit terminal 100 generates a payment offer 608 and transmits it to the credit settlement terminal 300 by infrared communication.
As shown in FIG. 36 (a), the payment offer 608 includes transactions with header information indicating that the message is a payment offer 608, a payment offer header 3600, a service code 3601, a service provider ID 3602, and a merchant. Request number 3603 arbitrarily generated as a unique number, payment amount 3604 entered by the user, payment option code 3605 indicating the payment option entered by the user, expiration date 3606 of this payment offer 608, and this payment offer A user's digital signature is applied to data consisting of an issue date and time 3607 indicating the date and time when 608 is issued. The credit settlement terminal 300 receives the payment offer 608, matches the payment amount 3404 with the billed amount, checks whether the payment option 3405 is an available option, and sends the payment offer response 609 via infrared communication. The data is transmitted to the personal credit terminal 100, and a credit inquiry request 610 is generated and transmitted to the service providing system 102 by digital telephone communication.

As shown in FIG. 36 (b), the payment offer response 609 includes header information indicating that the message is a payment offer response 609, a payment offer response header 3608, and the personal credit terminal 100 has received the payment offer response 609. A response message 3609 displayed on the LCD 203, a transaction number 3610 arbitrarily generated as a number uniquely indicating a transaction with the user, a billing amount 3611, an expiration date 3612 of this payment offer response 609, and a merchant ID 3613 The merchant's digital signature is applied to the data including the issue date 3614 indicating the date when the payment offer response 609 is issued. The response message 3609 is a text message set by the merchant option, and may not be set.
As shown in FIG. 36 (c), the credit inquiry request 610 includes header information indicating that the message is a credit inquiry request 610, a credit inquiry request header 3615, a payment offer 608, a payment offer response 609, and a person in charge. The data consisting of a name 3616, a merchant ID 3617, and an issue date 3618 indicating the date and time when this credit inquiry request 610 was issued is digitally signed by the merchant and sealed to the service provider. The person-in-charge name 3616 is information set by the merchant option and may not be set.
The personal credit terminal 100 receives the payment offer response 609, compares the payment amount 3404 with the billed amount, generates a payment request 613, and transmits it to the service providing system 102 by digital wireless telephone communication.

As shown in FIG. 36D, the payment request 613 includes header information indicating that the message is a payment request 613, a payment request header 3623, a payment offer 608, a payment offer response 609, a user ID 3624, Data consisting of an issue date and time 3625 indicating the date and time when the payment request 613 is issued is digitally signed by the user and sealed to the service provider.
The service providing system 102 receives the credit inquiry request 610 and the payment request 613, respectively, decrypts the cipher and checks the digital signature. Then, the request number, the transaction number, and the merchant ID are collated, and the merchant and the user who are trying to make a transaction take the correspondence between the issued credit reference request 610 and the payment request 613, respectively. The contents of 610 and the payment request 613 are collated to generate a credit inquiry response 614, which is transmitted to the credit settlement terminal 300 by digital telephone communication.
As shown in FIG. 36 (e), the credit inquiry response 614 uniquely indicates header information indicating that the message is the credit inquiry response 614, the credit inquiry response header 3630, the transaction number 3631, and the processing of the credit inquiry. The reference number 3632 arbitrarily generated as a number, the inquiry result 3633 indicating the result of the credit inquiry, the photograph data 363 of the user's face, the expiration date 3635 indicating the expiration date of the credit inquiry response 614, and the service provider ID 3636 And the date and time of issue 3637 indicating the date and time when this credit inquiry response 614 was issued, the service provider is digitally signed and sealed to the merchant. If there is a problem with the credit status of the user as a result of the credit inquiry, the photo data 3634 is not set.
The credit settlement terminal 300 receives the credit inquiry response 614, decrypts the encryption, checks the digital signature, and displays the result of the credit inquiry on the LCD 302.

Next, when the person in charge of the merchant performs a settlement processing request operation 616, the credit settlement terminal 300 generates a settlement request 617 and transmits it to the service providing system 102 by digital telephone communication.
As shown in FIG. 36 (f), the payment request 617 includes header information indicating that the message is a payment request 617, a payment request header 3642, a payment offer 608, a payment offer response 609, and a service providing system 102. Regarding the data comprising the issued reference number 3643, the expiration date 3644 indicating the expiration date of this settlement request 617, the person in charge 3645, the merchant ID 3646, and the issue date 3647 indicating the date and time when this settlement request 617 was issued, The merchant digitally signed and sealed to the service provider. The person-in-charge name 3616 is information set by the merchant option and may not be set.
The service providing system 102 receives the payment request 617, decrypts the encryption, checks the digital signature, and collates the contents of the payment request 617 and the payment request 613. Then, with reference to the payment processing organization table 3204, the payment processing organization that requests payment is determined, and the generated payment request 619 is transmitted to the payment system 103 of the payment processing organization.

As shown in FIG. 37 (a), the settlement request 619 includes header information indicating that the message is a settlement request 619, a settlement request header 3700, a credit card number 3701 corresponding to the service code designated by the user, personal Request number 3702 issued by the credit terminal 100, payment amount 3703, payment option code 3704, merchant account number 3705 indicating the merchant account number, transaction number 3706 issued by the credit settlement terminal 300, and this settlement The data consisting of an expiration date 3707 indicating the expiration date of the request 619, a service provider ID 3708, and an issue date and time 3709 indicating the date and time when this settlement request 619 is issued is digitally signed by the service provider and addressed to the payment processing organization. It is a sealed letter.
The payment system 103 receives the payment request 619, decrypts the encryption, checks the digital signature, performs payment processing, generates a payment completion notification 620, and transmits it to the service providing system 102.

As shown in FIG. 37 (b), the payment completion notification 620 is arbitrarily set as header information indicating that the message is the payment completion notification 620, a payment completion notification header 3714, and a number uniquely indicating the payment processing of the payment system 103. Generated payment number 3715, credit card number 3716, request number 3717, payment amount 3718, payment option code 3719, merchant account number 3720, transaction number 3721, and digitally signed payment processing service Payment information 3722 for providers, payment information 3723 for merchants with a digital signature of the payment processor, payment information 3724 for users with a digital signature of the payment processor, payment processor ID 3725, and this payment completion notification The data consisting of the issue date and time 3726 indicating the date and time when It is sealed to the provider.
The service providing system 102 receives the payment completion notification 620, decrypts the encryption, checks the digital signature, generates the payment completion notification 621, and performs digital telephone communication.
Send to credit payment terminal 300.

As shown in FIG. 37 (c), the payment completion notification 621 includes header information indicating that the message is the payment completion notification 621, a payment completion notification header 3731, a payment number 3732, and a digital signature of the payment processing organization. Merchant payment information 3723, a number generated as a number that uniquely identifies the user to the merchant, a customer number 3733, a payment request 3648 decrypted by the encryption, and a service providing information related to processing in the service providing system 102 Service provider information 3734, service provider ID 3735, and data of issue date 3736 indicating the date and time when this settlement completion notice 621 was issued are digitally signed by the service provider and sealed to the merchant . The service provider processing information 3734 is information set as an option of the service provider, and may not be set.
The credit payment terminal 300 receives the payment completion notification 621, decrypts the encryption, checks the digital signature, and displays the contents on the LCD 302. Then, the credit settlement terminal 300 generates a receipt 623 and transmits it to the service providing system 102 by digital telephone communication.

As shown in FIG. 38 (a), the receipt 623 includes header information indicating that the message is the receipt 623, a receipt header 3800, a product name 3801 indicating the name of the sold product, and the merchant to the user. Sales information 3802 showing additional information on transactions with the customer, settlement number 3803, transaction number 3804, payment offer 608, contact name 3805, merchant ID 3806, and issue date and time indicating when this receipt 623 was issued The data consisting of 3807 is digitally signed by the merchant and sealed to the service provider. The sales information 3802 and the person in charge name 3805 are information set by the merchant option and may not be set.
The service providing system 102 receives the receipt 623, decrypts the encryption, checks the digital signature, generates a receipt 624, and transmits the receipt 624 to the personal credit terminal 100 by digital wireless telephone communication.

As shown in FIG. 38 (b), the receipt 624 includes header information indicating that the message is the receipt 624, a receipt header 3812, a receipt 3808 obtained by decrypting the cipher, and a digital signature of the payment processing organization. Data consisting of payment information 3724 for the user who has performed, service provider processing information 3813 indicating information on processing in the service providing system 102, service provider ID 3814, and issue date and time 3815 indicating the date and time when this receipt 624 was issued The service provider is digitally signed and sealed to the user. The service provider processing information 3813 is information set as an option of the service provider, and may not be set.
The personal credit terminal 100 receives the receipt 624, decrypts the encryption, checks the digital signature, and displays the contents on the LCD 203.

Next, details of the contents of data exchanged between devices in the “cancel” process will be described.
39A to 39F show the contents of messages to be exchanged in the “cancel” process.
First, when the person in charge of the merchant performs a cancel operation 901, the credit card settlement terminal 300 generates a cancel request 903 and transmits it to the service providing system 102 by digital telephone communication.
On the other hand, when the user performs a cancel operation 904, the personal credit terminal 100 generates a cancel request 906 and transmits it to the service providing system 102 by digital wireless telephone communication.
As shown in FIG. 39A, the cancel request 903 includes header information indicating that the message is a cancel request 903, a cancel request header 3900, a settlement completion notification 3737 obtained by decrypting the cipher, and the cancel request 903. The data of the expiration date 3901 indicating the expiration date, the person in charge 3902, the merchant ID 3903, and the issue date 3904 indicating the date and time when this cancel request 903 is issued is digitally signed by the merchant and addressed to the service provider It is a sealed letter. The person-in-charge name 3916 is information set by the merchant option and may not be set.

As shown in FIG. 39B, the cancel request 906 includes header information indicating that the message is a cancel request 906, a cancel request header 3909, a receipt 3816 obtained by decrypting the cipher, and the validity of the cancel request 906. Data consisting of an expiration date 3910 indicating a time limit, a user ID 3911, and an issue date 3912 indicating the date and time when this cancel request 906 is issued is digitally signed by the user and sealed to the service provider.
The service providing system 102 receives the cancel request 903 and the cancel request 906, decrypts the encryption, and checks the digital signature, respectively. Then, the merchant and the user who are going to perform the cancel processing by comparing the request number, the transaction number, and the merchant ID take a correspondence between the cancel request 903 and the cancel request 906, respectively, The content of the cancellation request 906 is collated, a cancellation request 907 is generated, and transmitted to the settlement system 103.
As shown in FIG. 39C, the cancel request 907 includes header information indicating that the message is a cancel request 907, a cancel request header 3917, a settlement completion notification 3727 obtained by decrypting the cipher, and the cancel request 907. The data consisting of the expiration date 3918 indicating the expiration date, the service provider ID 3919, and the issue date 3920 indicating the date and time when this cancellation request 907 was issued is digitally signed by the service provider and sealed to the payment processing organization. It is a thing.
The settlement system 103 receives the cancellation request 907, decrypts the encryption, checks the digital signature, performs cancellation processing, generates a cancellation completion notification 908, and transmits it to the service providing system 102.

  As shown in FIG. 39 (d), the cancellation completion notification 908 includes header information indicating that the message is a cancellation completion notification 908, a cancellation completion notification header 3925, and a number uniquely indicating the cancellation processing performed by the settlement system 103. Cancellation number 3926, cancellation request 3921 for decrypting the cipher, cancellation information 3927 for the service provider with the digital signature of the payment processing institution, cancellation information 3928 for the merchant with the digital signature of the payment processing institution, and the payment processing institution A digital signature of the payment processing institution is digitally signed for the data consisting of the cancellation information 3929 for the user with the digital signature, the payment processing institution ID 3930, and the issuance date 3931 indicating the date and time when the payment completion notification is issued, and is sent to the service provider. It is a sealed letter. The service providing system 102 receives the cancellation completion notification 908, decrypts the encryption, checks the digital signature, generates a cancellation completion notification 909 and a cancellation processing receipt 910, respectively, and the credit settlement terminal 300 and personal・ Send to credit terminal 100.

  As shown in FIG. 39 (e), the cancellation completion notification 909 includes header information indicating that the message is a cancellation completion notification 909, a cancellation completion notification header 3936, a cancellation number 3937, and a cancellation request 3905 for decrypting the encryption. The payment information 3928 for the merchant with the digital signature of the payment processing organization, the service provider processing information 3938 indicating information related to processing in the service providing system, the service provider ID 3939, and the date and time when this cancellation completion notice 909 was issued. The data consisting of the issue date and time 3940 shown is digitally signed by the service provider and sealed to the merchant. The service provider processing information 3938 is information set as an option of the service provider and may not be set.

As shown in FIG. 39 (f), the cancellation processing receipt 910 has decrypted the header information indicating that the message is the cancellation processing receipt 910, the cancellation processing receipt header 3945, the cancellation number 3946, and the encryption. A cancellation request 3913, payment information 3929 for users digitally signed by the payment processing organization, service provider processing information 3947 indicating information related to processing in the service providing system, service provider ID 3948, and this cancellation processing receipt 910 The data including the issue date 3949 indicating the issue date is digitally signed by the service provider and sealed to the user. The service provider processing information 3947 is information set as an option of the service provider, and may not be set.
The credit settlement terminal 300 receives the cancellation completion notification 909, decrypts the encryption, checks the digital signature, and displays the content on the LCD 302. On the other hand, the personal credit terminal 100 also receives the cancellation processing receipt 910, decrypts the encryption, checks the digital signature, and displays the contents on the LCD 203.

Next, details of data contents exchanged between devices in the “customer service call” process will be described.
40A to 40E show the contents of messages to be exchanged in the “customer service call” process.
First, when a merchant person in charge performs a customer service call operation 1200, the credit settlement terminal 300 generates a customer service call request 1202 and transmits it to the service providing system 102 by digital telephone communication.
As shown in FIG. 40 (a), the customer service call request 1202 includes the header information indicating that the message is the customer service call request 1202, the customer service call request header 4000, and the number indicating the user as “settlement”. Customer number 4001 issued at the time of processing, request number 4002 uniquely indicating this customer service call request, person in charge name 4003, merchant ID 4004, and issue date and time indicating the date and time when this customer service call request 1202 was issued The data consisting of 4005 is digitally signed by the merchant and sealed to the service provider. The person-in-charge name 4003 is information set by the merchant option and may not be set.
The service providing system 102 receives the customer service call request 1202, decrypts the encryption, and checks the digital signature. Then, the service providing system 102 determines the user from the customer table, compares it with the access control information of the user, generates a customer service call 1203 and a customer service call request response 1204, and each of the user's personal credit terminal 100 and credit settlement terminal 300.

As shown in FIG. 40B, the customer service call 1203 includes header information indicating that the message is a customer service call 1203, a customer service call header 4010, a person in charge name 4011, a merchant ID 4012, and a merchant name 4013. The service provider's digital signature on the data consisting of the request number 4014 set by the credit settlement terminal 300, the service provider ID 4015, and the issue date 4016 indicating the date and time when this customer service call 1203 was issued, and the user It is a sealed letter. The person-in-charge name 4011 is information set by the merchant option and may not be set.
As shown in FIG. 40C, the customer service call request response 1204 includes header information indicating that the message is a customer service call request response 1204, a customer service call request response header 4021, and a response from the service providing system 102. For data consisting of message 4022, request number 4023 set by credit settlement terminal 300, service provider ID 4024, and issue date and time 4025 indicating the date and time when this customer service call request response 1204 was issued, the service provider's digital signature And sealed to the merchant.
The credit settlement terminal 300 receives the customer service call request response 1204, decrypts the encryption, checks the digital signature, and displays “calling”.

The personal credit terminal 100 receives the customer service call 1203, decrypts the encryption, checks the digital signature, and notifies the user of the incoming call. When the user performs a call operation 1207, the personal credit terminal 100 transmits an incoming call response 1208 to the service providing system 102. Upon receiving the incoming response 1208, the service providing system 102 transmits a call response 1210 to the credit settlement terminal 300, and the credit settlement terminal 300 and the personal credit terminal 100 enter a call state.
As shown in FIG. 40 (d), the incoming response 1208 includes header information indicating that the message is an incoming response 1208, an incoming response header 4030, and a request number 4031 set by the credit settlement terminal 300. As shown in FIG. 40E, the response 1210 is composed of header information indicating that the message is a call response 1210, a call response header 4032, and a request number 4033 set by the credit settlement terminal 300.

Next, details of data contents exchanged between devices in the “inquiry call” process will be described.
FIGS. 41A to 41E show the contents of messages to be exchanged in the “inquiry call” process.
First, when the user performs an inquiry call operation 1213, the personal credit settlement terminal 100 generates an inquiry call request 1215 and transmits it to the service providing system 102 by digital wireless telephone communication.
As shown in FIG. 41A, the inquiry call request 1215 includes header information indicating that the message is an inquiry call request 1215, an inquiry call request header 4100, a merchant ID 4101, a person in charge name 4102, and the inquiry call. Data consisting of a request number 4103 that uniquely indicates the request, a user ID 4104, and an issue date and time 4105 that indicates the date and time when this inquiry call request 1215 is issued is digitally signed by the user and sealed to the service provider It is. The person-in-charge name 4103 is information set in the merchant option during the “settlement” process, and may not be set.

The service providing system 102 receives the inquiry call request 1215, decrypts the encryption, and checks the digital signature. Then, the service providing system 102 generates an inquiry call 1216 and an inquiry call request response 1217, and transmits them to the merchant credit settlement terminal 300 and the personal credit settlement terminal 100, respectively.
As shown in FIG. 41B, the inquiry call 1216 includes header information indicating that the message is an inquiry call 1216, an inquiry call header 4110, a customer number 4111, and a request number 4112 set by the personal credit terminal 100. The service provider ID 4113 and the issue date and time 4114 indicating the date and time when this inquiry call 1216 is issued are digitally signed by the service provider and sealed to the merchant.

As shown in FIG. 41C, the inquiry call request response 1217 includes header information indicating that the message is an inquiry call request response 1217, an inquiry call request response header 4119, and a response message 4120 from the service providing system 102. The service provider's digital signature is applied to data consisting of the request number 4121 set by the personal credit settlement terminal 100, the service provider ID 4122, and the issue date 4123 indicating the date and time when this inquiry call request response 1217 was issued. , Sealed to the user.
The personal credit terminal 100 receives the inquiry call request response 1217, decrypts the encryption, checks the digital signature, and displays “calling”. The credit settlement terminal 300 receives the inquiry call 1216, decrypts the encryption, checks the digital signature, and notifies the merchant of the incoming call. When the merchant performs a call operation 1220, the credit settlement terminal 300 transmits an incoming call response 1221 to the service providing system. The service providing system that has received the incoming call response 1221 transmits a call response 1223 to the personal credit terminal, and the personal credit terminal 100 and the credit settlement terminal 300 enter a call state.
As shown in FIG. 41 (d), the incoming response 1221 is composed of header information indicating that the message is an incoming response 1221, an incoming response header 4128, and a request number 4129 set by the personal credit settlement terminal 100. 41, the call response 1223 is composed of header information indicating that the message is a call response 1223, a call response header 4130, and a request number 4131 set by the personal credit settlement terminal 100, as shown in FIG. Is done.

(Embodiment 2)
Next, a second embodiment of the present invention will be described. In the second embodiment, a personal remote credit settlement system that enables efficient processing of a personal remote credit settlement service will be described.
The basic configuration of this personal remote credit settlement system is the same as that of the first embodiment, and as shown in FIG. 1, it has a two-way bidirectional wireless communication function and an electronic credit card function. Personal credit terminal 100, credit settlement apparatus 101 that performs credit settlement processing at a retail store, settlement system 103 that performs credit settlement processing at a credit service company or settlement processing company, personal credit terminal 100, credit settlement apparatus 101 And a service providing system 102 for providing a personal remote credit settlement service, a digital public network 108 for providing a data transmission path in the network, and a personal credit terminal 100. Connect to digital public network 108 To and a base station 104 of the wireless telephone.

The personal credit terminal 100 is a portable wireless telephone terminal having two-way bidirectional wireless communication functions of infrared and digital wireless telephones and an electronic credit card function. The credit settlement apparatus 101 that performs credit settlement processing at a retail store also has two-way bidirectional communication functions of infrared communication and digital telephone communication.
In FIG. 1, 105 is a transmission path for infrared communication between the personal credit terminal 100 and the credit card settlement apparatus 101, and 106 is a digital wireless communication performed between the personal credit terminal 100 and the base station 104. 107 is a digital communication line connecting the base station 104 and the digital public network 108, 109 is a digital communication line connecting the digital public network 108 and the service providing system 102, and 110 is a credit card settlement apparatus 101. And a digital telephone communication line 111 connecting the digital public network 108 and a digital communication line 111 connecting the service providing system 102 and the payment system 103. In particular, the digital communication line 109 and the digital communication line 111 operate as a plurality of communication lines by multiplexing.
The normal operation mode of the personal remote credit settlement service is the same as that of the first embodiment, and is as follows.
The payment system 103 is installed in a credit card company or a payment processing company, and the credit payment apparatus 101 is installed in a retail store. A consumer carries the personal credit terminal 100 with him. The service providing system 102 is installed in a company that provides a personal remote credit settlement service. When the credit card company provides a personal remote credit settlement service, the service providing system 102 is installed in a credit card company. Is done.
In addition, as a premise, the consumer must sign a credit service membership contract with a credit card company, and a personal remote credit settlement service membership contract with a company that provides a personal remote credit settlement service. In addition, we have a wireless telephone service contract with a telephone company. Similarly, a retail store also has a credit service merchant contract with a credit card company, and a personal remote credit payment service merchant with a company that provides a personal remote credit payment service. The company also has a contract for a digital telephony service with a telephone company.
In addition, when the personal remote credit settlement service is provided by a company different from the credit card company, the company that provides the personal remote credit settlement service is between one or more credit card companies. The company has signed a contract to issue an electronic credit card and operate a personal remote credit settlement service instead of a credit card company for members who have contracted for a credit service.
When the payment processing company performs credit payment processing using the payment system 103, the payment processing company acts as a proxy for the credit payment processing with one or more credit card companies. I have a contract.
If the payment system for performing the credit payment process differs depending on the credit card, a plurality of payment systems are connected to the service providing system 102 through a digital communication line in the same manner as the payment system 103 in FIG.

In the following, in order to simplify the description of the system, the consumer owned by the personal credit terminal 100 is a user, the retail store where the credit settlement apparatus 101 is installed is a merchant, and the credit settlement apparatus 101 The sales clerk who operates the service, the operator (Operator), the company that provides the personal remote credit payment service (Service Provider), the credit card company or the payment processing company that performs the credit payment processing using the payment system 103 Is referred to as a transaction processor.
In this system, when the user pays the merchandise for the merchandise by credit, the payment information is electronically exchanged between the three parties of the personal credit terminal 100, the credit settlement device 101 and the service providing system 102, Credit settlement processing is performed by electronically exchanging settlement information between the service providing system 102 and the settlement system 103.
Basically, the service providing system 102 receives a payment request and a payment request from the personal credit terminal 100 and the credit payment device 101, and collates the payment request and the payment request, and sends them to the user and the merchant. Instead, it requests payment processing from the payment system 103. Then, the payment system performs actual payment processing.

At this time, the personal credit terminal 100 and the credit settlement device 101 perform infrared communication using the transmission path 105, and the personal credit terminal 100 and the service providing system 102 include the transmission path 106, the base station 104, and , Digital telephone communication by digital wireless telephone is performed via the digital communication line 107, the digital public network 108, and the digital communication line 109. The credit settlement apparatus 101 and the service providing system 102 are a digital telephone communication line 110, a digital public network Digital telephone communication is performed via 108 and the digital communication line 109. The service providing system 102 and the payment system 103 perform digital data communication via the digital communication line 111.
In the communication between the personal credit terminal 100 and the service providing system 102, the communication between the credit settlement device 101 and the service providing system 102, and the communication between the service providing system 102 and the settlement system 103, all the settlement information exchanged , Encrypt and communicate. For encryption, information is electronically sealed and communicated by combining secret key encryption processing and public key encryption processing.

Next, each component which comprises this system is demonstrated.
First, the personal credit terminal 100 will be described. The external appearance of the personal credit terminal 100 is the same as that of the first embodiment, and has the front and back side appearances shown in FIGS. 2 (a) and 2 (b).
The personal credit terminal 100 has three operation modes of a credit card mode, a digital radio telephone mode, and a personal information management mode, and the mode switch 204 switches the operation mode. The personal credit terminal 100 operates as a digital wireless telephone in the digital wireless telephone mode, and operates as an electronic credit settlement means, that is, an electronic credit card in the credit card mode.
The electronic credit card is registered in the personal credit terminal 100 on the assumption that the user has a credit service membership contract with the credit card company. When the user has a membership contract for a plurality of credit services, a plurality of credit cards are registered in the personal credit terminal 100.
The personal information management mode is an operation mode for managing user personal information stored in the personal credit terminal 100. In the personal information management mode, the user refers to registered personal information, photo data, and the like. And user setting information is set.
For example, when making a call using the personal credit terminal 100, the user first sets the operation mode to the digital wireless telephone mode with the mode switch 204, and then inputs the telephone number with the numeric key switch 208. Then, press the call switch 205. With the above operation, the user can make a call to the input telephone number.

Further, when a normal call is received to the personal credit terminal 100, the personal credit terminal 100 emits a ring tone regardless of the operation mode at that time. In this case, pressing the call switch 205 automatically switches to the digital wireless telephone mode, and the user can receive a call.
When paying the merchant with credit, first, the mode switch 204 sets the operation mode to the credit card mode, and the function switch 207 selects the credit card used for payment. Next, with the numeric keypad switch 208, the amount to be paid is input, the infrared communication port 200 is directed toward the merchant's credit payment apparatus 101, and the execution switch 211 is pressed. Through the above operation, the personal credit terminal 100 performs infrared communication with the credit settlement apparatus 101, and also performs digital wireless telephone communication with the service providing system 102, and exchanges settlement information respectively. Perform credit payment processing.

Next, the credit settlement apparatus 101 will be described. The appearance of the credit card settlement apparatus 101 is the same as that of the first embodiment, and has the appearance shown in FIG.
The credit payment terminal 300 has three operation modes, a credit payment mode, a digital telephone mode, and a merchant information management mode, which are switched by a mode switch 304. In the digital telephone mode, it operates as a digital telephone, and in the credit settlement mode, it operates as a credit settlement processing terminal of a personal remote credit settlement service.
The merchant information management mode is an operation mode for managing merchant information stored in the credit payment terminal 300. In the merchant information management mode, the merchant refers to the registered merchant information and the merchant setting. Set information.
When making a call from the credit settlement terminal 300, for example, the person in charge first sets the operation mode to the digital telephone mode with the mode switch 304, and then inputs the telephone number with the numeric key switch 307. By the above operation, the person in charge can make a call to the entered telephone number.
Further, when a normal phone call is received to the credit settlement terminal 300, the credit settlement terminal 300 emits a ring tone regardless of the operation mode. In this case, when the telephone 303 is raised or the hook switch 305 is pressed, the telephone mode is automatically switched, and the person in charge can receive a call.
In the case of performing credit settlement processing, first, the cash register 311 calculates the total amount from the product price and the tax, and notifies the user of the amount. Next, the credit settlement switch 312 of the cash register 311 is pushed according to the request of the user who wishes to pay by credit, and the user waits for the user to perform a payment operation at the personal credit terminal 100. When the user performs a payment operation, the payment amount input by the user is displayed on the LCD 302, and further the result of the user's credit inquiry is displayed. The person in charge confirms the content and presses the execution switch 308.
Through the above operation, the credit settlement apparatus 101 exchanges settlement information with the personal credit terminal 100 and the service providing system 102, and performs credit settlement processing.

Next, the service providing system will be described. The service providing system 102 has the same block configuration as that of the first embodiment. As shown in FIG. 4, in the personal remote credit settlement service, the personal credit terminal 100, the credit settlement device 101, and the settlement system Service server 400 that performs data processing of payment information exchanged with each of 103 and control of data communication at that time, attribute information about users, merchants, and payment processing organizations, and history information of services provided by service providing system 102 A service director information server 401 that manages user attributes, a user information server 402 that manages user attribute information and data in the personal credit terminal 100, and manages merchant attribute information and data in the credit payment terminal 300 Merchant information server 403 and the attribute information of the payment processor And a settlement processing organization information server 404 for managing settlement processing history information, and a management system 407 for managing the operation of the service providing system 102 by the service provider. Each of the servers 400 to 404 and the management system 407 includes Each is composed of one or a plurality of computers.
The service server 400, the service / director information server 401, the user information server 402, the merchant information server 403, and the payment processing organization information server 404 are connected to the ATM-LAN switch 405 by ATM-LAN cables 409, 410, 411, 412, and 413, respectively. The 400 accesses the service director information server 401, the user information server 402, the merchant information server 403, or the payment processing organization information server 404 via the ATM-LAN switch 405.
The ATM-LAN switch 405 is connected to the ATM switch 406 by an ATM-LAN cable 415. A digital communication line 109 connected to the digital public network 108 and a digital communication line 111 connected to the payment system 103 are connected to the ATM switch 404, and the service server 400 is connected via the ATM-LAN switch 405 and the ATM switch 406. It communicates with the personal credit terminal 100, the credit settlement apparatus 101, and the settlement system 103.

The management system 407 is connected to the ATM-LAN switch 406 by an ATM-LAN cable 414 and further connected to the ATM switch 406 by an ATM-LAN cable 416. The management system 407 is connected to the service server 400, the service director information server 401, the user information server 402, the merchant information server 403, or payment processing organization information via the ATM-LAN switch 408, the ATM switch 406, and the ATM-LAN switch 405. The server 404 is accessed to manage the operation of the service providing system 102.
The ATM switch 406 operates as a data communication switch in communication between the outside and inside of the service providing system 102 and communication between the inside of the service providing system 102. Further, the ATM switch 406 corresponds to a plurality of communication methods and has a function of a communication adapter. For example, in the communication between the service server 400 and the credit settlement apparatus 101, first, the ISDN data packet is exchanged between the credit settlement apparatus 101 and the ATM switch 406, and the ATM switch 406 converts the ATM packet from the ISDN data packet. The ATM packet is exchanged between the ATM exchange 406 and the service server 400. Similarly, in the communication between the service server 400 and the personal credit terminal 100 and the communication between the service server 400 and the settlement system 103, the ATM switch 406 corresponds to each communication method, and the communication data Perform conversion.

Further, in order to reduce the communication cost between the personal credit terminal 100 and the service providing system 102 and between the credit settlement apparatus 101 and the service providing system 102, the service providing system 102 usually provides a personal remote credit settlement service. It is installed for each area (service area) to be provided. Therefore, the ATM switch 406 is connected with a dedicated digital communication line 417 that connects with service providing systems in other regions. In this case, the service providing systems 102 share data with each other and perform data processing in cooperation.
The mechanism of data sharing and cooperative processing between service providing systems will be described in detail later.

Next, the payment system 103 will be described. The payment system 103 has the block configuration shown in FIG. 5 as in the first embodiment. In the personal remote credit settlement service, the credit settlement processing performed by the settlement system 103 is performed by the transaction processing server 500 in response to a settlement request from the service providing system 102, the subscriber information server 501, the member store information server 502, The transaction information server 503 is updated by updating the information.
In addition to the digital communication line 111 connected to the service providing system 102, the ATM switch 505 includes a bank dedicated line 515 connected to the bank online system, and a dedicated digital line 516 connected to a payment system of another payment processing institution. Connected, the payment system 103 communicates with the bank online system and the payment systems of other payment processing institutions to perform payment processing between financial institutions.

The management system 506 is connected to the ATM-LAN switch 507 via an ATM-LAN cable 512 and further connected to the ATM switch 505 via an ATM-LAN cable 514. The management system 506 accesses the transaction processing server 500, the subscriber information server 501, the member store information server 502, or the transaction information server 503 via the ATM-LAN switch 507, the ATM switch 505, and the ATM-LAN switch 504. Then, the operation management of the payment system 103 is performed.
The ATM switch 505 operates as a data communication switch in communication between the outside and the inside of the payment system 103 and communication between the inside of the payment system 103. The ATM switch 505 has a function of a communication adapter corresponding to a plurality of communication systems, and communicates between the transaction processing server 500 and the service providing system 102, and between the transaction processing server 500 and the bank online system. In the communication between the transaction processing server 500 and the payment system of another payment processing institution, the ATM switch 505 converts communication data corresponding to each communication method.

Next, the personal remote credit settlement service provided by this system will be described.
The personal remote credit settlement service is roughly divided into four processes: “settlement”, “cancellation”, “customer service call”, and “inquiry call”.
“Payment” is a process in which the user pays the merchant with credit, using a wireless communication without directly transferring the credit card or statement of use, etc. “Cancel” is a personal remote credit payment The transaction completed by the service “payment” process is canceled by wireless communication based on the agreement between the user and the merchant. The “customer service call” is the “payment process” of the personal remote credit settlement service. The process of enabling telephone contact even if the merchant does not know the user's phone number, and the “inquiry call” is the “settlement” of the personal remote credit payment service. For merchants who had transactions during processing, Without The are known your phone number, it is a process that enables the phone of inquiry.

The flow of the “settlement” process in this personal remote credit settlement service is shown in FIG. 43, and a display example of the LCD 203 of the personal credit terminal 100 at the time of this “settlement” process is shown in FIG. To (i), and display examples of the LCD 302 of the credit settlement terminal 300 are shown in (a) to (g) of FIG.
FIG. 9 shows the flow of the “cancel” process in this personal remote credit settlement service, and FIG. 10 shows an example of display on the LCD 203 of the personal credit terminal 100 during this “cancel” process. 11A to 11G, examples of display on the LCD 302 of the credit settlement terminal 300 are shown in FIGS. 11A to 11G.
FIG. 45 (a) shows the flow of processing of the “customer service call” in the personal remote credit settlement service, and the LCD 203 of the personal credit terminal 100 at the time of the “customer service call” processing. A display example is shown in FIGS. 13A to 13B, and a display example of the LCD 302 of the credit settlement terminal 300 is shown in FIGS. 14A to 14G.
FIG. 45B shows a flow of processing of “inquiry call” in the personal remote credit settlement service, and a display example of the LCD 203 of the personal credit terminal 100 at the time of this “inquiry call” processing. (B) to (f) of FIG. 13 are shown, and display examples of the LCD 302 of the credit settlement terminal 300 are shown in (h) and (f) of FIG.
The flow of each of these processes is substantially the same as that described in the first embodiment.

Next, the internal configuration of the personal credit terminal 100 will be described.
FIG. 15A is a block diagram of the personal credit terminal 100. This terminal includes a CPU (Central Processing Unit) 1500 that performs processing of transmission data and reception data and control of other components via a bus 1529 according to a program stored in a ROM (Read Only Memory) 1501. , Data processed by CPU 1500, RAM (Random Access Memory) 1502 storing data processed by CPU 1500, terminal ID of personal credit terminal 100, telephone number, user ID of user, private key and public key, In addition, the service provider ID of the service providing system 102, the telephone number (the telephone number of the service providing system is digitally signed by the service provider), and the EEPROM (which stores the public key of the service provider) Electric Erasable Programmable Read Only Memory) 1503 and the control of the CPU 203 according to the control of the CPU 1500 Therefore, an LCD controller 1504 for displaying the set image on the LCD, an encryption processor 1505 for performing data encryption processing and decryption processing according to the control of the CPU 1500, and encoding of transmission data and reception data according to the control of the CPU 1500 A data codec 1506 for performing decoding, an infrared communication module 1507 for performing infrared transmission and reception during infrared communication, a mode switch 204 by the user, a call switch 205, an end switch 206, a function switch 207, a numeric key switch 208, Analog to input from the microphone 210 or headset by driving the headset connected to the key operation control unit 1509 for detecting the switch operation of the power switch 209 and the execution switch 211 and the speaker 1510, the receiver 202 or the headset jack 212. Sound that amplifies audio signals Voice processing unit 1511, voice codec 1512 that encodes analog voice signal 1542 into digital voice data and decodes digital voice data into analog voice signal 1543, and generation and reception of transmission data over the radio channel Channel codec 1513 that extracts data addressed to itself from data, and serial digital signal 1547 input from channel codec 1513 is converted to analog transmission signal 1549 using oscillation electric signal 1552 supplied from PLL 1516 as a baseband A modulation unit 1514 that demodulates the analog reception signal 1550 using the oscillation electric signal 1553 supplied from the PLL 1516 as a baseband of the analog reception signal 1550, and supplies a serial digital signal 1548 to the channel codec 1513, and modulation. The analog transmission signal 1549 supplied from the unit 1514 is changed to a radio wave and the antenna 201 Conversely, when the radio wave is received by the antenna 201, the RF unit 1517 that inputs the analog reception signal 1550 to the demodulation unit 1515, and the battery capacity detection unit 1518 that detects the battery capacity of the personal credit terminal 100, , Activation control of channel codec 1513, PLL 1516 and RF unit 1517, key operation control unit 1509, processing of interrupt signal input from channel codec 1513 and battery capacity detection unit 1518, and CPU 1500 key operation control unit 1509, audio processing A control logic unit 1508 serving as an interface when accessing the internal registers of the unit 1511, the audio codec 1512, and the channel codec.

The cryptographic processor 1505 has a secret key encryption / decryption function and a public key encryption / decryption function, and is set by the CPU 1500 with the encryption method and key set by the CPU 1500. Data is encrypted or decrypted. Using the encryption and decryption functions of the cryptographic processor 1505, the digital signature processing or sealed processing of the message is performed, and the encrypted decryption processing of the sealed message or the digital signature is performed. Verify the digital signature of the message.
The data codec 1506 performs encoding of transmission data and decoding of reception data according to the control of the CPU 1500. In this case, the encoding is actually transmitted including communication control information and error correction information. Decoding is a process that performs error correction processing on received data, removes unnecessary communication control information, and generates data that the sender originally intended to transmit To do. The data codec 1506 has a data encoding / decoding function in data communication of a digital wireless telephone and a data encoding / decoding function in infrared communication. The data set by the CPU 1500 The encoding process and the decoding process set by the above are performed.

For example, in the case of transmitting a digital signature processing and sealed processing message by digital wireless telephone communication, the CPU 1500 uses the cryptographic processor 1505 to perform the digital signature processing of the message and the sealed processing. In addition, the data codec 1506 is used to encode the message subjected to the digital signature processing and the sealed processing into the data format of the data communication of the digital wireless telephone, and this is transmitted via the control logic unit 1508. Send to channel codec 1513.
Conversely, when a digitally signed message and sealed message are received via digital wireless telephone communication, the CPU 1500 reads the received message from the channel codec 1513 via the control logic unit 1508. The data codec 1506 is used to decrypt the received message, and the cryptographic processor 1505 is used to perform the decryption processing of the encrypted message and the verification processing of the digital signature applied to the message. Do.

Similarly, when a message subjected to digital signature processing and sealed processing is transmitted by infrared communication, the CPU 1500 uses the cryptographic processor 1505 to perform digital signature processing and sealed processing of the message. Further, the data codec 1506 is used to encode the message subjected to the digital signature processing and the sealed processing into the data format of the infrared communication and send it to the infrared communication module 1507.
On the other hand, when a message subjected to digital signature processing and sealed processing is received by infrared communication, the CPU 1500 reads the received message from the infrared communication module 1507 and receives it using the data codec 1506. The encrypted message is decrypted, and further, the encryption processor 1505 is used to perform encryption decryption processing of the sealed message and verification processing of the digital signature applied to the message.

  Further, as shown in FIG. 15B, the infrared communication module 1507 includes therein a serial-parallel conversion circuit 1560 that performs bidirectional conversion between parallel data and serial data, and a serial-parallel conversion circuit 1560. The digital signal 1562 converted into serial data is modulated into a signal that is actually transmitted as infrared light, and the modulation / demodulation circuit 1561 that demodulates the received analog signal 1565 into the serial digital signal 1563 and the modulation / demodulation circuit 1561 An infrared light receiving and emitting unit 200 that converts the signal 1564 into infrared rays to emit light and converts the received infrared rays into an analog signal 1565 is provided.

When the user presses one of the mode switch 204, the call switch 205, the end switch 206, the function switch 207, the numeric key switch 208, the power switch 209, or the execution switch 211, the key operation control unit 1509 that detects the switch operation by the user. The key operation control unit 1509 asserts an interrupt signal 1538 that prompts processing corresponding to the switch operation. Further, as shown in FIG. 46, the key operation control unit 1509 includes a key operation control register (KEYCTL) 21612 for setting validity / invalidity of each switch. The CPU 1500 accesses this key operation control register (KEYCTL) 21612 to set validity / invalidity of each switch.
As shown in FIG. 46, the voice processing unit 1511 includes a voice processing unit control register (SCTL) 21611 for controlling the voice processing operation. The CPU 1500 accesses the voice processing unit control register (SCTL) 21611 and controls the operation of the voice processing unit 1511. For example, when an incoming call request for a digital wireless telephone is received, the CPU 1500 accesses the voice processing unit control register (SCTL) 21611 and performs setting for outputting a ringing tone for the digital wireless telephone. As a result, the voice processing unit 1511 drives the speaker 1510, and the ring tone of the digital wireless telephone is output. However, if the incoming call request is from the service providing system 102, no ring tone is output, and the CPU 1500 starts processing for establishing a session with the service providing system. Details of the process for establishing a session will be described in detail later.

The audio codec 1512 encodes the analog audio signal 1542 input from the audio processing unit 1511 into digital audio data, and decodes the digital audio data read out as the digital audio signal 1546 from the channel codec 1513 into the analog audio signal 1543. And do. The analog audio signal 1543 is supplied to the audio processing unit 1511. The audio processing unit 1511 amplifies the analog audio signal 1543 and drives the receiver 202, so that audio is output from the receiver 202. Also, the digital audio data generated by the encoding is supplied to the channel codec 1513 as a digital audio signal 1546, and is actually converted into transmission data on the radio channel.
The voice codec 1512 includes a voice data encryption key register (CRYPT) 21613 for storing a secret key type encryption key used for encryption and decryption of the voice data, and this voice data encryption key register (CRYPT) When the audio data encryption key is set in 21613 by the CPU 1500, the audio codec 1512 encrypts the digital audio data simultaneously with the encoding of the analog audio signal 1542 into the digital audio data, and the analog audio of the digital audio data Simultaneously with the decryption to the signal 1543, the digital audio data is decrypted.
In addition, two types of data are input to the channel codec 1513 as data to be transmitted. One is digital audio data input as a digital audio signal 1546 from the audio codec 1512, and the other is data communication data input as a digital signal 1556 from the CPU 1500 via the control logic unit 1508.

The channel codec 1513 adds identification information between digital audio data and data communication data to each data as header information, and further converts the data into a digital radio telephone data format to modulate the serial digital signal 1547. Part 1514.
Conversely, the channel codec 1513 first checks the terminal ID against the serial digital signal 1548 input from the demodulator 1515, extracts only the data addressed to itself, and further controls the communication of the digital radio telephone. The information is removed, the digital audio data and the data communication data are identified from the header information of the data, and are supplied to the audio codec 1512 and the control logic unit 1508 as a digital audio signal 1546 and a digital signal 1556, respectively.
The channel codec 1513 asserts an interrupt signal 1554 when a digital wireless telephone is received and when data communication data is received, and sets the control signal 1544 to a low level when digital audio data is received. . The interrupt signal 1554 is an interrupt signal that prompts the CPU 1500 to perform processing upon arrival of a digital wireless telephone and processing of data communication data. The control signal 1544 is transmitted to the audio codec 1512 to process the received digital audio data. This is a low-active control signal for prompting.
In order to perform such an operation, the channel codec 1513, as shown in FIG. 46, an ID register (ID) 21605 for storing a terminal ID, a channel codec control register (CHCTL) 21606 for controlling the operation of the channel codec 1513, Audio transmission buffer 21607 for storing digital audio data input from audio codec 1512, audio reception buffer 21608 for storing digital audio data extracted from reception data, and CPU 1500 via control logic unit 1508 A data transmission buffer 21609 for storing data communication data and a data reception buffer 21610 for storing data communication data extracted from the reception data are provided.

The control signal 1545 is a control signal indicating the operation of writing to and reading from the channel codec 1513 by the audio codec 1512 to and from the audio transmission buffer 21607 and the audio reception buffer 21608. The audio codec 1512 sets the control signal 1545 to a low level. The digital audio data is written to the audio transmission buffer 21607, the control signal 1545 is set to the high level, and the digital audio data is read from the audio reception buffer 21608.
The control signal 1555 is a control signal indicating a write and read operation by the CPU 1500 via the control logic unit 1508 to the data transmission buffer 21609 and the data reception buffer 21610 to the channel codec 1513. The control signal 1555 is set to a low level. Thus, the data communication data is written to the data transmission buffer 21609, the control signal 1555 is set to the high level, and the data communication data is read from the data reception buffer 21610.
The modulation unit 1514 converts the serial digital signal 1547 input from the channel codec 1513 into an analog transmission signal 1549 using the oscillation electric signal 1552 supplied from the PLL 1516 as a baseband, and supplies the analog transmission signal 1549 to the RF unit. The analog transmission signal 1549 supplied to the RF unit is output from the antenna 201 as a radio wave.
Conversely, when the antenna 201 receives a radio wave, the analog reception signal 1550 is input from the RF unit 1517 to the demodulation unit 1515. The demodulation unit 1515 demodulates the analog reception signal 1550 using the oscillation electric signal 1553 supplied from the PLL 1516 as a baseband of the analog reception signal 1550 and supplies the serial digital signal 1548 to the channel codec 1513.
Further, the battery capacity detection unit 1518 for detecting the battery capacity asserts an interrupt signal 1557 when the battery capacity of the personal credit terminal 100 becomes equal to or less than a value Q (Q> 0) set by the CPU 1500. . The interrupt signal 1557 is an interrupt signal that prompts the CPU 1500 to back up the data on the RAM 1502, and Q is the personal credit terminal 100 that communicates with the service providing system 102 to provide the data on the RAM 1502 to the service. This value is sufficient to perform the process of backing up to the system 102 (data backup process).
As shown in FIG. 46, the control logic unit 1508 includes a frame counter (FRAMEC) 21600, a start frame register (FRAME) 21601, a clock counter (CLOCKC) 21602, an update time register (UPTIME) 21603, and Built-in five registers of interrupt register (INT) 21604.

The frame counter 21600 is a counter that counts the number of frames of the digital radio telephone, the activation frame register 21601 is a register that stores the frame number to be activated next time, the clock counter 21602 is a counter that counts the current date and time, and the update time The register 21603 is a register that stores the time when the personal credit terminal 100 communicates with the service providing system 102 to update the data on the RAM 1502 (data update process), and the interrupt register 21604 is a CPU 1500. This is a register indicating the cause of interrupt.
In general, in a digital radio telephone, incoming control of the control channel of the digital radio telephone is intermittently received and collated with a terminal ID to realize an incoming call for the telephone addressed to itself. This personal credit terminal 100 uses the frame counter 21600 and the activation frame register 21601 to intermittently receive control data. The frame number to be activated next time is stored in the activation frame register 21601 in advance, and when the frame counter 21600 counts up and becomes equal to the value of the activation frame register 21601, the control logic unit 1508 Via the signal line 1558, the channel codec 1513, PLL 1516, and RF unit 1517 are activated to receive control data.
In addition, the control logic unit 1508 detects that when the value of the clock counter 21602 matches the value of the update time register 21603 and when any of the interrupt signals 1538, 1554, and 1557 is asserted. The interrupt factor is set in the interrupt register (INT) 21604, the interrupt signal 1519 is asserted, and the CPU 1500 is prompted to perform an interrupt process. In the interrupt processing, the CPU 1500 reads the interrupt register (INT) 21604 and performs processing according to the interrupt factor.
Each bit field of the interrupt register (INT) 21604 has a meaning as shown in FIG. This meaning is the same as that described with reference to FIG. 18B in the first embodiment.

Next, data stored in the RAM 1502 will be described.
FIG. 48 is a schematic diagram of a RAM map of data stored in the RAM 1502.
The RAM 1502 has five areas: a basic program area 21800, a service data area 21801, a user area 21802, a work area 21803, and a temporary area 21804. The basic program area 21800 stores a version-upgraded module of the program stored in the ROM 1501, a patch program, and an additional program.
The user area 21802 is an area that can be freely used by the user, the work 21803 area is a work area used when the CPU 100 executes a program, and the temporary area 21804 is a temporary area for information received by the personal credit terminal 100. It is an area to be stored. The service data area 21801 is an area for storing personal remote remote credit payment service ID information, credit card information, history information, and the like. Data in this area is managed by the service providing system 102.
The service data area 21801 further includes eight areas of data management information 21805, personal information 21806, photo data 21807, user setting information 21808, telephone information 21809, credit card list 21810, usage history list 21811, and actual data area 21812. There is. The data management information 21805 is an area for storing management information of the information stored in the service data area 21801, the personal information 21806 is an area for storing information such as the user's name, age, and sex, and the photo data area 21807 is An area for storing user face photo data, user setting information 21808 is an area for storing user setting information related to the personal remote credit settlement service, and telephone information 21809 is an area for storing information related to digital wireless telephones The credit card list 21810 is an area for storing credit card list information registered by a user, the usage history list 21811 is an area for storing usage history information of a personal remote credit settlement service, and the actual data area 21812 is other This is an area for storing entity data of information managed in these seven areas.

Next, information stored in the service data area 21801 will be described in detail.
FIG. 49 is a schematic diagram showing in detail the relationship of information stored in the service data area 21801.
Data management information 21805 includes update date 21900, next update date 21901, terminal status 21902, personal information address 21903, photo data address 21904, user setting information address 21905, telephone information address 21906, credit card list address 21907, and usage It consists of nine pieces of information of history list address 21908.
The update date / time 21900 indicates the date / time when the service providing system 102 last updated the data in the RAM 1502, and the next update date / time 21901 indicates the scheduled update date / time of the data in the service data area 21801 by the next service providing system 102.
The value of the next update date 21901 is set in the update time register 21603. When the next update date 21901 is reached, the personal credit terminal 100 starts the data update process. The data update process is a process in which the service providing system 102 updates the data in the RAM 1502, and is usually performed every day in a relatively busy time zone (for example, midnight).
The terminal status 21902 indicates the status of the personal credit terminal 100, and includes a personal information address 21903, a photo data address 21904, a user setting information address 21905, a telephone information address 21906, a credit card list address 21907, and a usage history list address. Reference numeral 21908 denotes the start address of an area in which personal information 21806, photo data 21807, user setting information 21808, telephone information 21809, credit card list 21810, and usage history list 21811 are stored.
The telephone information 21809 is further composed of three pieces of information: a transmission telephone number 21909, a telephone directory address 21910, and a speed dial setting file address 21911. The outgoing telephone number 21909 indicates the telephone number of the telephone that the user made last time, and this information is used when the digital wireless telephone is retransmitted. The phone book address 21910 and the speed dial setting file address 21911 indicate addresses on the substance data area in which the phone book information and the speed dial setting file are stored, respectively.

The credit card list 21810 stores credit card list information registered by the user. In the credit card list 21810, credit card name 21912 (21919), credit card number 21913 (21920), expiration date 21914 (21921), credit card status 21915 (21922), image data Seven pieces of information of an address 21916 (21923), an object data address 21717 (21924), and an access time 21918 (21925) are stored.
The credit card status 21915 (21922) indicates whether or not the credit card is valid and the limit of use, and the image data address 21916 (21923) is an actual data area in which the image data of the credit card is stored. The address on 21812 is shown. The object data address 21917 (21924) indicates the address where the object data of the credit card program is stored, and the access time 21918 (21925) indicates the latest time when the user used the credit card. .
The object data address 21917 (21924) stores a local address indicating an address on the actual data area 21812 or a remote address indicating an address on the user information server 402 of the service providing system 102. When the remote address is stored in the object data address 21717 (21924), when the user selects and uses the credit card, the personal credit terminal 100 receives the object data from the service providing system 102. Download to the temporary area 21804 (remote access) and execute the credit card program. By only displaying the credit card, the image data in the actual data area 21812 indicated by the image data address 21916 (21923) is displayed, and the object data is not downloaded.
The address stored in the object data address 21917 (21924) is determined by the service providing system. During the data update process, the access times of the credit cards are compared, and a local address is assigned to the credit card with the latest access time. However, if the capacity of the actual data area 21812 is sufficient, the object data address of all credit cards may be a local address.

In the usage history list 21811, the request number 21926 (21930), service code 21927 (21931), usage time 21928 (21932), and usage information address 21929 (21933) are used for the use of one personal remote credit settlement service. Are stored.
The request number 21926 (21930) is a number that uniquely indicates the transaction with the merchant (from the user's perspective). The number issued by the personal credit terminal 100 when generating the payment offer 608, the service code 21927 (21931). ) Is a code number indicating the type of credit card service used, usage time 21928 (21932) is the time when personal remote credit payment service is used, usage information address 21929 (21933) is a receipt or usage Indicates the address where the information indicating the contents is stored.
The usage information address 21929 (21933) stores a local address indicating an address on the actual data area 21812 or a remote address indicating an address on the user information server 402 of the service providing system 102.
When a remote address is stored in the usage information address 21929 (21933), when the user accesses the usage history information, the personal credit terminal 100 downloads the usage information from the service providing system 102 to the temporary area 21804. (Remote access) and display on the LCD 203.
The address stored in the usage information address 21929 (21933) is also determined by the service providing system. During the data update process, the usage times of the usage information are compared, and a local address is assigned to the usage information with the latest usage time. However, if the capacity of the actual data area 21812 has a margin, all the usage information addresses may be local addresses.

Next, processing performed by the CPU 1500 will be described.
FIG. 51 is a conceptual diagram of a processing flow performed by the CPU 1500.
As shown in FIG. 51, the processing performed by CPU 1500 includes two processing routines, a main routine 22109 and an interrupt processing routine 22122. The main routine is a processing routine for processing transmission data and reception data and controlling other components, and the interrupt processing routine is a processing routine for detecting a process (processing) required by an external interrupt. is there. Therefore, CPU 1500 normally performs main routine processing. When the interrupt signal 1519 is asserted, the CPU 1500 jumps from the main routine to the interrupt processing routine, performs the interrupt processing, and when the interrupt processing ends, returns to the main routine and resumes the processing of the original main routine. .
The processes executed by the CPU 1500 in the main routine are 17 types of processes. The CPU 1500 dynamically selects a process and executes the selected process in a time-sharing manner. FIG. 50A shows 17 types of processes executed in the main routine.
The 17 types of processes executed in the main routine are a process management process for selecting and managing processes executed by the CPU, a power-on process for performing initial operation processing when the power switch is turned on, and a power switch being turned off. Power-off process for performing time termination processing, GUI (Graphical User Interface) processing in digital wireless telephone mode, digital wireless telephone process for performing data processing (for example, speed dial setting), and GUI processing in credit card mode (Example: display of usage history), credit card process for data processing, GUI processing in personal information management mode (eg: display of personal information), and data processing (eg: setting of user setting information) Personal information management process to be performed and payment pro to process “settlement” A cancel process for processing “cancel”, a customer service call process for processing “customer service call”, an inquiry call process for processing “inquiry call”, and a data update for processing data update A process, a compulsory data update process that performs compulsory data update processing, a data backup process that performs data backup processing, a remote access process that performs remote access processing, and a session establishment process with a service providing system A session establishment process to be performed, a digital wireless telephone communication process for controlling digital wireless telephone communication, and an infrared communication process for controlling infrared communication.

Each process has a corresponding program module in the basic program area 21802 of the ROM 1501 and the RAM 1502, and each process is executed by the CPU 1500 executing these program modules.
In addition, for each process, information indicating the status (state) of the process exists in the work area 21803 on the RAM 1502 corresponding to each process, and the process activation state (“active” or “inactive”) and The execution state (“running” or “idle”) and the current processing step are shown. “Active” in the start state indicates that the process is started as a process executed in the main routine, “inactive” indicates that the process is not started, and “running” in the execution state indicates “Idle” indicates that the process is being executed, and “idle” indicates that the process is suspended.
In particular, the execution state of the digital wireless telephone process, the credit card process, and the personal information management process corresponds to the operation mode of the personal credit terminal. When the execution state of the digital wireless telephone process is “running”, the personal credit The terminal enters the personal information management mode when the execution state of the digital wireless telephone mode and the credit card process is “running”, and when the execution state of the credit card mode and the personal information management process is “running”. Regarding the execution states of the digital wireless telephone process, the credit card process, and the personal information management process, only one process always indicates “running” and the other indicates “idle”. Hereinafter, the information indicating the status of the process is referred to as process status.

In the main routine, the CPU 1500 repeatedly executes the process management process and the processes registered in the process list in a time-sharing manner. The process list is a list indicating active processes other than the process management process, and the process management process updates the process list. The process management process is a process that is always executed in the main routine, and updates the process list and the process status of each process to select a process to be executed in the main routine.
The process management process updates the process list based on the process generation request message sent from another process of the main routine or the process of the interrupt processing routine and the process status of each process (FIG. 50B). reference).

FIG. 51 shows the flow of processing performed by the CPU 1500 as a generalized conceptual diagram. As shown in FIG. 50B, a process flow in the case where N processes (N is an integer of 0 or more) is registered in the process list 22000 is shown.
In FIG. 51, first, when the personal credit terminal 100 is reset, the process proceeds to step 22100. The CPU 1500 performs a reset process. When the reset process is completed, the process proceeds to step 22101. In the reset process, variables defined on the RAM 1502 are initialized, internal registers are initialized, and a process management process is generated.
In step 22101, the CPU 1500 executes the process management process, updates the process list and the process status of each process, and proceeds to step 22102 (if N ≧ 1) (if N = 0, step 22101). Back to).
(When N ≧ 1) In step 22102, it is checked whether the status of the first registered process in the process list 22000 is “running” or “idle”. 2) go to step 22104 (if N = 1, go back to step 22101), if “running” go to step 22103 and execute the first process (if N ≧ 2) ) Go to step 22104 (if N = 1, go back to step 22101).
(When N ≧ 2) In step 22104 and subsequent steps, processing for the second to Nth processes in the process list is sequentially performed in the same procedure as the processing for the first process in the process list (step 22102 and step 22103). When the processing for the Nth process (step 22106, step 22107) is finished, the CPU 1500 returns to step 22101. That is, CPU 1500 repeats step 22101 and processing corresponding to steps 22102 to 22107. However, the contents of the processing corresponding to step 22102 to step 22107 vary depending on the process management process of step 22101.

  When the interrupt signal 1519 is asserted during the execution of the processing of the main routine 22109, the CPU 1500 jumps to the interrupt routine 22122. In the interrupt processing routine 22122, first, in step 22110, the CPU 1500 reads the interrupt register (INT) and copies it to the word interrupt on the RAM (work area). At this time, the interrupt register (INT) read by the CPU is echo reset, and the interrupt signal 1519 is negated.

Next, in step 22111, it is checked from the value of interrupt bit 28 whether or not the call is an incoming interrupt. If it is not an incoming interrupt (interrupt (bit28) = 0), the process proceeds to step 22113, and in the case of an incoming interrupt (interrupt (bit28) = 1) goes to step 22112, sends a digital radiotelephone process generation request message to the process management process, and goes to step 22113.
In step 22113, it is checked whether or not the interrupt is an update interrupt from the value of interrupt bit 26. If it is not an update interrupt (interrupt (bit26) = 0), the process proceeds to step 22115, and if it is an update interrupt (interrupt (bit26) = 1) proceeds to step 22114, sends a data update process generation request message to the process management process, and proceeds to step 22115.
In step 22115, it is checked from the value of bit 25 of interrupt whether or not it is a backup interrupt. If it is not a backup interrupt (interrupt (bit25) = 0), the process proceeds to step 22117. = 1) proceeds to step 22116, sends a backup process generation request message to the process management process, and proceeds to step 22117.
In step 22117, it is checked from the value of bit 24 of interrupt whether or not it is a key interrupt. If it is not a key interrupt (interrupt (bit24) = 0), the interrupt process is terminated and the process returns to the original main routine In the case of key interruption (interrupt (bit 24) = 1), the process proceeds to step 22118.
In step 22118, the value of the interrupt “power” bit (bit 16) is checked. If it is 0, the interrupt processing is terminated and the processing returns to the original main routine. In case of 1, the power switch is operated. The process proceeds to step 22119.

In step 22119, the value of the interrupt “power display” bit (bit 31) is checked. If it is 0, it is determined that the power-off operation has been performed, and the process proceeds to step 22121. It is determined that the operation has been performed, and the process proceeds to step 22120.
In step 22120, a power-on process generation request message is sent to the process management process, the interrupt process is terminated, and the process returns to the original main routine.
In step 22121, a power-off process generation request message is sent to the process management process, the interrupt process is terminated, and the process returns to the original main routine process.
The CPU 1500 returning to the main routine 22109 from the interrupt processing routine 22122 resumes the processing of the main routine from the processing step immediately before jumping to the interrupt processing routine. In the interrupt processing routine, the process generation request message sent to the process management process returns to the main routine from the interrupt processing routine, and is evaluated and requested in the processing of the process management process in step 22101 to be executed first. The process is registered in the process list. The requested process is executed in the subsequent main routine processing.
For example, when the personal credit terminal 100 is reset, nothing is registered in the process list immediately after the reset. Therefore, the CPU 1500 repeats the process management process generated in the reset process 22100 in the main routine (see FIG. 52A). On the other hand, by the reset, the control logic unit 1508 sets 1 to the bit 24 (key interrupt) and the bit 16 (“power supply”) of the interrupt register (INT), and asserts the interrupt signal 1519. At this time, when the power switch 209 is on, the CPU 1500 executes the power-on process in the main routine through the processing of the interrupt processing routine by this interrupt, and the power switch 209 is off. First, the CPU 1500 executes the power-off process in the main routine through the processing of the interrupt processing routine based on this interrupt.

FIG. 52C shows a processing flow when the power switch is turned off or when the power switch is turned off at the time of resetting. In the power-off process, termination processing such as erasing the LCD display or accessing the key operation control register (KEYCTL) 21612 to set only the power switch 209 is performed. When the processing of the power-off process is completed, the CPU 1500 shifts to the halt state and stops the processing of the main routine. The CPU 1500 returns to the normal operation state from the halt state only by an interrupt due to an ON operation of the power switch, an update interrupt, or a battery interrupt. Resume.
FIG. 52B shows a processing flow when the power switch is turned on or when the power switch is turned on at the time of resetting. In the power-on process, initialization of LCD display, variables defined on RAM 1502, internal register settings, digital radiotelephone process, credit card process, and personal information management process generation request message are processed. Performs initial operation processing sent to the management process. With the process generation request message, a digital wireless telephone process, a credit card process, and a personal information management process are registered in the process list, and these processes are executed in the main routine. However, since the execution status of the process status of each process is stored, the operation mode at power-on becomes the operation mode when the power switch was turned off last time.

FIG. 53 shows the state after the end of the power-on process or when the personal credit terminal performs “settlement”, “cancel”, “customer service call”, “inquiry call”, “data update”, “remote access”, etc. The processing flow of CPU at the time of the steady state which is not processing is shown. At this time, there are three processes registered in the process list: a digital wireless telephone process, a credit card process, and a personal information management process, but the process status execution state is only “running”. The operation mode of the personal credit terminal is an operation mode corresponding to a process whose process status execution state indicates “running”.
The key operation performed by the user is copied to the word interrupt on the RAM 1502 as an interrupt factor of the interrupt register 21604 by the processing of the interrupt processing routine, and the process corresponding to the operation mode of the personal credit terminal (digital radiotelephone process) Or a credit card process or a personal information management process), and processing corresponding to a user operation is performed. When a payment operation 607, a cancel operation 904, an inquiry call operation 1213, etc. are performed, or when a customer service call 1203 is received, a settlement process, a cancellation process, an inquiry call process, a customer service call process, etc., respectively. A message requesting generation of the corresponding process is sent to the process management process.
For example, FIG. 54 shows a processing flow of the CPU 1500 during the “settlement” process. When the user performs a payment operation, a payment process, a session establishment process, a digital radiotelephone communication process, and an infrared communication process are started in addition to the steady process.

Next, the internal configuration of the credit settlement terminal 300 will be described.
FIG. 55A is a block diagram of the credit settlement terminal 300.
The credit settlement terminal 300 is a CPU (Central Processing Unit) that performs processing of transmission data and reception data and control of other components via a bus 22529 in accordance with a program stored in a ROM (Read Only Memory) 22501. ) 22500, data processed by CPU 22500, RAM (Random Access Memory) 22502 storing data processed by CPU 22500, and hard disk 22503, terminal ID of credit settlement terminal, telephone number, merchant ID of merchant, private The key and the public key, the service provider ID of the service providing system, the telephone number (the service provider system's telephone number is digitally signed), and the service provider's public key are stored. EEPROM (Electric Erasable Programmable Read Only Memory) 22504 and CPU 22500 An LCD controller 22505 that controls the operation of the LCD 302 and displays an image set by the CPU 22500 on the LCD, an encryption processor 22506 that performs encryption and decryption of data according to the control of the CPU 22500, and according to the control of the CPU 22500 Data codec 22507 for encoding transmission data and decoding reception data, serial port 22509 connected to infrared light emitting / receiving module 301, and serial-parallel conversion circuit 22508 for bidirectional conversion between parallel data and serial data A key operation control unit 22511 for detecting a switch operation of the mode switch 304, the hook switch 305, the function switch 306, the numeric key switch 307, the execution switch 308, or the power switch 209 by the merchant, the speaker 22512, and the receiver of the receiver 303. Drive and handset 303 An audio processing unit 22513 that amplifies an analog audio signal input from the audio source and supplies the amplified audio signal to the audio codec 22514; encoding of the analog audio signal 22544 into digital audio data; and decoding of the digital audio data into an analog audio signal 22543 A voice codec 22514, transmission data generation by multiplexing digital voice data and data communication data, a channel codec 22515 for extracting digital voice data and data communication data from the multiplexed reception data, and digital telephone communication RS-232C interface 22517 which is an interface circuit of an RS-232C cable 313 connecting the digital communication adapter 22516 which is a communication adapter with the line 110 and the cash register 311, a key operation control unit 22513, a channel codec 22515, RS -Input from 232C interface 22517 And a control logic unit 22510 that serves as an interface when the CPU 22500 accesses the internal registers of the key operation control unit 22513, the audio processing unit 22513, the audio codec 22514, and the channel codec. I have.

The cryptographic processor 22506 has functions of encryption / decryption with a secret key method and encryption / decryption with a public key method. Encryption processing or decryption processing. The CPU 22500 uses the encryption and decryption functions of the encryption processor 22506 to perform digital signature processing or sealing processing of the message, and decryption processing of the encrypted message, or The digital signature of the digitally signed message is verified.
Data codec 22507 performs encoding of transmission data and decoding of reception data under the control of CPU 22500. Encoding in this case means processing for generating actually transmitted data including communication control information and error correction information. Decoding means performing error correction processing on the received data, and extra data. This means the process of removing the communication control information and generating the data originally intended to be transmitted by the sender. The data codec 22507 has functions of data encoding / decoding in digital telephone data communication and data encoding / decoding in infrared communication, and is set in the CPU with respect to data set in the CPU. Encoding processing and decoding processing are performed.

For example, when a message subjected to digital signature processing and sealed processing is transmitted by digital telephone communication, the CPU 22500 uses the cryptographic processor 22506 to perform digital signature processing and sealed processing of the message. In addition, the data codec 22507 is used to encode a message subjected to digital signature processing and sealed processing into a data format for data communication of a digital telephone, which is then transmitted to the channel codec via the control logic unit 22510. Send to 22515.
On the contrary, when the digital signature processing and the sealed processing message are received by digital telephone communication, the CPU 22500 reads the received message from the channel codec 22515 via the control logic unit 22510, The data codec 22507 is used to decrypt the received message, and the encryption processor 22506 is used to decrypt the encrypted message and to verify the digital signature applied to the message. .
Similarly, when transmitting a message subjected to digital signature processing and sealed processing by infrared communication, the CPU 22500 uses the cryptographic processor 22506 to perform digital signature processing and sealed processing of the message, Further, the data codec 22507 is used to encode the message subjected to the digital signature process and the sealed process into an infrared communication data format, which is sent to the serial-parallel conversion circuit 22560.

Conversely, when a message that has been subjected to digital signature processing and sealed processing is received by infrared communication, the CPU 22500 reads the received message from the serial-parallel conversion circuit 22560, and uses the data codec 22507, The received message is decrypted, and further, the encryption processor 22506 is used to perform decryption processing of the encrypted message and verification processing of the digital signature applied to the message.
As shown in FIG. 55 (b), the infrared light emitting / receiving module 301 connected to the serial-parallel conversion circuit 22560, the serial port 22509, and the serial cable 310 includes a serial port 22555 that is an interface with a credit settlement terminal. A modulation / demodulation circuit 22556 that modulates the digital signal 22556 input from the serial-parallel conversion circuit into a signal that is actually transmitted as infrared rays, or demodulates the received analog signal 22561 into a serial digital signal 22559, and a modulation / demodulation circuit 22556 The infrared light receiving / emitting unit 22557 for converting the signal 22560 modulated by the above into an infrared ray to emit light, or converting the received infrared ray into an analog signal 22561.

When the merchant presses any one of the mode switch 304, the hook switch 305, the function switch 306, the numeric key switch 307, the execution switch 308, and the power switch 209, the key operation control unit 22511 In addition, an interrupt signal 22539 that prompts processing corresponding to the switch operation is asserted. Further, as shown in FIG. 56, the key operation control unit 22511 includes a key operation control register (KEYCTL) 22610 for setting validity / invalidity of each switch. The CPU 22500 accesses this key operation control register (KEYCTL) 22610 to set validity / invalidity of each switch.
As shown in FIG. 56, the voice processing unit 22513 includes a voice processing unit control register (SCTL) 22609 for controlling a voice processing operation. The CPU 22500 accesses the voice processing unit control register (SCTL) 22609 to control the operation of the voice processing unit 22513. For example, when an incoming call request for a digital telephone is received, the CPU 22500 accesses the voice processing unit control register (SCTL) 22609 and performs setting for outputting a ringing tone for the digital telephone. As a result, the voice processing unit 22513 drives the speaker 22512 to output a digital telephone ring tone. However, if the incoming call request is from the service providing system 102, no ring tone is output, and the CPU 22500 starts processing for establishing a session with the service providing system.

The audio codec 22514 encodes the analog audio signal 22544 input from the audio processing unit 22513 into digital audio data and decodes the digital audio data read from the channel codec 22515 into the analog audio signal 22543. The analog audio signal 22543 is supplied to the audio processing unit 22513, and the audio processing unit 22513 amplifies the analog audio signal 22543 and drives the receiver of the receiver 303, thereby outputting audio from the receiver. The digital audio data generated by encoding is supplied to the channel codec 22515 and converted into transmission data.
The voice codec 22514 includes a voice data encryption key register (CRYPT) 22611 for storing a secret key type encryption key used for encryption and decryption of voice data, and the voice data encryption key register (CRYPT) 22611 includes When the audio data encryption key is set by the CPU 22500, the audio codec 22514 encrypts the digital audio data simultaneously with encoding the analog audio signal 22544 into the digital audio data, and the analog audio signal 22543 of the digital audio data. Simultaneously with the decryption of the digital audio data, the encryption of the digital audio data is decrypted.
Two types of data are input to the channel codec 22515 as data to be transmitted. One is digital audio data input as a digital audio signal 22547 from the audio codec 22514, and the other is data communication data input as a digital signal 22551 from the CPU via the control logic unit 22510.
The channel codec 22515 adds identification information of digital audio data and data communication data to each data as header information, and a digital signal 22548 obtained by multiplexing the digital audio data and data communication data is sent to the digital communication adapter 22516. Supply.

  Conversely, the channel codec 22515 first checks the terminal ID against the digital signal 22548 input from the digital communication adapter 22516, and then identifies whether it is digital audio data or data communication data from the header information of the data. The digital audio signal 22547 and the digital signal 22551 are supplied to the audio codec 22512 and the control logic unit 22510, respectively. Further, the channel codec 22515 asserts an interrupt signal 22549 when a digital telephone is received and when data communication data is received, and sets the control signal 22545 to a low level when digital audio data is received. The interrupt signal 22549 is an interrupt signal that prompts the CPU 22500 to perform processing at the time of incoming digital phone call and processing of data communication data, and the control signal 22545 controls the audio codec 22514 to process the received digital audio data. This is a low active control signal to be urged.

In order to perform such an operation, the channel codec 22515, as shown in FIG. 56, an ID register (ID) 22603 for storing a terminal ID, a channel codec control register (CHCTL) 22604 for controlling the operation of the channel codec 22515, An audio transmission buffer 22605 for storing digital audio data input from the audio codec 22514, an audio reception buffer 22606 for storing digital audio data extracted from the received data, and an input from the CPU 22500 via the control logic unit 22510 A data transmission buffer 22607 for storing data communication data and a data reception buffer 22608 for storing data communication data extracted from the received data are provided.
The control signal 22546 is a control signal indicating a write / read operation by the audio codec 22514 to / from the audio transmission buffer 22605 and the audio reception buffer 22606 to the channel codec 22515. The audio codec 22514 sets the control signal 22546 to a low level. The digital audio data is written into the audio transmission buffer 22605, the control signal 22546 is set to the high level, and the digital audio data is read out from the audio reception buffer 22606.
The control signal 22550 is a control signal indicating a write / read operation by the CPU 22500 via the control logic unit 22510 to the data transmission buffer 22607 and the data reception buffer 22608 to the channel codec 22515, and the control signal 22550 is set to a low level. Thus, the data communication data is written to the data transmission buffer 22607, the control signal 22550 is set to the high level, and the data communication data is read from the data reception buffer 22608.
The digital communication adapter 22516 encodes the digital signal 22548 into a digital telephone communication format and outputs it to the digital telephone communication line 110. Conversely, the digital communication adapter 22516 decodes the signal received from the digital telephone communication line 110 and supplies the digital signal 22548 to the channel codec 22515.

The RS-232C interface 22517 is an interface circuit for connecting the RS-232C cable 313, and the credit settlement terminal communicates with the cash register 311 via the RS-232C interface 22517. When receiving data from the cash register 311, the RS-232C interface 22517 asserts the interrupt signal 22552. The interrupt signal 22552 is an interrupt signal that prompts the CPU 22500 to process data communication with the cash register 311 via the RS-232C interface 22517.
As shown in FIG. 56, the control logic unit 22510 includes three registers, a clock counter (CLOCKC) 22600, an update time register (UPTIME) 22601, and an interrupt register (INT) 22602.
The clock counter is a counter that counts the current time, and the update time register is a time at which the credit settlement terminal 300 performs processing (data update processing) for updating data on the RAM 22502 and the hard disk 22503 by communicating with the service providing system. Is a register indicating an interrupt factor to the CPU 22500.
The control logic unit 22510 generates an interrupt factor when the value of the clock counter 22600 matches the value of the update time register 22601 and when one of the interrupt signals 22539, 22549, 22552 is asserted. Is set in the interrupt register (INT) 22602 and the interrupt signal 22518 is asserted to prompt the CPU to perform interrupt processing. The CPU 22500 reads the interrupt register in the interrupt process and performs a process according to the interrupt factor.
Each bit field of the interrupt register (INT) has a meaning as shown in FIG. This meaning is the same as that described with reference to FIG. 27B in the first embodiment.

Next, data stored in the RAM 22502 will be described.
FIG. 58 is a schematic diagram of a RAM map of data stored in the RAM 22502.
The RAM 22502 has five areas: a basic program area 22800, a service data area 22801, a merchant area 22802, a work area 22803, and a temporary area 22804. The basic program area 22800 stores a version-upgraded module of the program stored in the ROM 22501, a patch program, and an additional program. The merchant area 22802 is an area that can be freely used by the merchant, the work 22803 area is a work area that is used when the CPU 100 executes a program, and the temporary area 22804 is an area that temporarily stores information received by the credit settlement terminal. It is.
The service data area 22801 is an area for storing ID information, handling credit card information, and history information of the personal remote credit settlement service, and data in this area is managed by the service providing system. The service data area 22801 further includes six areas: data management information 22805, merchant information 22806, merchant setting information 22807, telephone information 22808, credit card list 22809, and sales history list 22810.
Data management information 22805 is an area for storing management information of information stored in the service data area 22801, and merchant information 22806 is an area for storing information such as the merchant name and contract details with the service provider, merchant setting Information 22807 is an area for storing merchant setting information related to the personal remote credit settlement service, telephone information 22808 is an area for storing information related to digital telephones, and a credit card list 22809 can be handled by the merchant. The area for storing credit card list information, the sales history list 22810, is an area for storing history information on sales in the personal remote credit settlement service.

Next, information stored in service data area 22801 will be described in detail.
FIG. 59 is a schematic diagram showing in detail the relationship of information stored in the service data area 22801.
Data management information 22805 includes update date 22900, next update date 22901, terminal status 22902, merchant information address 22903, merchant setting information address 22904, telephone information address 22905, credit card list address 22906, sales history list address 22907 It consists of 8 pieces of information.
The update date and time 22900 indicates the date and time when the service providing system 102 last updated the data in the RAM 22502 and the hard disk 22503, and the next update date and time 22901 indicates the update of the data in the service data area 22801 by the next service providing system 102. Indicates the scheduled date and time. The credit settlement terminal automatically starts the data update process when the next update date 22901 is reached.
The value of the next update date / time 21901 is set in the update time register 21603. When the next update date / time 21901 is reached, the credit settlement terminal 300 starts the data update process. The data update process is a process in which the service providing system 102 updates the data in the RAM and the hard disk, and is normally performed every day in a relatively busy time zone (for example, midnight). .
The terminal status 22902 indicates the status of the credit payment terminal. The merchant information address 22903, the merchant setting information address 22904, the telephone information address 22905, the credit card list address 22906, and the sales history list address 22907 are respectively the merchant information 22806. , The start address of the area where the merchant setting information 22807, telephone information 22808, credit card list 22809, and usage history list 22810 are stored.

The telephone information 22808 is further composed of three pieces of information: a calling telephone number 22908, a telephone directory address 22909, and a speed dial setting file address 22910. The outgoing telephone number 22908 indicates the telephone number of the telephone that the merchant made last time, and this information is used when the digital wireless telephone is retransmitted. The phone book address 22909 and the speed dial setting file address 22910 indicate addresses on the hard disk 22503 in which the phone book information and the speed dial setting file are stored, respectively.
The credit card list 22809 stores credit card list information that can be handled by the merchant. In the credit card list 22809, two pieces of information of a credit card name 22911 (22913, 2295) and a service code list address 22912 (22914, 22916) are stored for one credit card. The credit card name 22911 (22913,22915) indicates the name of the credit card that the merchant can handle, and the service code list address 22912 (22914,22916) is the merchant of the services provided by the credit card. Indicates an address on the hard disk 22503 in which a service code list indicating the types of services that can be handled is stored. The service code list is a list of service codes that can be handled by the merchant and payment option codes.
The sales history list 22810 is an area for storing sales history information in the personal remote credit settlement service. In the sales history list 22810, transaction number 22917 (22921), service code 22918 (22922), sales time 22919 (22923), and sales information address 22920 (22924) are sold for sales of one personal remote credit settlement service. Four pieces of information are stored.
The transaction number 22917 (22921) is a number that uniquely indicates a transaction with the user, and the number issued by the credit settlement terminal and the service code 22918 (22922) used by the user when generating the payment offer response 609 Code number indicating the type of credit card service, sales time 22919 (22923) is the time of sale with personal remote credit payment service, sales information address 22920 (22924) is the address where the payment completion notice is stored .

In the sales information address 22920 (22924), a local address indicating an address on the hard disk 22503 or a remote address indicating an address on the merchant information server 403 of the service providing system 102 is stored. In the case where the remote address is stored in the sales information address 22920 (22924), when the merchant accesses the sales history information, the credit settlement terminal downloads the sales information from the service providing system to the temporary area, and the LCD To display.
The address stored in the sales information address 22920 (22924) is determined by the service providing system. In the data update process, the sales times of the sales information are compared, and a local address is assigned to the sales information with the latest sales time. However, if the hard disk 22503 has a sufficient capacity, all sales information addresses may be local addresses.

Next, processing performed by the CPU 22500 will be described.
FIG. 61 is a conceptual diagram of a processing flow performed by the CPU 22500.
As shown in FIG. 61, the processing performed by CPU 22500 includes two processing routines: a main routine 23109 and an interrupt processing routine 23122. The main routine is a processing routine for processing transmission data and reception data and controlling other components, and the interrupt processing routine is a processing routine for detecting a process (processing) requested by an external interrupt. It is. Therefore, CPU 22500 normally performs main routine processing. When the interrupt signal 22518 is asserted, the CPU 22500 jumps from the main routine to the interrupt processing routine, performs the interrupt processing, and when the interrupt processing ends, returns to the main routine and resumes the processing of the original main routine. .
The CPU 22500 executes 17 types of processes in the main routine. The CPU 22500 dynamically selects a process and executes the selected process in a time-sharing manner. FIG. 60A shows 17 types of processes executed in the main routine.
The 17 types of processes executed in the main routine are a process management process for selecting and managing processes executed by the CPU, a power-on process for performing initial operation processing when the power switch is turned on, and a power switch being turned off. Power-off process for performing time end processing, digital telephone process for performing GUI (Graphical User Interface) processing in digital telephone mode, and data processing (for example, setting of speed dial), and GUI processing in credit settlement mode (for example) : Display of sales history) and credit settlement process for data processing, and merchant for GUI processing in merchant information management mode (for example: display of merchant information) and data processing (for example, setting of merchant setting information) Information management process and “settlement” process A settlement process for performing a "cancel" process, a customer service call process for performing a "customer service call" process, an inquiry call process for performing an "inquiry call" process, and a data update process. A data update process to be performed, a forced data update process to perform forced data update processing, a remote access process to perform remote access processing, a session establishment process to perform session establishment processing with a service providing system, and a digital telephone A digital telephone communication process for controlling communication, an infrared communication process for controlling infrared communication, and an external interface communication process for controlling data communication via the RS-232C interface. .

Each process has a corresponding program module in the ROM 22501 and the basic program area 21802 of the RAM 22502, and the CPU 22500 executes the program module to execute each process.
In addition, for each process, information indicating the status (state) of the process exists in the work area 2503 on the RAM 22502 corresponding to each process, and the process activation status (“active” or “inactive”) and The execution state (“running” or “idle”) and the current processing step are shown. “Active” in the start state indicates that the process is started as a process executed in the main routine, “inactive” indicates that the process is not started, and “running” in the execution state indicates “Idle” indicates that the process is being executed, and “idle” indicates that the process is suspended.
In particular, the execution state of the digital telephone process, the credit settlement process, and the merchant information management process corresponds to the operation mode of the credit settlement terminal. When the execution state of the digital telephone process is “running”, the credit settlement terminal is a digital telephone. When the execution state of the mode and the credit settlement process is “running”, the merchant information management mode is entered when the execution state of the credit settlement mode and the merchant information management process is “running”. Regarding the execution state of the digital telephone process, the credit settlement process, and the merchant information management process, only one process always indicates “running” and the other indicates “idle”. Hereinafter, the information indicating the status of the process is referred to as process status.
In the main routine, the CPU 22500 repeatedly executes the process management process and the process registered in the process list in a time-sharing manner. The process list is a list indicating active processes other than the process management process, and the process management process updates the process list. The process management process is a process that is always executed in the main routine, and updates the process list and the process status of each process to select a process to be executed in the main routine.

The process management process updates the process list based on the process generation request message sent from another process of the main routine or the process of the interrupt processing routine and the process status of each process (FIG. 60B). reference).
FIG. 61 shows the flow of processing performed by the CPU 22500 as a generalized conceptual diagram. As shown in FIG. 60B, a process flow when N processes (N is an integer of 0 or more) is registered in the process list 23000 is shown.
In FIG. 61, first, when the credit settlement terminal 300 is reset, the process proceeds to step 23100, and the CPU 22500 performs a reset process. When the reset process is completed, the process proceeds to step 23101. In the reset process, variables defined on the RAM 22502 are initialized, internal registers are initialized, and a process management process is generated.
In step 23101, the CPU 22500 executes the process management process, updates the process list and the process status of each process, and proceeds to step 23102 (if N ≧ 1) (if N = 0, step 23101). Back to).
(When N ≧ 1) In step 23102, it is checked whether the status of the first registered process in the process list 23000 is “running” or “idle”. 2) go to step 23104 (if N = 1, go back to step 23101), if “running” go to step 23103 and execute the first process (if N ≧ 2) ) Proceed to step 23104 (if N = 1, return to step 23101).
(When N ≧ 2) Step 23104 and subsequent steps are sequentially performed for the second to Nth processes in the process list in the same procedure as the process for the first process in the process list (steps 23102 and 23103). When the CPU 22500 finishes the processing for the Nth process (step 23106, step 23107), it returns to step 23101. That is, the CPU 22500 repeats step 23101 and processing corresponding to steps 23102 to 23107. However, the processing contents corresponding to step 23102 to step 23107 vary depending on the process management process of step 23101.
When the interrupt signal 22518 is asserted during the execution of the processing of the main routine 23109, the CPU 22500 jumps to the interrupt routine 23122. In the interrupt processing routine 23122, first, in step 23110, the CPU 22500 reads the interrupt register (INT) and copies it to the word interrupt on the RAM (work area). At this time, the interrupt register (INT) read by the CPU is echo reset and the interrupt signal 22518 is negated.

Next, in step 23111, it is checked from the value of bit 28 of interrupt whether or not it is an incoming call interrupt. (bit28) = 1) goes to step 23112, sends a digital telephone process generation request message to the process management process, and goes to step 23113.
In step 23113, it is checked from the value of the bit 26 of the interrupt whether or not it is an update interrupt. = 1) proceeds to step 23114, sends a data update process generation request message to the process management process, and proceeds to step 23115.
In step 23115, it is checked from the value of bit 25 of the interrupt whether it is an external IF interrupt or not. (bit25) = 1) proceeds to step 23116, sends a generation request message of the external IF communication process to the process management process, and proceeds to step 23117.
In step 23117, it is checked from the value of bit 24 of interrupt whether it is a key interrupt or not. In the case of key interruption (interrupt (bit 24) = 1), the process proceeds to step 23118.
In step 23118, the value of the interrupt “power” bit (bit 16) is checked. If it is 0, the interrupt processing is terminated, and the processing returns to the original main routine. The process proceeds to step 23119.
In step 23119, the value of the “power display” bit (bit 31) of interrupt is checked. If it is 0, it is determined that the power-off operation has been performed, and the process proceeds to step 23121. It is determined that the operation has been performed, and the process proceeds to step 23120.
In step 23120, a power-on process generation request message is sent to the process management process, the interrupt process is terminated, and the process returns to the original main routine process.
In step 23121, a power-off process generation request message is sent to the process management process, the interrupt process is terminated, and the process returns to the original main routine process.
The CPU 22500 that has returned from the interrupt processing routine 23122 to the main routine 23109 resumes the processing of the main routine from the processing step immediately before jumping to the interrupt processing routine. In the interrupt processing routine, the process generation request message sent to the process management process returns to the main routine from the interrupt processing routine, and is evaluated and requested in the processing of the process management process in step 23101 to be executed first. The process is registered in the process list. The requested process is executed in the subsequent main routine processing.

For example, when the credit payment terminal 300 is reset, nothing is registered in the process list immediately after the reset. Therefore, the CPU 22500 repeats the process management process generated in the reset process 23100 in the main routine (see FIG. 52A). On the other hand, by the reset, the control logic unit 22510 sets 1 to the bit 24 (key interrupt) and the bit 16 (“power supply”) of the interrupt register (INT), and asserts the interrupt signal 22518. At this time, if the power switch 309 is on, the CPU 22500 executes the power-on process in the main routine through the processing of the interrupt processing routine by this interrupt, and the power switch 309 is off. First, the CPU 22500 executes the power-off process in the main routine through the processing of the interrupt processing routine by this interrupt.
FIG. 52C shows a processing flow when the power switch is turned off or when the power switch is turned off at the time of resetting. In the power-off process, termination processing such as erasing the LCD display or setting the key switch 309 to be valid by accessing the key operation control register (KEYCTL) 22610 is performed. When the processing of the power-off process is completed, the CPU 22500 shifts to the halt state and stops the processing of the main routine. The CPU 22500 returns from the halt state to the normal operation state only by an interrupt due to an ON operation of the power switch or an update interrupt, and resumes the processing of the main routine after the processing of the interrupt processing routine.

  FIG. 52B shows a processing flow when the power switch is turned on or when the power switch is turned on at the time of reset. In the power-on process, initialization of LCD display, variables defined on RAM 22502, internal register settings, digital telephone process, credit settlement process, and merchant information management process generation request message are processed. Performs initial operation processing sent to the management process. By the generation request message of these processes, a digital telephone process, a credit payment process, and a merchant information management process are registered in the process list, and these processes are executed in the main routine. However, since the execution status of the process status of each process is stored, the operation mode at power-on becomes the operation mode when the power switch was turned off last time.

FIG. 62 shows that after the power-on process is completed or the credit settlement terminal performs “settlement”, “cancel”, “customer service call”, “inquiry call”, “data update”, “remote access”, etc. The processing flow of CPU at the time of the steady state which is not processing is shown. At this time, in the process list, three processes of a digital telephone process, a credit settlement process, and a merchant information management process are registered, but only one process status execution state is “running”. The operation mode of the credit settlement terminal is an operation mode corresponding to a process whose process status execution state indicates “running”.
The key operation performed by the merchant is copied to the word interrupt on the RAM 22502 as the interrupt factor of the interrupt register 22602 by the processing of the interrupt processing routine, and the process corresponding to the operation mode of the credit settlement terminal (digital telephone process or , Credit settlement process or merchant information management process), and processing corresponding to the merchant operation is performed. Then, when an operation such as a credit settlement operation 604, a cancel operation 901, a customer service call operation 1200 is performed, or an inquiry call 1216 is received, a settlement process, a cancellation process, a customer service call process, and an inquiry call, respectively. A message requesting generation of a corresponding process such as a process is sent to the process management process.
For example, FIG. 63 shows the processing flow of the CPU 22500 during the “settlement” process. When the merchant performs a credit settlement operation, a settlement process, a session establishment process, a digital telephone communication process, and an infrared communication process are started in addition to the process at the normal time.

  Next, digital signature processing and sealed processing will be described. Digital signature processing when the personal credit terminal generates a message to be transmitted to the credit settlement terminal and the service providing system, or when the credit settlement terminal generates a message to be transmitted to the personal credit terminal and the service provision system. 64 (a) and (b) show the procedure of the digital signature processing, and FIGS. 65 (a) and 65 (b) show the procedure of the sealing processing. 66 (a) and 66 (b) show the procedure for decrypting the sealed message, and FIGS. 67 (a) and 67 (b) show the digital signature verification procedure for the digitally signed message. ing. These procedures are substantially the same as those described with reference to FIGS. 20, 21, 22, and 23 in the first embodiment.

Next, processing in the service providing system 102 will be described.
The service providing system 102 communicates with the personal credit terminal 100, the credit payment terminal 101, and the payment system 103, respectively, and mediates between the three parties of the user, the merchant, and the payment processing institution to the user and the merchant. On the other hand, the system provides a personal remote credit settlement service.
FIG. 68 shows the architecture of processing in the service providing system 102.
The service providing system 102 provides a personal remote credit payment service by a user process (UP: User Process) 23802 generated on the service server 400, a merchant process (MP: Merchant Process) 23802, a payment processing organization process (TPP: It is provided by cooperative processing of five types of processes: Transaction Processor Process (23804), Service Director Process (SDP) 23801, and Service Manager Process (SMP) 23800. 68, a user process 23802 corresponds to the personal credit terminal 100 on a one-to-one basis and serves as an interface for communication between the service providing system 102 and the personal credit terminal 100, and a merchant process 23803 The payment processing institution process 23804 corresponds to the payment system 103, and is a process that serves as a communication interface between the service providing system 102 and the credit payment terminal 300 in one-to-one correspondence with the credit payment terminal 300. Process and service director process 23801, which is the communication interface between 102 and payment system 103, communicates with user process 23802, merchant process 23803, and payment processor process 23804, respectively, to produce a personal remote credit payment service Process Service manager process 23 800, the user process, the merchant process on the service providing system 102, the settlement processing institution process is a process for managing service director process. The meaning of the expression “to produce a personal remote credit settlement service” will be described in detail later.
69 and 70 show a list of these five types of processes.

The service providing system 102 may communicate with a plurality of personal credit terminals and a plurality of credit payment terminals at the same time, and perform processing of a plurality of personal remote credit payment services at the same time. In some cases, at the same time, it communicates with a plurality of payment systems to process a plurality of personal remote credit payment services. Accordingly, a plurality of processes may exist on the service server 400 at the same time as the user process, the merchant process, the payment processing institution process, and the service director process. These user process, merchant process, payment processing institution process, and service director process are created, deleted, and managed by the service manager process.
Further, when the service server 400 is constituted by a plurality of computers, a plurality of user processes, merchant processes, payment processing institution processes, and service director processes are provided so that the processing load of each process is distributed. Generated in a distributed manner on one computer.

In addition, a set of processes for providing a single personal remote credit payment service by performing a cooperative process is determined by a service manager process, and the set of processes includes a user process, a merchant process, and a payment processor process. One or more of these processes and one service director process are included. Hereinafter, a set of processes for performing the cooperation processing is referred to as a process group.
First, the user process 23802 will be described.
The user process includes communication control with the personal credit terminal 100, user authentication, encryption of transmission data to the personal credit terminal 100, decryption of data received from the personal credit terminal 100, personal credit terminal 100 Is a process of checking the validity of the data received from the mobile phone, and performing remote access, data update, and data backup with the personal credit terminal 100.
The user process 23802 is a process generated by the service manager process 23800 when the service providing system 102 communicates with the personal credit terminal 100. The service manager process 23800 generates one user process 23802 for one personal credit terminal 100 communicating with the service providing system 102. At this time, the service manager process 23800 generates the user process management information 4400 shown in FIG. 75 (a) on the memory or hard disk of the computer constituting the service server 400, and stores the generated user process 23802. to manage.
The user process 23802 has access to user process management information 4400, attribute information of the owner (user) of the personal credit terminal 100 managed by the user information server 402, and data in the RAM 1502 of the personal credit terminal 100. Permission is granted. Conversely, the user process 23802 cannot access other information.

The personal credit terminal 100 and the user process 23802 have a one-to-one correspondence, and the user process 23802 is a process that is effective only for the personal credit terminal 100, and communicates directly with other personal credit terminals 100. I can't do it.
The user process 23802 and the personal credit terminal 100 communicate with each other using messages shown in the columns 23901 and 23902 in FIG. Messages in the column 23901 (authentication test A response, authentication test C, authentication test D response, remote access request, data update request, upload data, payment request, cancel request, incoming response, inquiry call request, timeout error message, session Error message) is a message sent from the personal credit terminal to the user process. The message in the column 23902 (authentication test A, authentication test B response, authentication test C response, remote access data, data update response, update data, Data update instruction, function stop instruction, receipt, cancellation processing receipt, customer service call, inquiry call response, call response, timeout error message, session error message, timeout “Message” indicates a message sent from the user process to the personal credit terminal. Sending other messages will not be interpreted as valid messages.

Also, the user process 23802 communicates with the service director process 23801 belonging to the same process group using the messages shown in the fields 23903 and 23904 in FIG. 69 as an interface. The messages in 23903 (receipt, cancellation receipt, customer service call, inquiry call response, call response, timeout error message, session error message) are messages sent from the service director process to the user process. The message (payment request, cancellation request, incoming response, inquiry call request, timeout error message, session error message, timeout message) in the column 23904 indicates a message sent from the user process to the service director process. . Sending other messages will not be interpreted as valid messages.
Further, the user process 23802 communicates with the service manager process 23800 using the message shown in the column 23906 in FIG. 69 as an interface. A message (payment request, cancel request, inquiry request, own process deletion request) in the column 23906 indicates a message sent from the user process to the service manager process. The column 23905 (user process generation, user process deletion) in FIG. 69 shows the action of the service manager process on the user process, and the service manager process generates and deletes the user process. The contents of the message will be described in detail later.

There is no interface for communication between a user process and another user's user process, and the user process cannot communicate directly with another user process. Similarly, there is no communication interface between the user process and the merchant process, the user process and the payment processor process, the service director process of a different process group from the user process, and the user process is the merchant process, payment processor process, And cannot communicate directly with service director processes of different process groups.
In addition, when using a personal credit terminal in a service area other than the service area where the user resides, the service providing system in the service area where the user resides and the service area where the personal credit terminal is used A user process may be generated on the service providing system. Such a case will be described in detail later.

Next, the merchant process 23803 will be described.
The merchant process includes communication control with the credit payment terminal 300, merchant authentication, encryption of transmission data to the credit payment terminal 300, decryption of data received from the credit payment terminal 300, and reception data from the credit payment terminal 300. In this process, the remote access and data update processing with the credit settlement terminal 300 are performed.
The merchant process 23803 is a process generated by the service manager process 23800 when the service providing system 102 communicates with the credit payment terminal 300. The service manager process 23800 generates one merchant process 23803 for one credit payment terminal 300 communicating with the service providing system 102. At this time, the service manager process 23800 generates the merchant process management information 4401 shown in FIG. 75B on the memory or the hard disk of the computer constituting the service server 400, and executes the generated merchant process 23803. to manage.
The merchant process 23803 includes merchant process management information 4401, attribute information of the owner (merchant) of the credit settlement terminal 300 managed by the merchant information server 403, and data in the RAM 22502 and the hard disk 22503 of the credit settlement terminal 300. Permission to access is given. Conversely, the merchant process 23803 cannot access other information.
The credit settlement terminal 300 and the merchant process 23803 have a one-to-one correspondence, and the merchant process 23803 is a process that is effective only for the corresponding credit settlement terminal 300 and directly communicates with other credit settlement terminals. It is not possible.

  The merchant process 23803 and the credit settlement terminal 300 communicate using the messages shown in the columns 23907 and 23908 in FIG. Messages in column 23907 (Authentication Test A Response, Authentication Test C, Authentication Test D Response, Remote Access Request, Data Update Request, Upload Data, Credit Inquiry Request, Payment Request, Receipt, Cancellation Request, Incoming Response, Customer Service Call Request, timeout error message, session error message) is a message sent from the credit settlement terminal to the merchant process. The message in the column 23908 (authentication test A, authentication test B response, authentication test C response, remote access data, Data update response, update data, data update command, function stop command, credit inquiry response, payment completion notification, cancellation completion notification, customer service call response, call response, inquiry call, timeout error message, security (Action error message, timeout message) indicates a message sent from the merchant process to the credit settlement terminal. Sending other messages will not be interpreted as valid messages.

  In addition, the merchant process 23803 communicates with the service director process 23801 belonging to the same process group using the messages shown in the fields 23909 and 23910 in FIG. 69 as an interface. Messages in column 23909 (credit inquiry response, payment completion notification, cancellation completion notification, customer service call response, call response, inquiry call, timeout error message, session error message) are sent from the service director process to the merchant process. Messages in the 23910 column (settlement completion notification, cancellation completion notification, customer service call response, call response, inquiry call, timeout error message, session error message, timeout message) are serviced from the merchant process. It shows a message sent to the director process. Sending other messages will not be interpreted as valid messages.

Further, the merchant process 23803 communicates with the service manager process 23800 using the message shown in the column 23912 of FIG. 69 as an interface. The message in the column 23912 (credit inquiry request, cancellation request, customer service call request, own process deletion request) indicates a message sent from the merchant process to the service manager process. The column 23911 (merchant process creation, merchant process erasure) in FIG. 69 shows the action of the service manager process on the merchant process. The service manager process creates and erases the merchant process. The contents of the message will be described in detail later.
There is no interface for communication between the merchant process and other merchant processes, and the merchant process cannot communicate directly with other merchant processes. Similarly, there is no communication interface between the merchant process and the user process, the merchant process and the payment processor process, the service director process of the process group different from the merchant process, and the merchant process includes the user process, the payment processor process, And cannot communicate directly with service director processes of different process groups.

Next, the settlement processor process 23804 will be described.
The payment processing organization process controls communication with the payment system 103, authentication of the payment processing organization, encryption of transmission data to the payment system 103, decryption of data received from the payment system 103, and data received from the payment system 103. This is a process for checking the validity of.
The payment processing institution process 23804 is a process generated by the service manager process 23800 when the service providing system 102 communicates with the payment system 103. One payment processing institution process 23804 is generated for communication using one communication line between the service providing system 102 and the payment system 103. The digital communication line 111 connecting the service providing system 102 and the payment system 103 operates as a plurality of communication lines by multiplexing. Therefore, when communication is performed between the service providing system 102 and the payment system 103 using a plurality of communication lines at the same time, the service manager process 23800 has the same number of payment processing institution processes as the communication lines. 23804 is generated. At this time, the service manager process 23800 performs the payment processing organization process shown in FIG. 75C for each of the payment processing organization processes generated on the memory or hard disk of the computer constituting the service server 400. Management information 4402 is generated to manage the payment processing organization process.

The payment processing institution process 23804 has access to the payment processing institution process management information 4402, attribute information of the payment processing institution where the payment system 103 managed by the payment processing institution information server 404 is installed, and payment processing history information. Permission to do so. Conversely, the payment processor process 23804 cannot access other information.
Further, the payment processing institution process 23804 is a process that is effective only for the payment system 103 and cannot directly communicate with other payment systems.
The settlement processor process 23804 and the settlement system 103 communicate with each other using messages shown in the columns 23913 and 23914 in FIG. Messages in the 23913 column (payment completion notification, cancellation completion notification, timeout error message, session error message) are messages sent from the payment system to the payment processor process, messages in the 23914 column (payment request, cancellation request) , Timeout error message, session error message, timeout message) indicates a message sent from the payment processing institution process to the payment system. Sending other messages will not be interpreted as valid messages.

Further, the payment processing institution process 23804 communicates with the service director process 23801 belonging to the same process group using the messages shown in the columns 23915 and 23916 in FIG. 69 as an interface. The messages in the 23915 column (payment request, cancellation request, timeout error message, session error message) are the messages sent from the service director process to the payment processor process, the messages in the 23916 column (payment completion notification, cancellation) (Completion notification, session error message, timeout message) indicates a message sent from the payment processing institution process to the service director process. Sending other messages will not be interpreted as valid messages.
Further, the settlement processor process 23804 communicates with the service manager process 23800 using the message shown in the column 23918 in FIG. 69 as an interface. The message in the column 23918 (its own process deletion request) indicates a message sent from the settlement processor process to the service manager process. In addition, the column 23717 (payment processing organization process generation, settlement processing organization process deletion) in FIG. 69 shows the action of the service manager process on the payment processing organization process. Generate and delete The contents of the message will be described in detail later.

  There is no communication interface between the clearing house process and other clearing house processes, and the clearing house process cannot communicate directly with other clearing house processes. Similarly, there is no communication interface between the payment processor process and the user process, the payment processor process and the merchant process, the service director process of the process group different from the payment processor process, and the payment processor process is the user process. , Merchant processes, and service director processes in different process groups cannot communicate directly.

Next, the service director process 23801 will be described.
The service director process is a process for producing a personal remote credit payment service by communicating with a user process, a merchant process, and a payment processing institution process belonging to the same process group. “Directing a personal remote credit payment service” means that the service director process will lead the processing of the personal remote credit payment service in cooperation with other member processes of the same process group. It means that.
The service director process 23801 is a service provided when the service providing system 102 performs any of the “settlement”, “cancel”, “customer service call”, and “inquiry call” processes of the personal remote credit settlement service. Generated by manager process 23800 The service manager process 23800 generates the service director process management information 4403 shown in FIG. 75D on the memory or hard disk of the computer constituting the service server 400, and generates the generated service director process 23801. Manage.

Each process of “settlement”, “cancellation”, “customer service call”, and “inquiry call” in the personal remote credit settlement service has a predetermined processing sequence. The service director process processes messages sent from member processes of the same process group in accordance with the determined processing sequence, and sends a message prompting processing to each member process. Each member process performs processing corresponding to the message sent from the service director process. In this way, the service / director process and the member process of the same process group perform processing in cooperation with each other, whereby processing of the personal remote credit settlement service is performed.
In the case of processing “payment” and “cancellation”, the service director process, user process, merchant process, and payment processing organization process are combined into one process group to perform each process. In the case of the “service call” process and the “inquiry call” process, the service director process, the user process, and the merchant process form one process group and perform the respective processes.

Further, the service director process 23801 accesses the service director process management information 443, the information managed by the service director information server 404, and the information that the member process of the same process group has access permission. Permission is granted. Conversely, the service director process 23801 cannot access other information.
Also, the service director process 23801 communicates with the user processes 23802 belonging to the same process group using the messages shown in the columns 23904 and 23903 in FIG. 70 as an interface. The messages in the column 23904 (payment request, cancel request, incoming response, inquiry call request, timeout error message, session error message, timeout message) are messages sent from the user process to the service director process. The column messages (receipt, cancellation receipt, customer service call, inquiry call response, call response, timeout error message, session error message) indicate messages sent from the service director process to the user process. . Sending other messages will not be interpreted as valid messages.

Similarly, the service director process 23801 communicates with the merchant process 23803 belonging to the same process group using the messages shown in the columns 23910 and 23909 in FIG. 70 as an interface. Messages in column 23910 (settlement completion notification, cancellation completion notification, customer service call response, call response, inquiry call, timeout error message, session error message, timeout message) are sent from the merchant process to the service director process. Messages in the 23909 column (credit inquiry response, payment completion notification, cancellation completion notification, customer service call response, call response, inquiry call, timeout error message, session error message) from the service director process Shows a message sent to the merchant process. Sending other messages will not be interpreted as valid messages.
Similarly, the service director process 23801 communicates with the payment processing institution process 23804 belonging to the same process group using the messages shown in the columns 23916 and 23915 in FIG. 70 as an interface. The messages in the 23916 column (settlement completion notification, cancellation completion notification, session error message, timeout message) are the messages sent from the settlement processor process to the service director process, and the messages in the 23915 column (settlement request, cancellation) Request, timeout error message, session error message) indicates a message sent from the service director process to the settlement processor process. Sending other messages will not be interpreted as valid messages.

  Further, the service director process 23801 communicates with the service manager process 23800 using the message shown in the column 23920 in FIG. 70 as an interface. The message (member process request, process deletion request) in the column 23920 indicates a message sent from the service director process to the service manager process. Also, the column 23919 (service director process creation, service director process deletion, payment request, credit inquiry request, cancellation request, customer service call request, inquiry request) in FIG. 70 is the service director process of the service manager process. The service manager process creates and deletes the service director process. The contents of the message will be described in detail later.

  There is no communication interface between the user process of the process group different from the service director process, the merchant process of the process group different from the service director process, and the payment processor process of the process group different from the service director process. Processes cannot communicate directly with user processes in different process groups, merchant processes in different process groups, and clearing house processes in different process groups.

Next, the service manager process 23800 will be described.
The service manager process is a process for generating and deleting a user process 23802, a merchant process 23803, a payment processing institution process 23804, and a service director process 23801, and generating and deleting a process group.
The service manager process 23800 has user process management information 4400, merchant process management information 4401, payment processing institution process management information 4402, service information shown in FIG. Six types of management data of director process management information 4403, process group management information 4404, and message list 4405 are generated to manage each process. The process group management information 4404 is process group management data, and the message list 4405 is a list of messages pending processing by the service manager process. The role of the message list 4405 will be described in detail later.

The service manager process 23800 is a process that is always activated when the service providing system provides a personal remote credit card payment service. The creation and deletion of the service manager process is controlled by the management system 407.
Further, the service manager process 23800 is given permission to access information managed by the service director information server 401. Conversely, the service manager process 23800 cannot access other information.
The service manager process 23800 communicates with the user process 23802 using the message shown in the column 23906 in FIG. 70 as an interface. A message (payment request, cancel request, inquiry request, own process deletion request) in the column 23906 indicates a message sent from the user process to the service manager process. Further, the column 23905 (user process generation, user process deletion) in FIG. 70 shows the action of the service manager process on the user process, and the service manager process generates and deletes the user process.

Similarly, the service manager process 23800 communicates with the merchant process 23803 using the message shown in the column 23912 of FIG. 70 as an interface. The message in the column 23912 (credit inquiry request, cancellation request, customer service call request, own process deletion request) indicates a message sent from the merchant process to the service manager process. Further, the column 23911 (merchant process creation, merchant process erasure) in FIG. 70 shows the action of the service manager process on the merchant process, and the service manager process creates and erases the merchant process.
Similarly, the service manager process 23800 communicates with the payment processing institution process 23804 using the message shown in the column 23918 in FIG. 70 as an interface. The message in the column 23918 (its own process deletion request) indicates a message sent from the settlement processor process to the service manager process. Also, the column 23917 (payment processing organization process generation, settlement processing organization process deletion) in FIG. 70 shows the effect of the service manager process on the payment processing organization process. Generate and delete

Similarly, the service manager process 23800 communicates with the service director process 23801 using the message shown in the column 23920 in FIG. 70 as an interface. A message (member process request, process deletion request) in the column 23920 indicates a message sent from the service director process to the service manager process. Also, the column 23919 (service director process creation, service director process deletion, payment request, credit inquiry request, cancellation request, customer service call request, inquiry request) in FIG. 70 is the service director process of the service manager process. The service manager process creates and deletes the service director process.
Further, the service manager process 23800 communicates with the service manager process of the service providing system in the other service area using the messages shown in the columns 23921 and 23922 in FIG. 70 as an interface. Messages in the fields of 23921 (user process generation, user process deletion, home user process generation, home user process deletion, mobile user process generation, mobile user process deletion, cancel request, inquiry call request) provide services in other service areas The message sent from the service manager process of the system to the service manager process 23800 is the message in the column 23922 (user process generation, user process deletion, home user process generation, home user process deletion, mobile user process generation, mobile user process Delete, cancel request, inquiry call request) is sent from the service manager process 23800 to the service manager process of the service providing system in another service area Shows the message. Communication between service manager processes of different service providing systems is performed when a personal remote credit settlement service is provided across service areas. Such a case will be described in detail later.

Next, information managed by the user information server 402 of the service providing system 102 will be described. The user information server 402 manages user attribute information and data in the RAM 1502 of the user's personal credit terminal 100. However, the single user information server 402 does not manage the attribute information of all users and the data in the personal credit terminal RAM, but distributes them for each service area. Therefore, the user information server 402 manages the attribute information of the user who lives in the service area handled by the service providing system 102 and the data in the RAM of the user's personal credit terminal (hereinafter, the service area where the user resides). Is called the user's “home service area”).
FIG. 71 is a schematic diagram showing information stored in the user information server 402 for one user. In the user information server 402, for one user, user data management information 24000, personal information 24001, photo data 24002, terminal property 24003, user setting information 24004, access control information 24005, terminal data 24006, telephone information 24007, Ten types of information including a credit card list 24008 and a usage history list 24009 are stored. The detailed contents of these pieces of information are the same as those described with reference to FIG. 29 in the first embodiment.

  Next, information managed by the merchant information server 403 of the service providing system 102 will be described. The merchant information server 403 manages the merchant attribute information and the data of the RAM 22502 and the hard disk 22503 of the merchant credit payment terminal 300. However, the single merchant information server 403 does not manage the attribute information of all merchants and the data of credit settlement terminals, but manages them in a distributed manner for each service area. Accordingly, the merchant information server 403 manages the merchant attribute information located in the service area that the service providing system 102 is in charge of, and the RAM and hard disk data of the merchant's personal credit terminal.

  FIG. 72 is a schematic diagram showing information stored in the merchant information server 403 for one merchant. In the merchant information server 403, for one merchant, merchant data management information 24100, merchant information 24101, terminal property 24102, merchant setting information 24103, terminal data 24104, telephone information 24105, credit card list 24106, and sales history 8 types of information in the list 24107 are stored. The detailed contents of these pieces of information are the same as those described with reference to FIG. 30 in the first embodiment. The merchant information 24101 is information related to the merchant, such as the merchant's address, account number, and contract details, and a part of this information corresponds to the merchant information 2506 of the credit settlement terminal 2410.

Next, information managed by the payment processing organization information server 404 of the service providing system 102 will be described. The payment processing organization information server 404 manages the attribute information of the payment processing organization and the history information of the payment processing by the payment processing organization.
FIG. 73 is a schematic diagram showing information stored in the payment processing organization information server 404 for one payment processing organization. The payment processor information server 404 stores four types of information, that is, payment processor data management information 24200, payment processor information 24201, a credit card list 24202, and a sales history list 24203 for one payment processor. The The detailed contents of these pieces of information are the same as those described with reference to FIG. 31 in the first embodiment.

Next, information stored in the service director information server 401 of the service providing system 102 will be described.
FIG. 74 is a schematic diagram showing information stored in the service director information server 401.
The service director information server 401 stores five types of information: a user list 4300, a merchant list 4301, a payment processing organization list 4302, a service provision history list 4303, and a payment processing organization table 4304.
The user list 4300 is a list of attribute information of all users who are contracted with the service provider, the merchant list 4301 is a list of attribute information of all the merchants who are contracted with the service provider, and the payment processor list 4302 is , A list of attribute information of all payment processing organizations contracted with the service provider, a service provision history list 4303 is a list of history information of the personal remote credit settlement service provided by the service provision system 102. The processing organization table 4304 is table information in which an optimal settlement processing organization is associated with a request for a personal remote credit settlement service from a user and a merchant.
The user list 4300 includes a user name 4305 (4310), a user ID 4306 (4311), a user telephone number 4307 (4312), a service list address 4308 (4313), and a user information address 4309 ( 4314) are stored.

A service list address 4308 (4313) indicates an address where a list of service codes usable by a user is stored, and a user information address 4309 (4314) indicates an address where user data management information of the user is stored. Indicates. A list of service codes that can be used by a user and user data management information are respectively managed by a service director information server and a user information server in the service providing system of the user's home service area. Therefore, when the service providing system 102 is a service providing system in the user's home service area, the service list address and the user information address are respectively the address on the service director information server 401 and the user information. If the user's home service area is different from the service area of the service providing system 102, the service list address and the user information address are respectively the user's home service. The address on the service director information server and the address on the user information server in the area service providing system are shown.
The merchant list 3301 includes a merchant name 4315 (4321), a merchant ID 4316 (4322), a merchant telephone number 4317 (4323), a service list address 4318 (4324), a customer table address 4319 ( 4325) and 6 types of information of merchant information address 4320 (4326) are stored.

The service list address 4308 (4312) indicates an address where a list of service codes that can be handled by the merchant is stored, and the customer table address 4317 (4322) indicates a correspondence between the customer number and the user ID. The address where the table information (customer table) is stored, and the merchant information address 4320 (4326) indicates the address where the merchant data management information of the merchant is stored.
A list of service codes and a customer table that can be handled by the merchant and merchant data management information are respectively managed by the service director information server and the user information server in the service providing system in the home service area of the merchant. Therefore, when the service providing system 102 is a service providing system in the merchant's home service area, the service list address and the customer table address indicate addresses on the service director information server 401, and the user information address is , The address on the user information server 402 is shown. When the merchant's home service area and the service area of the service providing system 102 are different, the service list address and the customer table address are stored on the service director information server in the service providing system of the merchant's home service area. The user information address indicates an address on the user information server in the service providing system of the merchant's home service area.

The settlement processor list 4302 includes a settlement processor name 4327 (4332), a settlement processor ID 4328 (4333), a settlement processor communication ID 4329 (4334), a service list address 4330 ( 4335), and 5 types of information of settlement processing organization information address 4331 (4336) are stored.
The payment processing institution communication ID 4329 (4334) indicates the ID of the payment system 103 when the service providing system 102 communicates with the payment system 103 via the digital communication line 111, and the service list address 4330 (4335) is Indicates the address on the service director information server 401 in which a list of service codes that can be handled by the payment processing organization is stored. The payment processing organization information address 4331 (4336) is the payment processing organization data management information of the payment processing organization. Indicates an address on the payment processing organization information server 404 in which is stored.
The service provision history list 4303 includes service provision number 4337 (4341), service code 4338 (4342), service provision time 4339 (4343), and service provision for one service provision of personal remote credit settlement service. Four types of information of information address 4340 (4344) are stored.
The service provision number 4337 (4341) is a number that uniquely indicates processing in the service provision system 102 in one service provision, the service code 4338 (4342) is a code number that indicates the type of credit card service used by the user, and a service The provision time 4339 (4343) is the time when the personal remote credit settlement service is provided, and the service provision information address 4340 (4344) stores the history information of processing in the service provision system 102 in one service provision. The address on the service director information server 401 is shown.

Next, process management data generated when the service manager process 23800 manages the user process, the merchant process, the payment processing institution process, and the service director process will be described.
75 (a) to 75 (f) show the configuration of the management data of the process generated by the service manager process.
FIG. 75A shows a data structure of user process management information 4400 generated for one user process. User process management information 4400 includes a user process ID 4406 indicating the process ID of the user process, a user ID 4407 of the user corresponding to the user process, and a home process indicating the process ID of the user process on the service providing system of the user's home service area. ID 4408, mobile process ID 4409 indicating the process ID of the user process on the service providing system other than the user's home service area, and service ID indicating the process ID of the service director process belonging to the same process group as the user process It consists of seven types of information: a director process ID 4410, a process status 4411 indicating the execution status of the user process, and a process data area pointer 4412 indicating the memory area allocated to the user process. It is.
When the personal credit terminal communicates with the service providing system of the user's home service area, the service manager process of the service providing system of the home service area generates one user process corresponding to the personal credit terminal. In the user process ID 4406 field, an ID that uniquely indicates the user process is set through the service providing systems in all service areas, and “0” is set in the home process ID 4408 and mobile process ID 4409 fields.

On the other hand, when a user uses a personal credit terminal in a service area other than the home service area and the personal credit terminal communicates with a service providing system other than the home service area, the personal credit terminal is supported. A user process is generated on the service providing system in the user's home service area and on the service providing system with which the personal credit terminal communicates.
In this case, the user process on the service providing system in the home service area is referred to as a home user process (HUP), and the user process on the service providing system with which the personal credit terminal communicates is referred to as a mobile user process ( It is called MUP (Mobile User Process). The home user process and the mobile user process communicate with each other to perform cooperation processing and function as one user process. Specifically, the home user process accesses user attribute information managed by the user information server and data in the user's personal credit terminal RAM, and the mobile user process controls communication with the personal credit terminal. And data processing. That is, the mobile user process accesses the user information server through the home user process.

The service manager process of the service providing system in the home service area has a unique ID indicating the home user process in the user process ID 4406 field in the user process management information of the home user process. Then, “0” is set in the field of the home process ID 4408, and the ID of the mobile user process is set in the field of the mobile process ID 4409.
In addition, the service manager process of the service providing system with which the personal credit terminal communicates, the field of the user process ID 4406 in the user process management information of the mobile user process is uniquely mobile throughout the service providing system of all service areas. An ID indicating a user process is set, the ID of the home user process is set in the field of the home process ID 4408, and “0” is set in the field of the mobile process ID 4409.
A user ID 4407 and a service director process ID 4410 indicate a user and a service director process that are unique through the service providing systems of all service areas, respectively.

  Next, FIG. 75 (b) shows the data structure of merchant process management information 4401 generated for one merchant process. The merchant process management information 4401 includes a merchant process ID 4413 indicating the process ID of the merchant process, a merchant ID 4414 of the merchant corresponding to the merchant process, and a service ID indicating the process ID of the service director process belonging to the same process group as the merchant process. The information includes five types of information: a director process ID 4415, a process status 4416 indicating the execution state of the merchant process, and a process data area pointer 4417 indicating a memory area allocated to the merchant process. The merchant process ID 4413, the merchant ID 4414, and the service director process ID 4415 indicate a merchant process, a merchant, and a service director process that are unique through the service providing systems of all service areas, respectively.

  Next, FIG. 75 (c) shows the data structure of the payment processing organization process management information 4402 generated for one payment processing organization process. The payment processing organization process management information 4402 includes a payment processing organization process ID 4418 indicating the process ID of the payment processing organization process, a payment processing organization ID 4419 of the payment processing organization corresponding to the payment processing organization process, and the same process as the payment processing organization process. Service director process ID 4420 indicating the process ID of the service director process belonging to the group, process status 4421 indicating the execution state of the settlement processor process, and process data area pointer 4422 indicating the memory area allocated to the settlement processor process And five types of information. Payment processing institution process ID 4418, payment processing institution ID 4419, and service director process ID 4420 respectively indicate a payment processing institution process, a payment processing institution, and a service director process that are unique throughout the service providing system of all service areas. .

  Next, FIG. 75 (d) shows the data structure of service director process management information 4403 generated for one service director process. The service director process management information 4403 includes a service director process ID 4423 indicating the process ID of the service director process, a process group ID 4424 indicating the ID of the process group to which the service director process belongs, and the execution status of the service director process. 5 of a process status 4425 shown, a member list 4426 showing a list of process IDs of processes belonging to the same process group as the service director process, and a process data area pointer 4427 showing a memory area allocated to the service director process Consists of types of information. The service director process ID 4423 and the process group ID 4424 respectively indicate a service director process and a process group that are unique through the service providing systems of all service areas.

  Next, FIG. 75 (e) shows the data structure of the process group management information 4404 generated for one process group. The process group management information 4404 includes a process group ID 4428 indicating the ID of the process group, a service director process ID 4429 indicating the process ID of the service director process of the process group, and a member indicating a list of process IDs of processes belonging to the process group. It is composed of three types of information, the list 4430. The process group ID 4428 and the service director process ID 4429 respectively indicate a process group and a service director process that are unique through the service providing systems of all service areas.

FIG. 75 (f) shows the data structure of a message list 4405 indicating messages pending processing by the service manager process.
Of the messages sent to the service manager process, payment requests and cancellation requests sent from the user process, and credit inquiry requests and cancellation requests sent from the merchant process may be temporarily suspended. In this case, the message is registered in the message list 4405 by the service manager process.
For example, in the case of “settlement” processing, if a payment request is sent to the service manager process prior to the credit inquiry request, the payment is made until the corresponding credit inquiry request is sent to the service manager process. The request is registered in the message list 4405. When the corresponding credit inquiry request is sent to the service manager process, the service manager process creates a service director process, and the generated service director process processes the payment request and the credit inquiry request. Conversely, if a credit inquiry request is sent to the service manager process prior to the payment request, the credit inquiry request is registered in message list 4405 until the corresponding payment request is sent to the service manager process. Is done. When the corresponding payment request is sent to the service manager process, the service manager process creates a service director process, and the generated service director process processes the payment request and the credit inquiry request.

  In the case of “cancel” processing, if a cancel request from the user process is sent to the service manager process before the cancel request from the merchant process, the cancel request from the corresponding merchant process is The cancel request from the user process is registered in the message list 4405 until it is sent to the service manager process. When a cancel request from the corresponding merchant process is sent to the service manager process, the service manager process creates a service director process, and the generated service director process cancels the user process and the merchant process. The request is processed. Conversely, when a cancel request from the merchant process is sent to the service manager process before the cancel request from the user process, the cancel request from the corresponding user process is sent to the service manager process. Until then, the cancellation request from the merchant process is registered in the message list 4405. When a cancel request from the corresponding user process is sent to the service manager process, the service manager process creates a service director process, and the generated service director process cancels the user process and the merchant process. The request is processed.

The service manager process detects messages corresponding to payment requests, credit inquiry requests, user processes, and cancellation requests from merchant processes by matching the messages registered in message list 4405 with the message contents. To do.
In the message list 4405, for one message, a message pointer 4431 (4434) that is a pointer to the message and a collation data pointer 4432 (4435 that is a pointer to collation data to be collated when detecting the corresponding message). ) And process ID 4433 (4436) indicating the process of the message sender.

Next, details of messages exchanged in the process of establishing a session with a service providing system using a personal credit terminal or a credit settlement terminal will be described. The session establishment process is a process in which the personal credit terminal and the service providing system, or the credit settlement terminal and the service providing system perform mutual authentication with each other before starting communication. Hereinafter, this process is referred to as a session establishment process.
FIG. 76 shows a procedure for session establishment processing when a personal credit terminal is connected to the service providing system. FIGS. 78 (a), 78 (b), and 78 (c) show the personal credit terminal and the service providing system. The contents of the messages exchanged with are shown.
FIG. 77 shows a procedure for session establishment processing when a service providing system is connected to a personal credit terminal. FIGS. 78 (d), (e), and (f) show the personal credit terminal and service provision. Shows the contents of messages exchanged with the system.
When connecting to a service providing system from a personal credit terminal, first, the personal credit terminal 100 calls the service providing system 102 and connects a line (line connection 4505). At this time, the personal credit terminal 100 transmits a message requesting connection of a digital wireless telephone, a call request 4500, to the digital public network 108, and the digital public network 108 receives a message for calling a service providing system, A request 4501 is transmitted to the service providing system. On the other hand, the service providing system transmits a call permission message and incoming call response 4503 to the digital public network, and the digital public network transmits a line connection permission message and outgoing call response 4504 to the personal credit terminal. The personal credit terminal and the service providing system are connected by a line (line connection 4505).

At this time, messages such as a call request 4500, a call request 4501, a call response 4503, and a call response 4504 exchanged between the personal credit terminal and the digital public network and between the digital public network and the service providing system are: This is dependent on the protocol of the line connection from the digital wireless telephone to the transmission path 106 and the base station 104, the digital communication line 107, the digital public network 108, and the digital communication line 109.
In the service providing system, the service manager process receives an incoming call request 4501 from the digital public network 108. The service manager process generates a user process corresponding to the caller's personal credit terminal from the telephone number information of the caller's personal credit terminal included in the incoming call request 4501 (process generation 4502). The user process transmits an incoming call response 4503 to connect the line with the personal credit terminal.
When the line between the personal credit terminal and the user process is connected (line connection 4505), the user process generates a test message for authenticating the personal credit terminal, an authentication test A4506, and transmits it to the personal credit terminal. .

As shown in FIG. 78 (a), the authentication test A4506 includes header information indicating that the message is the authentication test A4506, an authentication test A header 4700, and a test pattern A4701 which is an arbitrary bit pattern using the user's public key. It consists of 4702 encrypted.
The personal credit terminal receives the authentication test A4506, decrypts the encryption of the test pattern A with the user's private key, and is a response message to the authentication test A4506 and a test message for authenticating the user process. The authentication test A response 4507 is generated and transmitted to the user process.
As shown in FIG. 78 (b), the authentication test A response 4507 includes header information indicating that the message is the authentication test A response 4507, an authentication test A response header 4703, a test pattern A4704 obtained by decrypting the encryption, The test pattern B4705, which is an arbitrary bit pattern, is encrypted with the public key of the service provider 4706. That is, the authentication test A response 4507 includes an authentication test B for authenticating the user process corresponding to the authentication test A for the test pattern A.

The user process receives the authentication test A response 4507 and compares the test pattern A 4701 with the received test pattern A 4704 to authenticate the user. The user authentication in this case is based on the premise that the test pattern A encrypted with the user's public key can be decrypted only by a personal credit terminal having the user's private key.
The user process further decrypts the encryption of the test pattern B with the private key of the service provider, generates a response message for the authentication test B, and an authentication test B response 4508, and transmits the response message to the personal credit terminal.
As shown in FIG. 78 (c), the authentication test B response 4508 includes header information indicating that the message is the authentication test B response 4508, an authentication test B response header 4707, a test pattern B4708 obtained by decrypting the encryption, The session permission message 4709 is encrypted with the user's public key 4710. The session permission message 4709 is a message for permitting a session with a personal credit terminal, and includes information on communication conditions.

The personal credit terminal receives the authentication test B response 4508 and compares the test pattern B4705 with the received test pattern B4708 to authenticate the user process. The authentication of the user process in this case is based on the premise that the test pattern B encrypted with the service provider's public key can be decrypted only by the service providing system having the service provider's private key.
The personal credit terminal further decrypts the encryption of the session permission message with the user's private key, and changes the communication condition with the user process to the communication condition of the session permission message.
Through the above processing, the personal credit terminal and the user process mutually authenticate each other and communicate based on common communication conditions (session establishment 4509). Hereinafter, this state is referred to as a session establishment state.

When connecting to a personal credit terminal from the service providing system, first, the service providing system 102 calls the personal credit terminal 100 and connects the line (line connection 4605). At this time, in the service providing system 102, the service manager process generates a user process corresponding to the personal credit terminal connecting the line (process generation 4600), and the generated user process is digitally transmitted to the digital public network 108. A message requesting connection to a wireless telephone line and a call request 4601 are transmitted, and the digital public network 108 transmits a message for calling a personal credit terminal and an incoming call request 4602 to the personal credit terminal. On the other hand, the personal credit terminal transmits a call permission message, incoming call response 4603 to the digital public network, and the digital public network transmits a line connection permission message, outgoing call response 4604 to the user process. Then, the user process and the personal credit terminal are connected by a line (line connection 4605). At this time, messages such as a call request 4601, a call request 4602, a call response 4603, and a call response 4604 exchanged between the user process and the digital public network, and between the digital public network and the personal credit terminal are digital. This is dependent on the protocol of the line connection via the communication line 109, the digital public network 108, the digital communication line 107, the base station 104, and the transmission path 106.
When the line between the user process and the personal credit terminal is connected (line connection 4605), the personal credit terminal generates a test message for authenticating the user process, an authentication test C4606, and transmits it to the user process.

As shown in FIG. 78 (d), the authentication test C4606 discloses header information indicating that the message is the authentication test C4606, an authentication test C header 4711, and a test pattern C4712 which is an arbitrary bit pattern to the service provider. It consists of 4713 encrypted with the key.
The user process receives the authentication test C4606, decrypts the encryption of the test pattern C with the private key of the service provider, and is a response message to the authentication test C4606 and a test message for authenticating the personal credit terminal An authentication test C response 4607 is generated and transmitted to the personal credit terminal.
As shown in FIG. 78 (e), the authentication test C response 4607 includes header information indicating that the message is the authentication test C response 4607, an authentication test C response header 4714, and a test pattern C4715 obtained by decrypting the cipher. The test pattern D4716, which is an arbitrary bit pattern, is encrypted with the user's public key 4717. That is, the authentication test C response 4607 includes an authentication test D for authenticating the personal credit terminal corresponding to the authentication test C for the test pattern C.
The personal credit terminal receives the authentication test C response 4607 and compares the test pattern C4712 with the received test pattern C4715 to authenticate the user process. The authentication of the user process in this case is based on the premise that the test pattern C encrypted with the service provider's public key can be decrypted only by the service providing system having the service provider's private key.
The personal credit terminal further decrypts the encryption of the test pattern D with the user's private key, generates a response message for the authentication test D and an authentication test D response 4608, and transmits the response message to the user process.

As shown in FIG. 78 (f), the authentication test D response 4608 includes header information indicating that the message is the authentication test D response 4608, an authentication test D response header 4718, and a test pattern D4719 obtained by decrypting the cipher. The session permission message 4720 is encrypted with the public key of the service provider 4721. The session permission message 4720 is a message for permitting a session with the user process, and includes information on communication conditions.
The user process receives the authentication test D response 4608 and compares the test pattern D4716 with the received test pattern D4719 to authenticate the personal credit terminal. The authentication of the personal credit terminal in this case is based on the premise that the test pattern D encrypted with the user's public key can be decrypted only by the personal credit terminal having the user's private key.
The user process further decrypts the encryption of the session permission message with the private key of the service provider, and changes the communication condition with the personal credit terminal to the communication condition of the session permission message.
Through the above processing, the user process and the personal credit terminal mutually authenticate each other and communicate based on the common communication condition, thereby establishing a session establishment state (session establishment 4609).

The session establishment process between the credit settlement terminal and the service providing system is performed in exactly the same procedure as the session establishment process between the personal credit terminal and the service providing system.
FIG. 79 shows a procedure for session establishment processing when a credit payment terminal is connected to a service providing system. FIGS. The contents of messages exchanged between them are shown.
FIG. 80 shows a procedure for session establishment processing when the service providing system is connected to the credit settlement terminal. FIGS. Shows the contents of messages exchanged between.
When connecting from the credit settlement terminal to the service providing system, first, the credit settlement terminal 300 calls the service providing system 102 and connects the line (line connection 4805). At this time, the credit settlement terminal 300 transmits a message requesting digital telephone line connection, a call request 4800, to the digital public network 108, and the digital public network 108 calls a service call system, an incoming call request 4801. Is transmitted to the service providing system. On the other hand, the service providing system transmits a call permission message and an incoming call response 4803 to the digital public network, and the digital public network transmits a line connection permission message and a call response 4804 to the credit settlement terminal. The credit settlement terminal and the service providing system are connected by a line (line connection 4805).
At this time, messages such as a call request 4800, a call request 4801, a call response 4803, and a call response 4804 exchanged between the credit settlement terminal and the digital public network and between the digital public network and the service providing system are digital. This is dependent on the protocol of line connection from the telephone to the digital telephone communication line 110, the digital public network 108, and the digital communication line 109.

In the service providing system, the service manager process receives an incoming call request 4801 from the digital public network 108. The service manager process generates a merchant process corresponding to the caller's credit payment terminal from the telephone number information of the caller's credit payment terminal included in the incoming call request 4801 (process generation 4802), and the generated merchant The process transmits an incoming call response 4803 to connect the line with the credit settlement terminal.
When the line between the credit settlement terminal and the merchant process is connected (line connection 4805), the merchant process generates a test message for authenticating the credit settlement terminal, an authentication test A 4806, and transmits it to the credit settlement terminal.
As shown in FIG. 81 (a), the authentication test A 4806 includes header information indicating that the message is the authentication test A 4806, an authentication test A header 5000, and a test pattern A 5001 that is an arbitrary bit pattern using the merchant's public key. It consists of the encrypted 5002.
The credit settlement terminal receives the authentication test A 4806, decrypts the encryption of the test pattern A with the merchant's private key, and is a response message to the authentication test A 4806 and a test message for authenticating the merchant process. An authentication test A response 4807 is generated and sent to the merchant process.

As shown in FIG. 81 (b), the authentication test A response 4807 includes header information indicating that the message is the authentication test A response 4807, an authentication test A response header 5003, and a test pattern A 5004 obtained by decrypting the cipher. The test pattern B5005 which is an arbitrary bit pattern is encrypted with the public key of the service provider 5006. That is, the authentication test A response 4807 includes an authentication test B for authenticating the merchant process, which corresponds to the authentication test A for the test pattern A.
The merchant process receives the authentication test A response 4807, compares the test pattern A5001 with the received test pattern A5004, and authenticates the merchant. The merchant authentication in this case is based on the premise that the test pattern A encrypted with the merchant's public key can only be decrypted by a credit payment terminal having the merchant's private key.
The merchant process further decrypts the encryption of the test pattern B with the service provider's private key, generates a response message for the authentication test B, and an authentication test B response 4808, and transmits the response message to the credit card payment terminal.
As shown in FIG. 81 (c), the authentication test B response 4808 includes header information indicating that the message is the authentication test B response 4808, an authentication test B response header 5007, and a test pattern B 5008 obtained by decrypting the cipher. The session permission message 5009 is encrypted with the merchant's public key 5010. The session permission message 5009 is a message for permitting a session with the credit settlement terminal, and includes information on communication conditions.
The credit settlement terminal receives the authentication test B response 4808, and compares the test pattern B5005 with the received test pattern B5008 to authenticate the merchant process. The authentication of the merchant process in this case is based on the premise that the test pattern B encrypted with the service provider's public key can be decrypted only by the service providing system having the service provider's private key.
Furthermore, the credit settlement terminal decrypts the cipher of the session permission message with the merchant's private key, and changes the communication condition with the merchant process to the communication condition of the session permission message.
Through the above processing, the credit settlement terminal and the merchant process mutually authenticate each other and communicate based on the common communication conditions, thereby establishing a session establishment state (session establishment 4809).

When connecting from the service providing system to the credit settlement terminal, first, the service providing system 102 calls the credit settlement terminal 300 to connect the line (line connection 4905). At this time, in the service providing system 102, the service manager process generates a merchant process corresponding to the credit payment terminal connecting the line (process generation 4900), and the generated merchant process is digitally transmitted to the digital public network 108. A message requesting telephone line connection and a call request 4901 are transmitted, and the digital public network 108 transmits a message for calling a credit settlement terminal and an incoming call request 4902 to the credit settlement terminal. On the other hand, the credit settlement terminal transmits a call permission message and an incoming call response 4903 to the digital public network, and the digital public network transmits a line connection permission message and a call response 4904 to the merchant process. The merchant process and the credit settlement terminal are connected by a line (line connection 4905). At this time, messages such as a call request 4901, a call request 4902, a call response 4903, and a call response 4904 exchanged between the merchant process and the digital public network and between the digital public network and the credit settlement terminal are digital communication. It depends on the line connection protocol via the line 109, the digital public network 108, and the digital telephone communication line 110.
When the line between the merchant process and the credit settlement terminal is connected (line connection 4905), the credit settlement terminal generates a test message for authenticating the merchant process, an authentication test C4906, and transmits it to the merchant process.

As shown in FIG. 81 (d), the authentication test C4906 discloses the header information indicating that the message is the authentication test C4906, the authentication test C header 5011, and a test pattern C5012 which is an arbitrary bit pattern to the public of the service provider. It consists of 5013 encrypted with a key.
The merchant process receives the authentication test C4906, decrypts the cipher of the test pattern C with the private key of the service provider, and is a response message to the authentication test C4906 and a test message for authenticating the credit payment terminal. A certain authentication test C response 4907 is generated and transmitted to the credit settlement terminal.
As shown in FIG. 81 (e), the authentication test C response 4907 includes header information indicating that the message is the authentication test C response 4907, an authentication test C response header 5014, a test pattern C5015 obtained by decrypting the encryption, The test pattern D5016, which is an arbitrary bit pattern, is encrypted with the merchant's public key 5017. That is, the authentication test C response 4907 includes an authentication test D for authenticating the credit settlement terminal corresponding to the authentication test C for the test pattern C.
The credit settlement terminal receives the authentication test C response 4907, and compares the test pattern C5012 with the received test pattern C5015 to authenticate the merchant process. The authentication of the merchant process in this case is based on the premise that the test pattern C encrypted with the service provider's public key can be decrypted only by the service providing system having the service provider's private key.
The credit settlement terminal further decrypts the encryption of the test pattern D with the merchant's private key, generates a response message for the authentication test D and an authentication test D response 4908, and transmits the response message to the merchant process.

As shown in FIG. 81 (f), the authentication test D response 4908 includes header information indicating that the message is the authentication test D response 4908, an authentication test D response header 5018, and a test pattern D5019 obtained by decrypting the cipher. The session permission message 5020 is encrypted with the service provider's public key 5021. The session permission message 5020 is a message for permitting a session with the merchant process, and includes information on communication conditions.
The merchant process receives the authentication test D response 4908 and compares the test pattern D5016 with the received test pattern D5019 to authenticate the credit card payment terminal. The authentication of the credit payment terminal in this case is based on the premise that the test pattern D encrypted with the merchant's public key can be decrypted only by the credit payment terminal having the merchant's private key.
The merchant process further decrypts the encryption of the session permission message with the private key of the service provider, and changes the communication condition with the credit settlement terminal to the communication condition of the session permission message.
Through the above processing, the merchant process and the credit settlement terminal mutually authenticate each other and communicate on the basis of common communication conditions, thereby establishing a session establishment state (session establishment 4909).

Next, the contents of messages exchanged between the personal credit terminal 100 and the credit settlement terminal 300 with the service providing system 102 in the remote access process will be described. The remote access process is a process of downloading data from the service providing system 102 when attempting to access data existing at a remote address. Hereinafter, this process is referred to as a remote access process.
82 (a) shows the procedure of remote access processing by the personal credit terminal 100, and FIGS. 83 (a) and 83 (b) show the contents of messages exchanged between the personal credit terminal 100 and the user process. Show. If the data to be accessed exists at the remote address, the personal credit terminal 100 generates a remote access process and starts the remote access process. First, a session with the service providing system 102 is established, and a message requesting data to the user process of the service providing system 102, a remote access request 5100, is generated and transmitted to the user process.
As shown in FIG. 83 (a), the remote access request 5100 includes header information indicating that the message is a remote access request 5100, a remote access request header 5200, a data address 5201 indicating a remote address, a user ID 5202, The data including the issue date 5203 indicating the date when this remote access request 5100 was issued is digitally signed by the user 5204 and sealed to the service provider.
The user process of the service providing system 102 receives the remote access request 5100, decrypts the encryption, checks the digital signature, and generates a message to send the requested data to the personal credit terminal 100, remote access data 5101. To the personal credit terminal 100.

As shown in FIG. 83 (b), the remote access data 5101 includes header information indicating that the message is remote access data 5101, a remote access data header 5208, requested data 5209, a service provider ID 5210, The data including the issue date and time 5211 indicating the date and time when the remote access data 5101 is issued is digitally signed by the service provider and sealed to the user.
The personal credit terminal 100 receives the remote access data 5101, decrypts the encryption, checks the digital signature, stores it in the temporary area, and accesses the data.
Similarly, FIG. 85 (a) shows the procedure of remote access processing by the credit settlement terminal 300, and FIGS. 86 (a) and 86 (b) show the contents of messages exchanged between the credit settlement terminal 300 and the merchant process. Is shown. When the data to be accessed exists at the remote address, the credit card payment terminal 300 generates a remote access process and starts the remote access process. First, a session with the service providing system 102 is established, and a message for requesting data to the merchant process of the service providing system 102, a remote access request 5400, is generated and transmitted to the merchant process.

As shown in FIG. 86 (a), the remote access request 5400 includes header information indicating that the message is a remote access request 5400, a remote access request header 5500, a data address 5501 indicating a remote address, a merchant ID 5502, The data including the date and time of issue 5503 indicating the date and time when this remote access request 5400 is issued is digitally signed by the merchant 5504 and sealed to the service provider.
The merchant process of the service providing system 102 receives the remote access request 5400, decrypts the encryption, checks the digital signature, generates a message to send the requested data to the credit payment terminal 300, remote access data 5401, Send to credit payment terminal 300.
As shown in FIG. 86 (b), the remote access data 5401 includes header information indicating that the message is remote access data 5401, a remote access data header 5508, requested data 5509, a service provider ID 5510, The data including the issue date 5511 indicating the date when this remote access data 5401 was issued is digitally signed by the service provider and sealed to the merchant.
The credit settlement terminal 300 receives the remote access data 5401, decrypts the encryption, checks the digital signature, stores it in the temporary area, and accesses the data.
Next, the contents of messages exchanged between the personal credit terminal 100 and the credit settlement terminal 300 with the service providing system 102 in the data update process will be described. The data update process is a process in which the service providing system updates the contents of the RAM 1502 of the personal credit terminal 100 or the RAM 22502 and the hard disk 22503 of the credit settlement terminal. Hereinafter, this process is referred to as a data update process.

FIG. 82 (b) shows the data update processing procedure in the personal credit terminal 100. FIGS. 83 (c) to 83 (f) and FIG. 84 (a) show the relationship between the personal credit terminal 100 and the service providing system 102. The contents of messages exchanged between them are shown.
When the value of the clock counter matches the update time register, the personal credit terminal 100 generates a data update process and starts the data update process. First, the personal credit terminal 100 establishes a session with the service providing system 102, generates a message for requesting data update processing to the user process of the service providing system 102, a data update request 5102, and transmits it to the user process. .
As shown in FIG. 83 (c), the data update request 5102 includes header information indicating that the message is the data update request 5102, a data update request header 5216, a user ID 5217, and the date and time when this data update request 5102 is issued. The data including the issue date and time 5218 indicating the digital signature of the user is digitally signed and sealed to the service provider.
The user process of the service providing system 102 receives the data update request 5102, decrypts the encryption, checks the digital signature, generates a message indicating that the request is ready, a data update response 5103, and・ Send to credit terminal 100.

As shown in FIG. 83 (d), the data update response 5103 issues header information indicating that the message is the data update response 5103, a data update response header 5223, a service provider ID 5224, and this data update response 5103. The data including the issue date and time 5225 indicating the date and time when the service is performed is digitally signed by the service provider and sealed to the user.
The personal credit terminal 100 receives the data update response 5103, decrypts the encryption, checks the digital signature, generates a message for uploading the data in the RAM 1502 to the service providing system 102, and upload data 5104, and provides the service providing system. Send to.
As shown in FIG. 83 (e), upload data 5104 includes header information indicating that the message is upload data 5104, upload data header 5230, data obtained by compressing data in RAM 1502, terminal data 5231, and user ID 5232. The data including the issue date and time 5233 indicating the date and time when the upload data 5104 is issued is digitally signed by the user and sealed to the service provider.
The user process of the service providing system 102 receives the upload data 5104, decrypts the encryption, and checks the digital signature. Then, the compressed terminal data 5231 is decompressed and collated with the terminal data 24006 on the user information server 402 and data managed by the other user data management information 24000.
Then, new terminal data is generated, a message for updating the data of the personal credit terminal 100 and update data 5105 are generated and transmitted to the personal credit terminal 100.
As shown in FIG. 83 (f), the update data 5105 includes header information indicating that the message is update data 5105, an update data header 5238, data obtained by compressing new terminal data, terminal data 5239, and a service provider. Data consisting of an ID 5240 and an issue date 5241 indicating the date when this update data 5105 was issued is digitally signed by the service provider and sealed to the user.
The personal credit terminal 100 receives the update data 5105, decrypts the encryption, checks the digital signature, decompresses the compressed terminal data 5239, and updates the data in the RAM 1502.

The user process of the service providing system 102 compares the access time of each credit card when the capacity of the actual data area 21812 is not enough in the generation of new terminal data. A local address is assigned to the data address, the usage times of the usage information are compared, and the local address is assigned to the usage information address of the usage information with the latest usage time. When the personal credit terminal program needs to be upgraded, the data in the basic program area is updated.
In addition, when the user process of the service providing system 102 compares the upload data with the terminal data, if an unauthorized alteration of the data is found, the function of the personal credit terminal 100 is used instead of the update data 5105. A function stop command 5105 ′ is generated and transmitted to the personal credit terminal 100.
As shown in FIG. 84 (a), the function stop command 5105 ′ includes header information indicating that the message is a function stop command 5105 ′, a function stop command header 5300, a service provider ID 5301, and this function stop command 5105. Data consisting of an issue date and time 5302 indicating the date and time when 'is issued is a digital signature of the service provider and sealed to the user.
In this case, the personal credit terminal 100 that has received the function stop command 5105 ′ decrypts the encryption, checks the digital signature, changes the terminal status 21902 to “unusable”, and becomes unusable.
This data update process stores relatively frequently used information in the personal credit terminal RAM, keeps the personal credit terminal program up-to-date, and illegally alters the terminal data. Is prevented.
Similarly, FIG. 85 (b) shows the procedure of data update processing in the credit settlement terminal 300. FIGS. 86 (c) to 86 (f) and FIG. 84 (a) show the credit settlement terminal 300, the service providing system 102, Shows the contents of messages exchanged between.

When the value of the clock counter matches the update time register, the credit settlement terminal 300 generates a data update process and starts data update processing. The credit settlement terminal 300 first establishes a session with the service providing system 102, generates a message for requesting data update processing from the merchant process of the service providing system 102, a data update request 5402, and transmits the message to the merchant process.
As shown in FIG. 86 (c), the data update request 5402 includes header information indicating that the message is a data update request 5402, a data update request header 5516, a merchant ID 5517, and the date and time when this data update request 5402 is issued. The data consisting of the issue date and time 5518 indicating the merchant is digitally signed by the merchant and sealed to the service provider.
The merchant process of the service providing system 102 receives the data update request 5402, decrypts the encryption, checks the digital signature, generates a message indicating that the request is ready, a data update response 5403, Send to payment terminal 300.

As shown in FIG. 86 (d), the data update response 5403 issues header information indicating that the message is a data update response 5403, a data update response header 5523, a service provider ID 5524, and this data update response 5403. The data including the issue date and time 5525 indicating the date and time of execution is digitally signed by the service provider and sealed to the merchant.
The credit settlement terminal 300 receives the data update response 5403, decrypts the encryption, checks the digital signature, generates a message for uploading the data in the RAM 22502 and the hard disk 22503 to the service providing system 102, the upload data 5404, Send to the service delivery system.

As shown in FIG. 86 (e), upload data 5404 includes header information indicating that the message is upload data 5404, upload data header 5530, data obtained by compressing data in RAM 22502 and hard disk 22503, and terminal data 5531. The data consisting of the merchant ID 5532 and the issue date 5533 indicating the date when the upload data 5404 was issued is digitally signed by the merchant and sealed to the service provider.
The merchant process of the service providing system 102 receives the upload data 5404, decrypts the encryption, and checks the digital signature. Then, the compressed terminal data 5531 is decompressed and collated with the terminal data 24104 on the merchant information server 403 and data managed by the other merchant data management information 24100.
Then, new terminal data is generated, a message for updating the data of the credit settlement terminal 300 and update data 5405 are generated and transmitted to the credit settlement terminal 300.

As shown in FIG. 86 (f), the update data 5405 includes header information indicating that the message is update data 5405, an update data header 5538, data obtained by compressing new terminal data, terminal data 5539, and a service provider. Data consisting of an ID 5540 and an issue date 5541 indicating the date when this update data 5405 was issued is digitally signed by the service provider and sealed to the merchant.
The credit settlement terminal 300 receives the update data 5405, decrypts the encryption, checks the digital signature, decompresses the compressed terminal data 5539, and updates the data in the RAM 22502 and the hard disk 22503.
The merchant process of the service providing system 102 compares the use times of the sales information when the capacity of the hard disk 22503 of the credit card payment terminal is not sufficient in generating new terminal data, Assign a local address to the sales information address. If the credit settlement terminal program needs to be upgraded, the data in the basic program area is updated.
In addition, the merchant process of the service providing system 102, when checking the uploaded data and the terminal data, detects the function of the credit settlement terminal 300 instead of the update data 5405 when an unauthorized alteration of the data is detected. A message to be stopped and a function stop command 5405 ′ are generated and transmitted to the credit settlement terminal 300.

As shown in FIG. 87A, the function stop command 5405 ′ includes header information indicating that the message is a function stop command 5405 ′, a function stop command header 5600, a service provider ID 5601, and the function stop command 5405. The data consisting of the issue date and time 5602 indicating the date and time when 'is issued is a digital signature of the service provider and sealed to the merchant.
In this case, the credit settlement terminal 300 that has received the function stop command 5405 ′ decrypts the encryption, checks the digital signature, changes the terminal status 22902 to “unusable”, and becomes unusable.
This data update process stores relatively frequently used information in the RAM and hard disk of the credit card settlement terminal, keeps the credit card terminal program in the latest version, and corrects terminal data fraud. Tampering is prevented.

Next, the contents of messages exchanged between the personal credit terminal 100 and the credit settlement terminal 300 with the service providing system 102 in the forced data update process will be described. The compulsory data update process is performed when the service providing system forcibly updates the contents of the RAM 1502 of the personal credit terminal 100 or the contents of the RAM 22502 and the hard disk 22503 of the credit settlement terminal. It is a process to update. Hereinafter, this process is referred to as a forced data update process.
FIG. 82 (c) shows the procedure of compulsory data update processing in the personal credit terminal 100. FIGS. 83 (e) and 83 (f) and FIGS. The contents of messages exchanged with the service providing system 102 are shown.
The service providing system 102 first establishes a session with the personal credit terminal 100 when it is necessary to quickly update the RAM data of the personal credit terminal 100, such as when there is a change in the contract contents with the user. Then, a message for instructing the personal credit terminal 100 to perform forced data update processing, a data update instruction 5106, is generated and transmitted to the personal credit terminal 100.

As shown in FIG. 84 (b), the data update command 5106 issues header information indicating that the message is the data update command 5106, a data update command header 5307, a service provider ID 5308, and this data update command 5106. The data including the issue date and time 5309 indicating the date and time when the service is performed is digitally signed by the service provider and sealed to the user.
The personal credit terminal 100 receives the data update instruction 5106, decrypts the encryption, checks the digital signature, generates a forced data update process, and starts the forced data update process. First, the personal credit terminal 100 generates a message for uploading data in the RAM 1502 to the service providing system 102, and upload data 5107, and transmits it to the service providing system.
The user process of the service providing system 102 receives the upload data 5107, decrypts the encryption, and checks the digital signature. Then, the compressed terminal data 5231 is decompressed and collated with the terminal data 24006 on the user information server 402.
Then, new terminal data is generated, a message for updating the data of the personal credit terminal 100 and update data 5108 are generated and transmitted to the personal credit terminal 100.

The personal credit terminal 100 receives the update data 5108, decrypts the encryption, checks the digital signature, decompresses the compressed terminal data 5239, and updates the data in the RAM 1502.
In addition, when the user process of the service providing system 102 collates the upload data with the terminal data, if an unauthorized alteration of the data is detected, the function of the personal credit terminal 100 is used instead of the update data 5108. Is generated and a function stop command 5108 ′ is generated and transmitted to the personal credit terminal 100.
In this case, the personal credit terminal 100 that has received the function stop instruction 5108 ′ decrypts the encryption, checks the digital signature, changes the terminal status 21902 to “unusable”, and becomes unusable.
Similarly, FIG. 85 (c) shows the procedure of the compulsory data update process in the credit settlement terminal 300. FIGS. 86 (e) and (f) and FIGS. 87 (a) and 87 (b) show the credit settlement terminal 300. The contents of messages exchanged between the service provider system 102 and the service providing system 102 are shown.
When the service providing system 102 needs to immediately update the RAM and hard disk data of the credit settlement terminal 300, such as when there is a change in the contract with the merchant, the service providing system 102 first establishes a session with the credit settlement terminal 300. A message for instructing the credit settlement terminal 300 to perform forced data update processing, a data update instruction 5406, is generated and transmitted to the credit settlement terminal 300.

As shown in FIG. 84B, the data update command 5406 issues header information indicating that the message is the data update command 5406, a data update command header 5607, a service provider ID 5608, and this data update command 5406. The data consisting of the issue date and time 5609 indicating the date and time when the service is performed is digitally signed by the service provider and sealed to the merchant.
The credit settlement terminal 300 receives the data update instruction 5406, decrypts the encryption, checks the digital signature, generates a forced data update process, and starts the forced data update process. First, the credit settlement terminal 300 generates a message and upload data 5407 for uploading the RAM and hard disk data to the service providing system 102 and transmits them to the service providing system.
The merchant process of the service providing system 102 receives the upload data 5407, decrypts the encryption, and checks the digital signature. Then, the compressed terminal data 5531 is decompressed and collated with the terminal data 24104 on the merchant information server 403.
Then, new terminal data is generated, a message for updating the data of the credit settlement terminal 300 and update data 5408 are generated and transmitted to the credit settlement terminal 300.

The credit settlement terminal 300 receives the update data 5408, decrypts the encryption, checks the digital signature, decompresses the compressed terminal data 5539, and updates the data in the RAM and the hard disk.
In addition, the merchant process of the service providing system 102 can check the function of the credit settlement terminal 300 instead of the update data 5408 if an unauthorized alteration of the data is detected when the uploaded data is compared with the terminal data. A message to be stopped and a function stop command 5408 ′ are generated and transmitted to the credit settlement terminal 300.
In this case, the credit settlement terminal 300 that has received the function stop command 5408 ′ decrypts the encryption, checks the digital signature, changes the terminal status 22902 to “unusable”, and enters the unusable state.

Next, the contents of messages exchanged between the personal credit terminal 100 and the service providing system in the data backup process will be described. The data backup process is a process for automatically backing up the contents of the RAM 1502 to the user information server of the service providing system when the battery of the personal credit terminal 100 is low. Hereinafter, this process is referred to as a data backup process.
FIG. 82 (d) shows the procedure of data backup processing in the personal credit terminal 100. FIGS. 83 (c) to 83 (f) and FIG. 87 (a) show the relationship between the personal credit terminal 100 and the service providing system 102. The contents of messages exchanged between them are shown. The data backup process is performed in almost the same procedure as the data update process. However, in the data backup process, the personal credit terminal 100 receives the update data 5112, updates the data in the RAM 1502, changes the terminal status 21902 of the personal credit terminal 100 to “not writable”, and Until the battery capacity is sufficient, the input of new data to the RAM is prohibited.
When the battery capacity becomes Q or less, the personal credit terminal 100 generates a data backup process and starts the data backup process. First, the personal credit terminal 100 establishes a session with the service providing system 102, generates a message for requesting data update processing from the user process of the service providing system 102, a data update request 5109, and transmits the message to the user process. .
The user process of the service providing system 102 receives the data update request 5109, decrypts the encryption, checks the digital signature, generates a message indicating that the request is ready, a data update response 5110, and・ Send to credit terminal 100.
The personal credit terminal 100 receives the data update response 5110, decrypts the encryption, checks the digital signature, generates a message for uploading the data in the RAM 1502 to the service providing system 102, and upload data 5111, and sends it to the service providing system. Send.
The user process of the service providing system 102 receives the upload data 5111, decrypts the encryption, and checks the digital signature. Then, the compressed terminal data 5231 is decompressed and collated with the terminal data 24006 on the user information server 402.
Then, new terminal data is generated, a message for updating the data of the personal credit terminal 100 and update data 5112 are generated and transmitted to the personal credit terminal 100.

The personal credit terminal 100 receives the update data 5112, decrypts the encryption, checks the digital signature, decompresses the compressed terminal data 5239, and updates the data in the RAM 1502. Further, the terminal status 21902 is changed to “not writable”, and the input of new data to the RAM is prohibited until the battery capacity becomes sufficient.
In addition, when the user process of the service providing system 102 collates the upload data with the terminal data, if an unauthorized alteration of the data is found, the function of the personal credit terminal 100 is used instead of the update data 5112. Is generated and a function stop command 5112 ′ is generated and transmitted to the personal credit terminal 100.
In this case, the personal credit terminal 100 that received the function stop command 5112 ′ decrypts the encryption, checks the digital signature, changes the terminal status 21902 to “unusable” and “unwritable”, and cannot be used. It becomes a state.

Next, the contents of messages exchanged between devices in the “settlement” process will be described.
FIG. 88 shows a procedure for exchanging messages between devices in the “settlement” process, and FIGS. 89 (a) to 89 (f), FIGS. , The contents of messages exchanged between devices in the “settlement” process. FIG. 88 is a diagram in which a part of a message exchanged between devices is extracted from FIG. 43, and FIGS. 88 and 43 show the same “settlement” process.
First, when the merchant presses the credit settlement switch of the register 20604, the credit settlement terminal 300 generates a settlement process and starts the “settlement” process. The credit settlement terminal 300 generates a plurality of types of payment offer responses 5701 (20609), and waits for a payment offer 5700 to be received.
Next, when the user performs a payment operation 20607, the personal credit terminal 100 generates a payment process and starts the process of “settlement”. The personal credit terminal 100 generates a payment offer 5700 (20608) and transmits it to the credit settlement terminal 300 by infrared communication.

As shown in FIG. 89 (a), the payment offer 5700 includes a transaction with a header information indicating that the message is a payment offer 5700, a payment offer header 5800, a service code 5801, a service provider ID 5802, and a merchant. Request number 5803 arbitrarily generated as a unique number, payment amount 5804 entered by the user, payment option code 5805 indicating the payment option entered by the user, validity period 5806 of this payment offer 20608, and this payment offer A user's digital signature is applied to data consisting of an issue date and time 5807 indicating the date and time when 20608 is issued.
The credit settlement terminal 300 receives the payment offer 5700, collates the payment amount with the invoiced amount, and collates whether the payment option 5805 is an available option. From this, an appropriate payment offer response 5701 is selected and transmitted to the personal credit terminal 100 by infrared communication, and further, a credit inquiry request 5702 (20610) is generated, and the merchant process of the service providing system 102 is performed by digital telephone communication. Send to.

  As shown in FIG. 89 (b), the payment offer response 5701 includes header information indicating that the message is a payment offer response 5701, a payment offer response header 5808, and the personal credit terminal 100 has received the payment offer response 5701. A response message 5809 displayed on the LCD 203, a transaction number 5810 arbitrarily generated as a number uniquely indicating a transaction with the user, a billing amount 5811, and a service indicating the telephone number of the service providing system in the merchant service area The merchant's digital signature on the data consisting of the provider telephone number 5812, the validity period 5813 of this payment offer response 5701, the merchant ID 5814, and the issue date 5815 indicating the date and time when this payment offer response 5701 was issued It is. The service provider telephone number 5812 is digitally signed by the service provider, and the response message 5809 is a text message set in the merchant option and may not be set.

As shown in FIG. 89 (c), the credit inquiry request 5702 includes header information indicating that the message is a credit inquiry request 5702, a credit inquiry request header 5816, a payment offer 5700, a payment offer response 5701, and a person in charge. Data consisting of a name 5817, a merchant ID 5818, and an issuance date and time 5819 indicating the date and time when this credit inquiry request 5702 is issued is digitally signed by the merchant and sealed to the service provider. The person-in-charge name 5817 is information set by the merchant option, and may not be set.
On the other hand, the personal credit terminal 100 receives the payment offer response 5701, compares the payment amount 5804 with the billing amount 5811, generates a payment request 5703 (20613), and provides the service providing system 102 by digital wireless telephone communication. To the user process.
As shown in FIG. 89 (d), the payment request 5703 includes header information indicating that the message is a payment request 5703, a payment request header 5824, a payment offer 5700, a payment offer response 5701, a user ID 5825, Data consisting of an issue date and time 5826 indicating the date and time when the payment request 5703 is issued is digitally signed by the user and sealed to the service provider.
The transmission of the credit inquiry request 5702 by the credit settlement terminal 300 to the merchant process and the transmission of the payment request 5703 by the personal credit terminal to the user process may be performed first or at the same time.

  The merchant process and the user process of the service providing system 102 receive the credit reference request 5702 and the payment request 20613, respectively, decrypt the encryption, check the digital signature, and check the credit reference request 5820 and the payment request 5827, respectively. To the service manager process. The service manager process compares the request number, the transaction number, and the merchant ID to establish a correspondence between the credit inquiry request and the payment request, and generates a service director process to generate the credit inquiry request 5820 and the payment request 5827. Generate a process group to process The service director process matches the contents of the credit inquiry request 5702 and the payment request 5700, performs the user's credit inquiry, generates a credit inquiry response 5840, and the merchant process seals it to the merchant and credits it. An inquiry response 5704 (20614) is transmitted to the credit settlement terminal 300 by digital telephone communication.

As shown in FIG. 89 (e), the credit inquiry response 5704 uniquely indicates header information indicating that the message is the credit inquiry response 5704, the credit inquiry response header 5831, the transaction number 5832, and the processing of the credit inquiry. An inquiry number 5833 arbitrarily generated as a number, an inquiry result 5834 indicating the result of a credit inquiry, user personal data 5835 comprising user name, user age information, and user face photo data, and merchant Data consisting of a customer number 5836 that uniquely identifies the user, a validity period 5837 that indicates the validity period of this credit inquiry response 5704, a service provider ID 5838, and an issue date and time 5839 that indicates the date and time when this credit inquiry response 5704 was issued , Digitally signed by the service provider and sealed to the merchant. If there is a problem with the credit status of the user as a result of the credit inquiry, the user personal information 5834 is not set, and the customer number 5836 is previously set between the user and the merchant in the personal remote credit settlement service. Set when there is a transaction.
The credit settlement terminal 300 receives the credit inquiry response 5704, decrypts the encryption, checks the digital signature, and displays the result of the credit inquiry on the LCD 302.

Next, when the person in charge of the merchant performs a settlement processing request operation 20616, the credit settlement terminal 300 generates a settlement request 5705 (20618) and transmits it to the merchant process by digital telephone communication.
As shown in FIG. 89 (f), the payment request 5705 includes header information indicating that the message is a payment request 5705, a payment request header 5844, a payment offer 5700, a payment offer response 5701, and a service providing system 102. About the data consisting of the issued reference number 5845, the validity period 5846 indicating the validity period of this settlement request 5705, the person in charge 5847, the merchant ID 5848, and the issuance date and time 5849 indicating the date and time when this settlement request 5705 was issued, The merchant digitally signed and sealed to the service provider. The person-in-charge name 5847 is information set by the merchant option, and may not be set.
The merchant process of the service providing system 102 receives the payment request 5705, decrypts the encryption, checks the digital signature, and sends a payment request message to the service director process. The service director process collates the contents of the payment request 5705 and the payment request 5700 to generate a payment request 5906 for the payment processor, and the payment processor process seals this to the payment processor, 5706 (20619) is transmitted to the settlement system.

As shown in FIG. 90A, the payment request 5706 includes header information indicating that the message is a payment request 5706, a payment request header 5900, a credit card number 5901 corresponding to the service code specified by the user, Request number 5902 issued by the credit terminal 100, payment amount 5903, payment option code 5904, merchant account number 5905 indicating the merchant account number, transaction number 5906 issued by the credit settlement terminal 300, and this settlement The data of the validity period 5907 indicating the validity period of the request 5706, the service provider ID 5908, and the issue date 5909 indicating the date and time when this settlement request 5706 is issued is digitally signed by the service provider and addressed to the settlement processing organization. It is a sealed letter.
The settlement system 103 receives the settlement request 5706, decrypts the encryption, checks the digital signature, and performs the settlement process. Then, a payment completion notification 5707 (20620) is generated and transmitted to the service providing system 102.

As shown in FIG. 90 (b), the payment completion notification 5707 is arbitrarily set as header information indicating that the message is the payment completion notification 5707, a payment completion notification header 5914, and a number uniquely indicating the payment processing of the payment system 103. Generated payment number 5915, credit card number 5916, request number 5917, payment amount 5918, payment option code 5919, merchant account number 5920, transaction number 5921, and digitally signed service of the payment processor Payment information 5922 for providers, payment information 5923 for merchants with a digital signature of the payment processor, payment information 5924 for users with a digital signature of the payment processor, payment processor ID 5925, and this payment completion notification The data consisting of the issue date and time 5926 indicating the date and time of It is obtained by sealed letter of addressed to providers.
The payment processing organization process of the service providing system 102 receives the payment completion notification 5707, decrypts the encryption, checks the digital signature, and sends a payment completion notification 5927 to the service director process. The service director process generates a payment completion notification 5937 for the merchant from the payment completion notification 5927. Send to credit payment terminal 300.

As shown in FIG. 90 (c), the payment completion notification 5708 includes header information indicating that the message is a payment completion notification 5708, a payment completion notification header 5931, a payment number 5932, and a digital signature of the payment processing organization. Service information indicating merchant payment information 5923, a number generated as a number that uniquely identifies the user to the merchant, a customer number 5933, a payment request 5850 obtained by decrypting the encryption, and information related to processing in the service providing system 102 Service provider information 5934, service provider ID 5935, and issuance date and time 5936 indicating the date and time when this settlement completion notice 5708 was issued is digitally signed by the service provider and sealed to the merchant. . The service provider processing information 5934 is information set as an option of the service provider, and may not be set.
The credit payment terminal 300 receives the payment completion notification 5708, decrypts the encryption, checks the digital signature, generates a receipt 5709 (20622), and transmits it to the merchant process by digital telephone communication.

As shown in FIG. 91A, the receipt 5709 includes header information indicating that the message is the receipt 5709, a receipt header 6000, a product name 6001 indicating the name of the sold product, and the merchant to the user. Sales information 6002 indicating additional information on the transaction of the transaction, transaction number 6003, transaction number 6004, payment offer 5700, contact person name 6005, merchant ID 6006, and issue date and time 6007 indicating the date and time when this receipt 5709 was issued Is a digital signature of the merchant and sealed to the service provider. The sales information 6002 and the person in charge name 6005 are information set by the merchant option and may not be set.
The merchant process of the service providing system 102 receives the receipt 5709, decrypts the cipher, checks the digital signature, and sends the receipt 6008 to the service director process. The service director process generates a receipt 6016 for the user from the receipt 6008. The user process seals the receipt 6016 to the user. The receipt 5710 (20624) is used as a personal credit terminal by digital wireless telephone communication. Send to 100.
As shown in FIG. 91 (b), the receipt 5710 includes header information indicating that the message is the receipt 5710, a receipt header 6012, a receipt 6008 obtained by decrypting the encryption, and a digital signature of the payment processing organization. Data including payment information 5924 for the user who has performed, service provider processing information 6013 indicating information related to processing in the service providing system 102, service provider ID 6014, and issue date 6015 indicating the date and time when this receipt 5710 was issued The service provider is digitally signed and sealed to the user. The service provider processing information 6013 is information set as an option of the service provider, and may not be set.
The personal credit terminal 100 receives the receipt 5710, decrypts the encryption, checks the digital signature, and displays the content on the LCD 203.

Next, contents of messages exchanged between devices in the “cancel” process will be described.
FIG. 92 shows the procedure for exchanging messages between devices in the “cancel” process, and FIGS. 93A to 93F show the contents of messages exchanged between devices in the “cancel” process. . FIG. 92 is a diagram in which a part of a message exchanged between devices is extracted from FIG. 9, and FIGS. 92 and 9 show the same “cancel” processing.
First, when the person in charge of the merchant performs a cancel operation 901, the credit settlement terminal 300 generates a cancel process and starts a “cancel” process. The credit settlement terminal 300 generates a cancellation request 6100 (903) from the settlement completion notification of the transaction to be canceled and transmits it to the merchant process of the service providing system 102 by digital telephone communication.
On the other hand, when the user performs a cancel operation 904, the personal credit terminal 100 generates a cancel process and starts a “cancel” process. The personal credit terminal 100 generates a cancel request 6101 (906) from the receipt of the transaction to be canceled, and transmits it to the user process of the service providing system 102 by digital wireless telephone communication.

As shown in FIG. 93A, the cancel request 6100 includes header information indicating that the message is a cancel request 6100, a cancel request header 6200, a settlement completion notification 5937 obtained by decrypting the cipher, and the cancel request 6100. Digitally sign the merchant for the data consisting of the validity period 6201 indicating the validity period, the person in charge name 6202, the merchant ID 6203, and the issue date and time 6204 indicating the date and time when this cancel request 6100 was issued, and addressed to the service provider It is a sealed letter. The person-in-charge name 6216 is information set as a merchant option, and may not be set.
Also, as shown in FIG. 93 (b), the cancel request 6101 includes header information indicating that the message is a cancel request 6101, a cancel request header 6209, a receipt 6016 obtained by decrypting the cipher, and the cancel request 6101. The data consisting of the validity period 6210 indicating the validity period of the user, the user ID 6121, and the issue date 6122 indicating the date and time when the cancel request 6101 is issued is digitally signed by the user and sealed to the service provider. is there.
Either the transmission of the cancellation request 6100 by the credit settlement terminal 300 to the merchant process or the transmission of the cancellation request 6101 by the personal credit terminal to the user process may be performed first or at the same time.
The merchant process and the user process of the service providing system 102 receive the cancel request 6100 and the cancel request 6101 respectively, decrypt the encryption, check the digital signature, and service the cancel request 6205 and the cancel request 6213, respectively. Send to manager process. The service manager process compares the request number, the transaction number, and the merchant ID, takes a correspondence between the cancel request 6205 and the cancel request 6213, generates a service director process, and generates the cancel request 6205 and the cancel request 6213. Generate a process group to process The service director process collates the contents of the cancellation request 6205 and the cancellation request 6213 to generate a cancellation request 6221 for the payment processing institution, and the payment processing institution process seals this to the payment processing institution and performs the payment processing. This is transmitted to the settlement system 103 as a cancel request 6102 (907) to the institution.

As shown in FIG. 93 (c), the cancel request 6102 includes header information indicating that the message is a cancel request 6102, a cancel request header 6217, a settlement completion notification 5927 obtained by decrypting the cipher, and the cancel request 6102. The data consisting of the validity period 6218 indicating the validity period, the service provider ID 6219, and the issue date 6220 indicating the date and time when this cancellation request 6102 was issued is digitally signed by the service provider and sealed to the payment processing organization. It is a thing.
The settlement system 103 receives the cancel request 6102, decrypts the encryption, checks the digital signature, and performs a cancel process. Then, a cancellation completion notification 6103 (908) is generated and transmitted to the payment processing organization process of the service providing system 102.

  As shown in FIG. 93 (d), the cancellation completion notification 6103 includes header information indicating that the message is a cancellation completion notification 6103, a cancellation completion notification header 6225, and a number uniquely indicating the cancellation processing performed by the payment system 103. Cancellation number 6226, cancellation request 6221 for decrypting the cipher, cancellation information 6227 for the service provider with the digital signature of the payment processing organization, cancellation information 6228 for the merchant with the digital signature of the payment processing organization, and the payment processing organization A digital signature of the payment processing institution is made on the data consisting of the cancellation information 6229 for the user with the digital signature, the payment processing institution ID 6230, and the issuance date and time 6231 indicating the date and time when this payment completion notice is issued. It is a sealed letter.

  The payment processing organization process of the service providing system 102 receives the cancellation completion notification 6103, decrypts the encryption, checks the digital signature, and sends a cancellation completion notification 6132 to the service director process. The service director process generates a cancellation completion notification 6241 and a cancellation processing receipt 6250 from the cancellation completion notification 6132. The merchant process seals the cancellation completion notification 6241 to the merchant and sends it to the credit settlement terminal 300 as a cancellation completion notification 6104 (909), and the user process seals and cancels the cancellation processing receipt 6250 to the user. The processing receipt 6105 (910) is transmitted to the personal credit terminal 100.

  As shown in FIG. 93 (e), the cancellation completion notification 6104 includes header information indicating that the message is the cancellation completion notification 6104, a cancellation completion notification header 6236, a cancellation number 6237, and a cancellation request 6205 for decrypting the encryption. The payment information 6228 for the merchant who has digitally signed the payment processing organization, the service provider processing information 6238 indicating information related to processing in the service providing system, the service provider ID 6239, and the date and time when this cancellation completion notification 6104 was issued. The data including the issue date and time 6240 shown is digitally signed by the service provider and sealed to the merchant. The service provider processing information 6238 is information set as an option of the service provider and may not be set.

As shown in FIG. 93 (f), the cancellation processing receipt 6105 has decrypted the header information indicating that the message is the cancellation processing receipt 6105, the cancellation processing receipt header 6245, the cancellation number 6246, and the encryption. A cancellation request 6213, payment information 6229 for the user digitally signed by the payment processing institution, service provider processing information 6247 indicating information related to processing in the service providing system, service provider ID 6248, and this cancellation processing receipt 6105 Data consisting of an issue date 6249 indicating the date of issue is digitally signed by the service provider and sealed to the user. The service provider processing information 6247 is information set as an option of the service provider, and may not be set.
The credit settlement terminal 300 receives the cancellation completion notification 6104, decrypts the encryption, checks the digital signature, and displays the contents on the LCD 302. On the other hand, the personal credit terminal 100 also receives the cancellation processing receipt 6105, decrypts the encryption, checks the digital signature, and displays the contents on the LCD 203.

Next, the contents of messages exchanged between devices in the “customer service call” process will be described.
FIG. 94A shows a message exchange procedure between devices in the “customer service call” process, and FIGS. 95A to 95E show an exchange between devices in the “customer service call” process. Indicates the message content. FIG. 94 (a) is a diagram in which a part of a message exchanged between devices is extracted from FIG. 45 (a). FIG. 94 (a) and FIG. 45 (a) are the same “customer service call”. Processing is shown.
First, when the person in charge of the merchant performs a customer service call operation 21200, the credit settlement terminal 300 generates a customer service call process and starts processing the “customer service call”. The credit settlement terminal 300 generates a customer service call request 6300 (21202) and transmits it to the merchant process of the service providing system 102 by digital telephone communication.

  As shown in FIG. 95 (a), the customer service call request 6300 includes the header information indicating that the message is the customer service call request 6300, the customer service call request header 6400, and the number indicating the user as “settlement”. Customer number 6401 issued at the time of processing, request number 6402 uniquely indicating this customer service call request, person in charge name 6403, merchant ID 6404, and date of issue indicating the date and time when this customer service call request 6300 was issued The data consisting of 6405 is digitally signed by the merchant and sealed to the service provider. The person-in-charge name 6403 is information set by the merchant option and may not be set.

  The merchant process of the service providing system 102 receives the customer service call request 6300, decrypts the cipher, checks the digital signature, and sends a customer service call request 6406 to the service manager process. The service manager process creates a service director process to create a process group that handles customer service call request 6406. The service director process determines the user corresponding to the customer number from the customer table and compares it with the user's access control information to generate a customer service call 6417 and a customer service call response 6426. The user process seals the customer service call 6417 to the user and sends it to the user's personal credit terminal 100 as the customer service call 6301 (21203), and the merchant process sends the customer service call response 6426 to the merchant. It is sealed and transmitted to the credit settlement terminal 300 as a customer service call response 6302 (21204).

As shown in FIG. 95 (b), the customer service call 6301 includes header information indicating that the message is a customer service call 6301, a customer service call header 6410, a person-in-charge name 6411, a merchant ID 6412, and a merchant name 6413. And a digital signature of the service provider on the data consisting of the request number 6414 set by the credit settlement terminal 300, the service provider ID 6415, and the issue date and time 6416 indicating the date and time when this customer service call 6301 is issued, and the user It is a sealed letter. The person-in-charge name 6411 is information set by the merchant option and may not be set.
As shown in FIG. 95 (c), the customer service call response 6302 includes header information indicating that the message is a customer service call response 6302, a customer service call response header 6421, and a response message 6422 from the service providing system 102. The digital signature of the service provider is applied to the data comprising the request number 6423 set by the credit settlement terminal 300, the service provider ID 6424, and the issue date and time 6425 indicating the date and time when this customer service call response 6302 is issued, and the merchant It is a sealed letter.
The credit settlement terminal 300 receives the customer service call response 6302, decrypts the encryption, checks the digital signature, and displays “calling”.

The personal credit terminal 100 receives the customer service call 6301, decrypts the encryption, checks the digital signature, generates a customer service call process, and starts processing the “customer service call”. The personal credit terminal 100 first outputs a ring tone from the speaker to notify the user of an incoming call. When the user performs a call operation 21207, the personal credit terminal 100 generates an incoming response 6303 (21208) and transmits it to the user process of the service providing system 102.
The user process of the service providing system 102 receives the incoming response 6303, decrypts the encryption, and sends the incoming response 6433 to the service director process. The service director process generates a call response 6440 from the incoming response 6433, and the merchant process seals it for the merchant and sends it to the credit settlement terminal 300 as a call response 6304 (21210).
The credit settlement terminal 300 receives the call response 6304, decrypts the encryption, and the credit settlement terminal 300 and the personal credit terminal 100 enter a voice call state.

As shown in FIG. 95 (d), the incoming response 6303 includes header information indicating that the message is an incoming response 6303, an incoming response header 6430, a request number 6431 set by the credit settlement terminal 300, and an audio data encryption key. The data consisting of 6432 is sealed to the service provider.
As shown in FIG. 95 (e), the call response 6304 includes header information indicating that the message is a call response 6304, a call response header 6437, a request number 6438 set by the credit settlement terminal 300, and voice data. The data consisting of the encryption key 6439 is sealed to the merchant.
The voice data encryption key 6432 and the voice data encryption key 6439 are common encryption keys for encrypting voice data during a call, and this voice data encryption key is stored in the voice data encryption key register ( CRYPT) 21613 and the voice data encryption key register (CRYPT) 22611 of the credit settlement terminal 300, the personal credit terminal 100 and the credit settlement terminal 300 encrypt voice data and make a voice call. If the audio data is not encrypted, this audio data encryption key is not set.

Next, the contents of messages exchanged between devices in the “inquiry call” process will be described.
FIG. 94B shows a procedure for exchanging messages between devices in the “inquiry call” processing. FIGS. 96A to 96E show messages exchanged between devices in the “inquiry call” processing. The contents are shown. FIG. 94 (b) is a diagram in which a part of a message exchanged between devices is extracted from FIG. 45 (b). FIG. 94 (b) and FIG. 45 (b) show the same “inquiry call” process. Show.
First, when the user performs an inquiry call operation 21213, the personal / credit settlement terminal 100 generates an inquiry call process and starts an “inquiry call” process. The personal credit settlement terminal 100 first generates an inquiry call request 6307 (21215) and transmits it to the user process of the service providing system 102 by digital wireless telephone communication.

As shown in FIG. 96A, the inquiry call request 6307 includes header information indicating that the message is an inquiry call request 6307, an inquiry call request header 6500, a merchant ID 6501, a person in charge name 6502, and this inquiry call. Data consisting of a request number 6503 that uniquely indicates the request, a user ID 6504, and an issue date and time 6505 that indicates the date and time when this inquiry call request 6307 is issued is digitally signed by the user and sealed to the service provider It is. The person-in-charge name 6503 is information set in the merchant option during the “settlement” process, and may not be set.
The user process of the service providing system 102 receives the inquiry call request 6307, decrypts the encryption, checks the digital signature, and sends an inquiry call request 6506 to the service manager process. The service manager process creates a service director process to create a process group that handles the inquiry call request 6506. The service director process creates an inquiry call 6515 and an inquiry call response 6524 with reference to the merchant's customer table. The merchant process seals the inquiry call 6515 to the merchant and sends it as an inquiry call 6307 (21216) to the credit settlement terminal 300, and the user process seals the inquiry call response 6524 to the user and sends the inquiry call response 6308. (21217) is transmitted to the personal credit settlement terminal 100.

As shown in FIG. 96 (b), the inquiry call 6307 includes header information indicating that the message is an inquiry call 6307, an inquiry call header 6510, a customer number 6511, and a request number 6512 set by the personal credit terminal 100. The service provider ID 6513 and the issue date and time 6514 indicating the date and time when this inquiry call 6307 was issued are digitally signed by the service provider and sealed to the merchant.
As shown in FIG. 96 (c), the inquiry call response 6308 includes header information indicating that the message is an inquiry call response 6308, an inquiry call response header 6519, a response message 6520 from the service providing system 102, and a personal message. For the data consisting of the request number 6521 set by the credit settlement terminal 100, the service provider ID 6522, and the issuance date and time 6523 indicating the date and time when this inquiry call response 6308 is issued, the service provider is digitally signed and addressed to the user It is a sealed letter.

The personal credit terminal 100 receives the inquiry call response 6308, decrypts the encryption, checks the digital signature, and displays “calling”.
The credit settlement terminal 300 receives the inquiry call 6307, decrypts the encryption, checks the digital signature, generates an inquiry call process, and starts the processing of the “inquiry call”. First, the credit settlement terminal 300 outputs a ring tone from the speaker to notify the merchant of the incoming call. When the merchant performs a call operation 1220, the credit settlement terminal 300 generates an incoming response 6309 (21221) and transmits it to the merchant process of the service providing system 102.
The merchant process of the service providing system 102 receives the incoming response 6309, decrypts the cipher, and sends the incoming response 6531 to the service director process. The service director process generates a call response 6538 from the incoming response 6531, and the user process seals it for the user and sends it to the personal credit terminal 100 as a call response 6310 (21223).
The personal credit terminal 100 receives the call response 6310, decrypts the encryption, and the personal credit terminal 100 and the credit settlement terminal 300 enter a voice call state.
As shown in FIG. 96 (d), the incoming response 6309 includes header information indicating that the message is an incoming response 6309, an incoming response header 6528, a request number 6529 set by the personal credit settlement terminal 100, and voice data. The data composed of the encryption key 6530 is sealed to the service provider.

Also, as shown in FIG. 96 (e), the call response 6310 includes header information indicating that the message is a call response 6310, a call response header 6535, a request number 6536 set by the personal credit settlement terminal 100, The data composed of the audio data encryption key 6537 is sealed to the user.
The voice data encryption key 6530 and the voice data encryption key 6537 are a common encryption key for encrypting voice data during a voice call, and this voice data encryption key is stored in the voice data encryption key register of the personal credit terminal 100. (CRYPT) 21613 and the voice data encryption key register (CRYPT) 22611 of the credit settlement terminal 300 are set, and the personal credit terminal 100 and the credit settlement terminal 300 encrypt voice data and perform a voice call. If the audio data is not encrypted, this audio data encryption key is not set.

Next, session establishment processing, remote access processing, data update processing, forced data update processing, data backup processing, “settlement” processing, “cancellation” processing, “customer service call” processing, and “inquiry call” Personal credit terminal 100, credit settlement terminal 300, settlement system 103, and service manager process, service director process, user process, merchant process, and settlement processing institution process of service providing system 102 Details of processing performed by each process will be described.
The overall processing flow of the personal credit terminal and the credit payment terminal is as described in the description of FIGS. 51 and 61, respectively. Personal credit terminal and credit payment terminal are: session establishment process, remote access process, data update process, forced data update process, data backup process, “settlement” process, “cancel” process, “customer service call” Processes corresponding to the processes "" and "inquiry call" are registered in the process list, and each process is executed by each process of the main routine.
On the other hand, the service providing system executes each process by a cooperative process of five types of processes, that is, a service manager process, a service director process, a user process, a merchant process, and a payment processing organization process.

Of the five types of processes, first, the service manager process manages other processes such as a service director process, a user process, a merchant process, and a payment processing institution process in accordance with the processing flow shown in FIGS.
The service manager process is always running, and normally waits for an incoming call request message from the personal credit terminal or credit settlement terminal and a message from each process in step 6600. When the service manager process receives the message, it performs processing corresponding to the type of message shown in steps 6601 to 6618 and steps 6700 to 6709 and returns to step 6600.
If the message is an incoming call request, the service manager process performs a process generation process for generating a user process corresponding to the caller or a merchant process in step 6606.
If the message is a credit inquiry request from a merchant process, the service manager process first checks in step 6607 if a payment request corresponding to the received credit inquiry request is registered in the message list 4405. If the message is not registered, the received message is registered in the message list in step 6608. If registered, the service director process is created in step 6609 to create the service director process. In Step 6610, the registered message is deleted from the message list, and in Step 6611, a credit inquiry request and a payment request are sent to the service director process. Send.
If the message is a payment request from the user process, the service manager process first checks in step 6612 whether a credit inquiry request corresponding to the received payment request is registered in the message list 4405. If it is not registered, the received message is registered in the message list in Step 6613. If it is registered, the process proceeds to Step 6609 and the same processing as when the message is a credit inquiry request is performed. To do.

If the message is a cancel request from the merchant process, the service manager process first registers a cancel request from the user process corresponding to the received cancel request in step 6614 in the message list 4405. If it is not registered, the received message is registered in the message list in step 6615. If it is registered, a service director process is created in step 6616 to A process group is created by the director process, user process, and merchant process. In step 6617, the registered message is deleted from the message list. In step 6618, the service director process is canceled from the merchant process. It transmits the cancellation request from the required and the user process.
If the message is a cancel request from the user process, the service manager process first registers the cancel request from the merchant process corresponding to the received cancel request in step 6619 in the message list 4405. If it is not registered, the received message is registered in the message list in step 6620. If it is registered, the process proceeds to step 6616, and the message is a cancel request from the merchant process. The same processing is performed as in the case of the case.
In registration of the received message in the message list in step 6608, step 6613, step 6615, and step 6620, collation data is generated from the merchant ID, transaction number, and request number included in the message, and the message is sent to the message list. Register with.
In the process group generation in step 6609 and step 6616, first, a service director process is generated, process group management information and service director process management information are registered, and user process management information, and The merchant process management information is updated, and a process group including a service director process, a user process, and a merchant process is generated.
If the message is a customer service call request from a merchant process, the service manager process creates a service director process in step 6704, and a process group consisting of the service director process and the merchant process. In step 6705, a customer service call request is sent to the service director process.

In the generation of the process group in Step 6704, first, a service director process is generated, and the process group management information and the service director process management information are registered. Further, the merchant process management information is updated to A process group is created by a director process and a merchant process.
If the message is an inquiry call request from a user process, the service manager process creates a service director process in step 6706 to create a process group by the service director process and the user process. In step 6707, an inquiry call request is sent to the service director process.
In the process group generation in step 6706, first, a service director process is generated, the process group management information and the service director process management information are registered, and the user process management information is updated to A process group including a director process and a user process is generated.
If the message is a member process request from the service director process, the service manager process adds the requested process to the process group of the service director process in step 6708. To do. At this time, the service manager process creates the requested process as necessary.
If the message is a process erasure request, the service manager process performs process erasure processing for erasing the requested process in step 6709. At this time, the service manager process updates the process management information, process group management information 4404, and message list 4405 of each process as necessary.

Further, the process generation process of step 6606 is performed according to the process flow shown in FIG.
In step 6800, the service manager process first compares the caller telephone number information included in the incoming call request with the user telephone number of the user list 4300 and the merchant telephone number of the merchant list 4301. Determine the requester. If the telephone number information matches the user telephone number, the requester is determined to be a user, and the process proceeds to step 6801. If the telephone number information matches the merchant telephone number, the requester is determined to be a merchant. Then, the process proceeds to Step 6804, and if it does not match any of them, it is determined that it is not an incoming call request from the user or the merchant, and the process generation process is terminated without generating a process.
In step 6801, the registered user process management information is examined to determine whether a user process corresponding to the user who is the requester already exists. If no user process exists, the process advances to step 6802 to generate a user process, register user process management information, and end the process generation process. Also, if the user process already exists, there is a possibility that fraudulent acts such as impersonation of the user have been performed, so proceed to Step 6803, send an error message to the management system, and generate the process The process ends.
In step 6804, the registered merchant process management information is examined to determine whether a merchant process corresponding to the requesting merchant already exists. If the merchant process does not exist, the process proceeds to step 6805 to generate a merchant process, register merchant process management information, and end the process generation process. Also, if the merchant process already exists, there is a possibility that fraudulent acts such as impersonation of the merchant have occurred, so proceed to Step 6806, send an error message to the management system, and generate the process. The process ends.

Next, the user process performs processing according to the message from the personal credit terminal and the message from the service director process according to the processing flow shown in FIG.
The user process generated by the service manager process first performs session establishment processing with a personal credit terminal in step 6900, and in steps 6901 and 6905, a message from the personal credit terminal or service director process. Wait for. In step 6901, message reception is determined, and in step 6905, timeout is determined.
If the message is received, the user process changes the process status of the user process to the “active” state in step 6902, and performs processing corresponding to the received message in step 6903. For example, if a “payment request” is received from a personal credit terminal, in step 6903 a “settlement” process is performed in the user process. When the processing of step 6903 ends, the user process changes the process status to the “idle” state in step 6904 and returns to step 6901.
In the time-out determination at step 6905, if a new message is not received for the time-out time TNRU (TNRU> 0) or longer, the user process times out, and at step 6906, user process time-out processing is performed. By the user process timeout process, the user process is deleted by the service manager process, and the line between the user process and the personal credit terminal is disconnected.
In other words, if the user process does not receive a new message from the personal credit terminal or service director process for the timeout time TNRU or longer, the user process is automatically deleted, and the line to the personal credit terminal is disconnected. Disconnected.

Next, the merchant process performs processing according to the message from the credit settlement terminal and the message from the service director process according to the processing flow shown in FIG.
As in the case of the user process, the merchant process generated by the service manager process first performs session establishment processing with the credit settlement terminal in step 7000, and in steps 7001 and 7005, the credit settlement terminal or , Waiting for a message from the service director process. In step 7001, message reception is determined, and in step 7005, timeout is determined.
If the message is received, the merchant process changes the process status of the merchant process to the “active” state in step 7002, and performs processing according to the received message in step 7003. For example, when a “credit inquiry request” is received from a credit payment terminal, “settlement” in the merchant process is performed in step 7003. When the processing in step 7003 ends, the merchant process changes the process status to the “idle” state in step 7004 and returns to step 7001.
In the time-out determination at Step 7005, if a new message is not received for a time longer than the time-out time TNRM (TNRM> 0), the merchant process times out, and at Step 7006, merchant process time-out processing is performed. By the merchant process timeout process, the merchant process is deleted by the service manager process, and the line between the merchant process and the credit payment terminal is disconnected.
In other words, if the merchant process does not receive a new message from the credit settlement terminal or service director process for the timeout time TNRM or longer, it is automatically deleted and the line with the credit settlement terminal is disconnected. The

Next, the payment processing institution process performs processing according to the message from the payment system and the message from the service director process according to the processing flow shown in FIG.
The payment processing agency process generated by the service manager process first initializes the communication line with the payment system in step 7100, and in steps 7101 and 7105, the payment system or service director process. Waiting for a message from In step 7101, message reception is determined, and in step 7105, timeout is determined.
If the message is received, the payment processing institution process changes the process status of the payment processing institution process to “active” in step 7102, and performs processing according to the received message in step 7103. For example, when a “settlement request” is received from the service director process, the “settlement” process in the settlement processing institution process is performed in step 7103. When the processing in step 7103 is completed, the payment processing institution process changes the process status to the “idle” state in step 7104 and returns to step 7101.
In the time-out determination at Step 7105, if a new message is not received for the time-out time TNRTP (TNRTP> 0) or more, the payment processing institution process times out, and the payment processing institution process time-out processing is performed at Step 7106. . By the payment processing institution process timeout process, the payment processing institution process is deleted by the service manager process, and the line between the payment processing institution process and the payment system is disconnected.
In other words, if the payment processor process does not receive a new message from the payment system or the service director process for the timeout time TNRTP or more, it is automatically deleted and the line with the payment system is disconnected. The

Further, when the communication cost between the user process and the personal credit terminal 100 depends on the usage time of the communication line, the timeout time TNRU is a value depending on the communication fee system. For example, when the usage time of a communication line is charged stepwise, the timeout time TNRU is equal to or longer than a certain time TNRU0 (TNRU0> 0) and does not exceed the next communication charge change point. It becomes the value of. In this case, the communication line between the personal credit terminal and the user process is connected for as long a time as possible without increasing the communication cost. Further, when the communication line usage time is charged linearly, the timeout time TNRU is a fixed time TNRU0.
Similarly, when the communication cost between the merchant process and the credit payment terminal 300 or between the payment processing institution process and the payment system 103 depends on the usage time of the communication line, the user process timeout time TNRU and Similarly, the timeout times TNRM and TNRTP are values depending on the respective communication charge systems.
The service director process will be described in detail in the description of each process of “settlement”, “cancellation”, “customer service call”, and “inquiry call”. The payment system will be described in detail in the description of each process of “settlement” and “cancel”.

Next, a processing flow in session establishment processing when connecting to a user process from a personal credit terminal will be described.
FIG. 103 and FIG. 104 respectively show the process flow of the session establishment process of the personal credit terminal and the user process in the session establishment process when the personal credit terminal is connected to the user process.
First, in step 7200, the personal credit terminal transmits a call request 4500 to the digital public network and receives a call response 4504 from the digital public network to connect a line with the user process. At this time, the service manager process receives the incoming call request 4501 from the digital public network, and generates a user process in the process generation process in step 6606. In step 7300, the generated user process transmits an incoming call response 4503 to the digital public network to connect the line with the personal credit terminal. Next, the user process generates a test pattern A4701 in step 7301, encrypts the test pattern A with the user's public key in step 7302, and generates an authentication test A4506. In step 7303, the user process generates the authentication test A. Send to a personal credit terminal.

On the other hand, the personal credit terminal generates a test pattern B4705 in step 7201, encrypts the test pattern B with the service provider's public key in step 7202, generates an authentication test B, and executes steps 7203 and 7211. And waiting for receiving the authentication test A from the user process. In step 7203, reception of authentication test A is determined. In step 7211, timeout is determined.
In the determination of timeout in step 7211, if the authentication test A is not received for the timeout time TTAU (TTAU> 0) or more, the personal credit terminal times out, and in step 7212 an error message is displayed on the LCD. In step 7213, the line is disconnected and the session establishment process is terminated.
If the authentication test A is received, the personal credit terminal decrypts the encrypted test pattern A with the user's private key in step 7204, and decrypts the authentication test B and the encryption in step 7205. An authentication test A response 4507 is generated from the test pattern A, and in step 7206, the authentication test A response is transmitted to the user process.
The user process that has transmitted the authentication test A to the personal credit terminal waits to receive an authentication test A response from the personal credit terminal in steps 7304 and 7312. In step 7304, reception of the authentication test A response is determined, and in step 7312, timeout is determined.
In the time-out determination at step 7312, if the authentication test A response is not received for the time-out time TTARU (TTARU> 0) or longer, the user process times out, and at step 7313, session establishment error processing is performed, and session establishment processing is performed. Exit. Due to session establishment error handling, the user process is erased by the service manager process and the line is disconnected.
If the authentication test A response is received, the user process checks the transmitted test pattern A of the authentication test A against the test pattern A of the received authentication test A response in step 7305, and if the patterns match. In step 7306, if they do not match, it is determined that the user authentication has failed, and in step 7314, a session establishment error process is performed, and the session establishment process is terminated.

In step 7306, the user process decrypts the encrypted test pattern B with the service provider's private key, generates a session permission message 4709 in step 7307, and in step 7308, converts the session permission message to the user's public key. The authentication test B response 4508 is generated from the test pattern B encrypted and decrypted and the encrypted session permission message. In step 7309, the authentication test B response is transmitted to the personal credit terminal. In step 7310, the user status is changed to the session established state. In step 7311, the process status is changed to the “idle” state, and the session establishment process is terminated. Proceed to
The personal credit terminal that has transmitted the authentication test A response to the user process waits to receive an authentication test B response from the user process in steps 7207 and 7214. In step 7207, reception of the authentication test B response is determined, and in step 7214, timeout is determined.

If the authentication test B response is not received for the timeout time TTBRU (TTBRU> 0) or more in the determination of timeout in step 7214, the personal credit terminal times out, and an error message is displayed on the LCD in step 7215. In step 7216, the line is disconnected and the session establishment process is terminated.
When receiving the authentication test B response, the personal credit terminal matches the test pattern B of the transmitted authentication test B with the test pattern B of the received authentication test B response in step 7208, and the pattern matches. If not, the process proceeds to step 7209. If they do not match, it is determined that authentication of the service provider has failed, an error message is displayed on the LCD in step 7217, and a line is connected in step 7218. Disconnect and end the session establishment process.
In step 7209, the personal credit terminal decrypts the encrypted session permission message with the user's private key, and in step 7210, changes the terminal status to the session established state, and ends the session establishment process.

The session establishment process when connecting from the credit settlement terminal to the merchant process performs the same process as the session establishment process when connecting from the personal credit terminal to the user process. FIG. 105 and FIG. 106 respectively show the processing flow of the session establishment process of the credit settlement terminal and the merchant process in the session establishment process when connecting from the credit settlement terminal to the merchant process.
First, in step 7400, the credit settlement terminal transmits a call request 4800 to the digital public network and receives a call response 4804 from the digital public network to connect a line with the merchant process. At this time, the service manager process receives the incoming call request 4801 from the digital public network, and generates a merchant process in the process generation process in step 6606. In step 7500, the generated merchant process transmits an incoming call response 4803 to the digital public network to connect the line with the credit settlement terminal. Next, the merchant process generates test pattern A5001 in step 7501, encrypts test pattern A with the merchant's public key in step 7502, generates authentication test A4806, and in step 7503, generates authentication test A. Send to credit payment terminal.

On the other hand, the credit card settlement terminal generates a test pattern B5005 in step 7401, encrypts the test pattern B with the service provider's public key in step 7402, and generates an authentication test B. Steps 7403 and 7411 And waiting to receive an authentication test A from the merchant process. In step 7403, reception of authentication test A is determined, and in step 7411, timeout is determined.
In the time-out determination in step 7411, if the authentication test A is not received for the time-out time TTAM (TTAM> 0) or longer, the credit settlement terminal times out, and an error message is displayed on the LCD in step 7412. In step 7413, the line is disconnected and the session establishment process is terminated.
When receiving the authentication test A, the credit settlement terminal decrypts the encrypted test pattern A with the merchant's private key in step 7404, and in step 7405, authenticates the test B and the decrypted test. An authentication test A response 4807 is generated from the pattern A, and in step 7406, the authentication test A response is transmitted to the merchant process.
In step 7504 and step 7512, the merchant process that has transmitted the authentication test A to the credit settlement terminal waits to receive an authentication test A response from the credit settlement terminal. In step 7504, reception of the authentication test A response is determined, and in step 7512, timeout is determined.

In the time-out determination of step 7512, if the authentication test A response is not received for the time-out time TTARM (TTARM> 0) or longer, the merchant process times out, and in step 7513, session establishment error processing is performed, and session establishment processing is performed. Exit. With the session establishment error handling, the merchant process is erased by the service manager process and the line is disconnected.
If the authentication test A response is received, the merchant process compares the test pattern A of the sent authentication test A with the test pattern A of the received authentication test A response in step 7505, and the pattern matches. In this case, the process proceeds to step 7506. If they do not match, it is determined that the merchant authentication has failed, and in step 7514, a session establishment error process is performed, and the session establishment process is terminated.

The merchant process decrypts the encrypted test pattern B with the service provider's private key at step 7506, generates a session permission message 4709 at step 7507, and converts the session permission message into the merchant's public key at step 7508. Then, an authentication test B response 4808 is generated from the test pattern B encrypted and decrypted, and the encrypted session permission message. In step 7509, the authentication test B response is transmitted to the credit settlement terminal. In step 7510, the merchant status is changed to the session established state. In step 7511, the process status is changed to the “idle” state, and the session establishment process is terminated. Proceed to In step 7407 and step 7414, the credit settlement terminal that has transmitted the authentication test A response to the merchant process waits to receive an authentication test B response from the merchant process. In step 7407, reception of the authentication test B response is determined, and in step 7414, a timeout is determined.
If the authentication test B response is not received for the time-out time TTBRM (TTBRM> 0) or more in the time-out determination at step 7414, the credit settlement terminal times out, and an error message is displayed on the LCD at step 7415. In step 7416, the line is disconnected and the session establishment process is terminated.
If the authentication test B response is received, the credit settlement terminal collates the transmitted test pattern B of the authentication test B with the received test pattern B of the authentication test B response in step 7408, and the patterns match. In step 7409, if they do not match, it is determined that authentication of the service provider has failed, an error message is displayed on the LCD in step 7417, and the line is disconnected in step 7418. Then, the session establishment process ends.
The credit settlement terminal decrypts the encrypted session permission message with the merchant's private key in step 7409, changes the terminal status to the session established state in step 7410, and ends the session establishment process.

Next, a processing flow in session establishment processing when connecting to a personal credit terminal from a user process will be described.
FIG. 107 and FIG. 108 show the processing flow of the user process in the session establishment process and the session establishment process of the personal credit terminal when connecting from the user process to the personal credit terminal, respectively.
In step 7600, the user process generated by the service manager process first sends a call request 4601 to the digital public network and receives a call response 4604 from the digital public network to receive a personal credit terminal. Connect the line. At this time, in step 7700, the personal credit terminal receives an incoming call request 4602 from the digital public network and transmits an incoming call response 4603 to the digital public network to connect a line with the user process. Further, the personal credit terminal generates a test pattern C4712 in step 7701, encrypts the test pattern C with the service provider's public key in step 7702, generates an authentication test C4606, and authenticates in step 7703. Send test C to the user process.

On the other hand, the user process generates a test pattern D4716 in step 7601, encrypts the test pattern D with the user's public key in step 7602, generates an authentication test D, and in steps 7603 and 7612, -Waiting to receive an authentication test C from the credit terminal. In step 7603, the reception of the authentication test C is determined, and in step 7612, a timeout is determined.
In the time-out determination at step 7612, if the authentication test C is not received for the time-out time TTCU (TTCU> 0) or longer, the user process times out, and at step 7613, the session establishment error processing is performed and the session establishment processing is performed. finish.
When receiving the authentication test C, the user process decrypts the encrypted test pattern C with the service provider's private key in Step 7604, and in Step 7605, the user process decrypts the authentication test D and the encrypted test pattern. An authentication test C response 4607 is generated from C, and in step 7606, the authentication test C response is transmitted to the personal credit terminal.
In step 7704 and step 7711, the personal credit terminal that has transmitted the authentication test C to the user process waits to receive an authentication test C response from the user process. In step 7704, reception of the authentication test C response is determined, and in step 7711, timeout is determined.
In the time-out determination in step 7711, if the authentication test C response is not received for the time-out time TTCRU (TTCRU> 0) or longer, the personal credit terminal times out, and an error message is displayed on the LCD in step 7712. In step 7613, the line is disconnected and the session establishment process is terminated.
When the authentication test C response is received, in step 7705, the personal credit terminal compares the test pattern C of the transmitted authentication test C with the test pattern C of the received authentication test C response, and the patterns match. In this case, the process proceeds to step 7706, and if they do not match, it is determined that the authentication of the service provider has failed, an error message is displayed on the LCD in step 7714, and the line is connected in step 7613. Disconnect and end the session establishment process.
In step 7706, the personal credit terminal decrypts the encrypted test pattern D with the user's private key, generates a session permission message 4720 in step 7707, and in step 7708, sends the session permission message to the service provider's An authentication test D response 4608 is generated from the test pattern D encrypted with the public key and decrypted, and the encrypted session permission message. In step 7709, the authentication test D response is transmitted to the user process. In step 7710, the terminal status is changed to the session established state, and the session establishment process is terminated.

The user process that has transmitted the authentication test C response to the personal credit terminal is waiting to receive the authentication test D response from the personal credit terminal in steps 7607 and 7614. In step 7607, it is determined whether or not an authentication test D response has been received. In step 7614, a timeout is determined.
If the authentication test D response is not received for the time-out time TTDRU (TTDRU> 0) or longer in the time-out determination at step 7614, the user process times out, and at step 7615, the session establishment error processing is performed. Exit.
If the authentication test D response is received, the user process compares the test pattern D of the transmitted authentication test D with the test pattern D of the received authentication test D response in step 7608, and if the patterns match. In step 7609, if they do not match, it is determined that the user authentication has failed, and in step 7616, a session establishment error process is performed, and the session establishment process is terminated.
The user process decrypts the encrypted session authorization message with the service provider's private key in step 7609, changes the user status to the session established state in step 7610, and in step 7611 sets the process status to “ After changing to the “idle” state, the session establishment process is terminated, and the user process proceeds to step 6901 in FIG.

The session establishment process when connecting to the credit settlement terminal from the merchant process performs the same process as the session establishment process when connecting to the personal credit terminal from the user process. FIG. 109 and FIG. 110 show the processing flow of the merchant process in the session establishment process when connecting to the credit settlement terminal from the merchant process and the session establishment process of the credit settlement terminal, respectively.
In step 7800, the merchant process generated by the service manager process first sends a call request 4901 to the digital public network and receives a call response 4904 from the digital public network to establish a line with the credit settlement terminal. Connect. At this time, in step 7900, the credit settlement terminal receives an incoming call request 4902 from the digital public network and transmits an incoming call response 4903 to the digital public network to connect the line with the merchant process. Further, the credit settlement terminal generates a test pattern C5012 in Step 7901, encrypts the test pattern C with the public key of the service provider in Step 7902, generates an authentication test C4906, and in Step 7903 Send C to the merchant process.

On the other hand, the merchant process generates a test pattern D5016 in step 7801, encrypts the test pattern D with the merchant's public key in step 7802, and generates an authentication test D. In step 7803 and step 7812, a credit is generated. Waiting to receive an authentication test C from the payment terminal. In step 7803, reception of the authentication test C is determined, and in step 7812, timeout is determined.
In the time-out determination in step 7812, if the authentication test C is not received for the time-out time TTCM (TTCM> 0) or longer, the merchant process times out, and in step 7813, the session establishment error processing is performed, and the session establishment processing is performed. finish.
If the authentication test C is received, the merchant process decrypts the encrypted test pattern C with the service provider's private key in step 7804, and in step 7805 the authentication test D and the test pattern obtained by decrypting the cipher. And C, an authentication test C response 4907 is generated. In step 7806, the authentication test C response is transmitted to the credit card settlement terminal.
The credit settlement terminal that has transmitted the authentication test C to the merchant process waits to receive an authentication test C response from the merchant process in steps 7904 and 7911. In step 7904, reception of the authentication test C response is determined, and in step 7911, timeout is determined.
If the authentication test C response is not received for the timeout time TTCRM (TTCRM> 0) or longer in the time-out determination at Step 7911, the credit settlement terminal times out, and an error message is displayed on the LCD at Step 7912. In step 7913, the line is disconnected and the session establishment process is terminated.

When the authentication test C response is received, the credit settlement terminal collates the transmitted test pattern C of the authentication test C with the received test pattern C of the authentication test C response in step 7905 and the patterns match. In step 7906, if they do not match, it is determined that authentication of the service provider has failed, an error message is displayed on the LCD in step 7914, and the line is disconnected in step 7915. Then, the session establishment process ends.
The credit settlement terminal decrypts the encrypted test pattern D with the merchant's private key in step 7906, generates a session permission message 5020 in step 7907, and discloses the session permission message to the service provider in step 7908. An authentication test D response 4908 is generated from the test pattern D encrypted with the key and decrypted, and the encrypted session permission message. In step 7909, the authentication test D response is transmitted to the merchant process. In step 7910, the terminal status is changed to the session established state, and the session establishment process is terminated.

In step 7807 and step 7814, the merchant process that has transmitted the authentication test C response to the credit settlement terminal waits to receive an authentication test D response from the credit settlement terminal. In step 7807, reception of the authentication test D response is determined, and in step 7814, timeout is determined.
If the authentication test D response is not received for the timeout time TTDRM (TTDRM> 0) or longer in the time-out determination in step 7814, the merchant process times out and performs session establishment error processing in step 7815. Exit.
If the authentication test D response is received, the merchant process compares the test pattern D of the transmitted authentication test D with the test pattern D of the received authentication test D response in step 7808, and if the patterns match. In step 7809, if they do not match, it is determined that the merchant authentication has failed, and in step 7816, a session establishment error process is performed, and the session establishment process is terminated.
The merchant process decrypts the encrypted session authorization message with the service provider's private key at step 7809, changes the merchant status to the session established state at step 7810, and sets the process status to “ The state is changed to the “idle” state, the session establishment process is terminated, and the merchant process proceeds to step 7001 in FIG.

Next, a processing flow in remote access processing will be described.
111 (a) and 112 (a) respectively show the processing of the remote access process of the personal credit terminal and the user process of the service providing system in the remote access processing of the personal credit terminal and the service providing system. The flow is shown.
The remote access process is initiated by the user accessing data present at the remote address. In step 8000, the personal credit terminal first generates a remote access request 5100 for data to be accessed. In step 8001, the personal credit terminal determines whether or not a session is established from the terminal status. In step 8003, the generated remote access request is transmitted to the user process. If the session is not established, session establishment processing is performed in step 8002 to establish a session with the service providing system, and then the process proceeds to step 8003. .
In step 8004 and step 8011, the personal credit terminal that has transmitted the remote access request waits for reception of the remote access data 5101. In step 8004, reception of remote access data is determined. In step 8011, timeout is determined.
In the determination of the timeout in step 8011, if the remote access data is not received for the timeout time TRADU (TRADU> 0) or more, the personal credit terminal times out and performs a user timeout error process in step 8012. Terminates remote access processing. In the user timeout error processing, the personal credit terminal sends a user timeout error message to the user process of the service providing system, disconnects the session and line with the user process, and displays a timeout error on the LCD. To do.

If the remote access data is received, the personal credit terminal decrypts the encryption of the remote access data with the user's private key in step 8005, performs a user validity check in step 8006, and validates the remote access data. To verify.
If the user validity check is passed, the personal credit terminal stores the data 5209 portion of the remote access data in the temporary area of the RAM in step 8007, and in step 8008, the address information of the data is stored in the data. The stored local address is updated, and in step 8009, the data stored in the RAM is accessed. In step 8010, it is determined whether data update processing is necessary from the free space in the temporary area. If the free space in the temporary area is greater than or equal to the set value AU (AU> 0), the remote access is continued. When the process is terminated and the value is smaller than the set value AU, a data update process is generated, and the process proceeds to the data update process.
If the user validity check fails, the personal credit terminal performs user session error processing in step 8013 and ends the remote access processing. In user session error handling, the personal credit terminal sends a user session error message to the user process of the service providing system, disconnects the session and the line with the user process, and displays the session error on the LCD. To do.

The user validity check is a process for verifying the validity of a message received from the user process of the service providing system. As shown in FIG. 111B, the user validity check performs three types of verification. . First, in step 8014, the service provider's digital signature is verified, in step 8015, the service provider ID is verified, and in step 8016, the issue time of the received message is verified. In the issuance time verification in step 8016, a deviation between the issuance time of the received information and the current time is verified. If the deviation is equal to or greater than the time TU (TU> 0), it is determined that the information is invalid. Therefore, it is determined that the user validity check is passed only when the verification of the service provider's digital signature is passed, the service provider ID matches, and the issue time verification is passed, otherwise it is failed. Is determined.
On the other hand, in the user process, the remote access processing is started by receiving the remote access request 5100. First, in step 8100, the user process decrypts the received remote access request with the service provider's private key. In step 8101, the user process checks the validity of the user process and verifies the validity of the remote access request. .
If the user process validity check is passed, the user process generates remote access data 5101 in step 8102 and transmits the generated remote access data to the personal credit terminal in step 8103 for remote access processing. Exit.

If the user process validity check fails, the user process determines that the received message is not valid, performs user process session error processing at step 8104, and ends the remote access processing. By the user process / session error processing, the user process is deleted by the service manager process, and the session and the line with the personal credit terminal are disconnected. At this time, the user process transmits to the management system 407 a session error message indicating that an invalid message has been received.
The user process validity check is a process for verifying the validity of the information received from the personal credit terminal. As shown in FIG. 112B, the user process validity check performs three types of verification. . First, in step 8105, the user's digital signature is verified, in step 8106, the user ID is verified, and in step 8107, the issue time of the received information is verified. In the issuance time verification in step 8107, the deviation between the issuance time of the received information and the current time is verified. If the deviation is equal to or greater than the time TUP (TUP> 0), it is determined that the information is invalid. . Therefore, it is determined that the user process validity check is passed only when the verification of the user's digital signature is passed, the user ID matches, and the verification of the issue time is passed. Otherwise, the failure is determined. To do.

FIG. 113 (a) and FIG. 114 (a) show the processing flow of the credit payment terminal remote access process and the merchant process in the remote access processing of the credit payment terminal and the service providing system, respectively. Yes.
The remote access process is initiated by the merchant accessing data residing at the remote address. First, in step 8200, the credit settlement terminal generates a remote access request 5400 for data to be accessed.In step 8201, the credit settlement terminal determines whether or not the session is established from the terminal status. In step 8203, the generated remote access request is transmitted to the merchant process. If the session is not established, session establishment processing is performed in step 8202 to establish a session with the service providing system, and then the process proceeds to step 8203.
In step 8204 and step 8211, the credit settlement terminal that has transmitted the remote access request waits for reception of remote access data 5401. In step 8204, reception of remote access data is determined, and in step 8211, timeout is determined.
If the remote access data is not received for the timeout time TRADM (TRADM> 0) or more in the time-out determination in step 8211, the credit settlement terminal times out and performs the merchant time-out error processing in step 8212. The access process ends. In the merchant time-out error processing, the credit payment terminal transmits a merchant time-out error message to the merchant process of the service providing system, disconnects the session and the line with the merchant process, and displays a time-out error on the LCD. .

When receiving the remote access data, the credit card terminal decrypts the encryption of the remote access data with the merchant's private key in step 8205, performs the merchant validity check in step 8206, and checks the validity of the remote access data. Validate.
If the merchant validity check is passed, the credit settlement terminal stores the data 5509 portion of the remote access data in the temporary area of the RAM in step 8207, and stores the address information of the data in step 8208. In step 8209, the data stored in the RAM is accessed. In step 8210, it is determined whether data update processing is necessary from the free space in the temporary area. If the free space in the temporary area is equal to or greater than the set value AM (AM> 0), the remote access is continued. When the process is terminated and the value is smaller than the set value AM, a data update process is generated, and the process proceeds to the data update process.
If the merchant validity check fails, the credit terminal performs merchant session error processing in step 8213 and ends the remote access processing. In the merchant session error processing, the credit payment terminal transmits a merchant session error message to the merchant process of the service providing system, disconnects the session and the line with the merchant process, and displays the session error on the LCD. .

  The merchant validity check is a process for verifying the validity of the message received from the merchant process of the service providing system. As shown in FIG. 113B, the merchant validity check performs three types of verification. . First, in step 8214, the service provider's digital signature is verified, in step 8215, the service provider ID is verified, and in step 8216, the issue time of the received message is verified. In the issue time verification in step 8216, the deviation between the issue time of the received information and the current time is verified. If the time difference is equal to or greater than time TM (TM> 0), it is determined that the information is invalid. . Therefore, it is determined that the merchant validity check is passed only when the verification of the digital signature of the service provider is passed, the service provider ID matches, and the verification of the issue time is passed. It is determined that

On the other hand, in the merchant process, the remote access process is started by receiving the remote access request 5400. In step 8300, the merchant process first decrypts the received remote access request with the service provider's private key, and in step 8301 performs a merchant process validity check to verify the validity of the remote access request. .
If the merchant process validity check is passed, the merchant process generates remote access data 5401 in step 8302, and transmits the generated remote access data to the credit card payment terminal in step 8303 to perform remote access processing. finish.

If the merchant process validity check fails, the merchant process determines that the received message is not valid, performs merchant process session error processing at step 8304, and ends the remote access processing. With the merchant process session error handling, the merchant process is deleted by the service manager process, and the session with the credit settlement terminal and the line are disconnected. At this time, the merchant process transmits to the management system 407 a session error message indicating that an invalid message has been received.
The merchant process validity check is a process for verifying the validity of the information received from the credit settlement terminal. As shown in FIG. 114B, the merchant process validity check performs three types of verification. First, in step 8305, the digital signature of the merchant is verified, in step 8306, the merchant ID is verified, and in step 8307, the issue time of the received information is verified. In the issuance time verification in step 8307, the deviation between the issuance time of the received information and the current time is verified. If the deviation is equal to or greater than the time TMP (TMP> 0), it is determined that the information is invalid. . Therefore, only when the merchant's digital signature is verified, the merchant ID matches, and the issue time is verified, it is determined that the merchant process validity check has been passed. Otherwise, it is determined that a failure has occurred. To do.

Next, a processing flow in the data update process will be described.
FIG. 115 and FIG. 116 respectively show the processing flow of the data update process of the personal credit terminal and the user process of the service providing system in the data update process of the personal credit terminal and the service providing system.
In the data update process, when the value of the clock counter of the personal credit terminal matches the update time register, or when the free space in the temporary area becomes smaller than the set value AU, the personal credit terminal It starts by generating a data update process.
First, in step 8400, the personal credit terminal displays “data update in progress” on the LCD, and in step 8401, generates a data update request 5102. In step 8402, whether or not the session status is established from the terminal status. If the session is established, the generated data update request is transmitted to the user process in step 8404. If the session is not established, session establishment processing is performed in step 8403, and the service providing system After establishing the session, go to Step 8404.
In step 8405 and step 8416, the personal credit terminal that has transmitted the data update request waits for reception of the data update response 5103. In step 8405, reception of a data update response is determined, and in step 8416, timeout is determined.
In the time-out determination in step 8416, if the data update response is not received for the time-out time TRURU (TRURU> 0) or more, the personal credit terminal times out, and in step 8417, user time-out error processing is performed. End the data update process.

If the data update response is received, the personal credit terminal decrypts the encryption of the data update response with the user's private key in step 8406, performs the user validity check in step 8407, and validates the data update response. To verify.
If the user validity check is passed, the personal credit terminal compresses the RAM data in step 8408 to generate upload data 5104, and in step 8409 transmits the generated upload data to the user process. To do.
If the user validity check fails, the personal credit terminal performs user session error processing in step 8418 and ends the data update processing.
In step 8410 and step 8419, the personal credit terminal that has transmitted the upload data waits for reception of a message from the user process. In step 8410, it is determined whether to receive a message. In step 8419, a timeout is determined.
If the message is not received for the timeout time TDU (TDU> 0) or more in the time-out determination in step 8419, the personal credit terminal times out, and in step 8420, the user time-out error processing is performed to update the data. The process ends.

When receiving a message from the user process, the personal credit terminal decrypts the received message with the user's private key in step 8411, performs a user validity check in step 8412, and checks the received message. Validate the effectiveness.
If the user validity check passes, the personal credit terminal proceeds to step 8413. If the user validity check fails, the personal credit terminal performs user session error processing in step 8421. To complete the data update process.
In step 8413, the personal credit terminal determines whether the received message is update data 5105 or a function stop command 5105 ′, and if it is update data, in step 8414 the update data terminal data 5239 is updated. The data compression is released and the data in the RAM is updated. In step 8415, the display of “data update in progress” is released, and the data update process is terminated.
If the received message is a function stop command, the personal credit terminal displays “unusable” on the LCD in step 8422, clears the terminal enable bit in the EEPROM 1503 in step 8423, and In step 8424, the terminal status is changed to unusable, and the data update process is terminated.

On the other hand, in the user process, the data update process is started by receiving the data update request 5102. First, in step 8500, the user process decrypts the received data update request with the service provider's private key. In step 8501, the user process checks the validity of the user process and verifies the validity of the data update request. .
If the user process validity check is passed, the user process generates a data update response 5103 in step 8502, and transmits the generated data update response to the personal credit terminal in step 8503.
If the user process validity check fails, the user process determines that the received message is not valid, performs user process session error processing at step 8514, and ends the data update processing.
The user process that has transmitted the data update response waits for reception of the upload data 5104 in step 8504 and step 8515. In step 8504, reception of upload data is determined, and in step 8515, timeout is determined.

In the time-out determination in step 8515, if the upload data is not received for the time-out time TUDU (TUDU> 0) or longer, the user process times out, and in step 8516, the user process time-out error processing is performed to update the data. End the process. By the user process timeout error processing, the user process is deleted by the service manager process, and the session and the line with the personal credit terminal are disconnected. At this time, the user process transmits a timeout error message indicating that timeout has occurred to the management system 407.
If the upload data is received, the user process decrypts the received upload data with the service provider's private key in step 8505, and in step 8506 performs a user process validity check to verify the validity of the upload data. To verify.
If the user process validity check is passed, the user process proceeds to step 8507. If the user process validity check fails, the user process determines that the received message is not valid, and step 8517 Then, the user process, session error process is performed, and the data update process is terminated.

In step 8507, the user process releases the data compression of the terminal data 5231 of the uploaded data. In step 8508, the user process performs a data comparison check to verify whether the terminal data has been tampered with. In the data collation check, the terminal data whose data compression has been released is collated with the terminal data 24006 of the user information server and data managed by the other user data management information 24000.
If the data verification check is passed, the user process first changes the access time of the credit card list 24008 of the user information server to the latest information based on the terminal data whose data compression has been released in step 8509. Next, in step 8510, new terminal data is generated based on the actual data area capacity of the personal credit terminal, the data generation time, and the access time, and in step 8511, the data compression is released. The update data 5105 is generated by taking the difference between the data and the new terminal data. In step 8512, the generated update data is transmitted to the personal credit terminal. In 8513, the terminal data 24006 of the user information server is updated. Update and end the data update process.

If the data verification check fails, it is determined that the terminal data may have been tampered with, and the user process generates a function stop command 5105 ′ in step 8518, and in step 8519 In step 8520, the user status 24012 on the user information server is changed to “unusable”, and in step 8521, user process / session error processing is performed. To complete the data update process.
In the generation of new terminal data in step 8510, the data stored in the RAM is reorganized so that the temporary area becomes empty. In particular, if there is not enough space in the actual data area 21812, the access time of each credit card is compared, a local address is assigned to the object data address of the credit card with the latest access time, and each use The use times of information are compared, and a local address is assigned to the use information address of the use information with the latest use time. When the personal credit terminal program needs to be upgraded, the data in the basic program area is updated. However, the user area is updated to the user area data of the terminal data received from the personal credit terminal.

117 and 118 show processing flows of the data update process of the credit settlement terminal and the merchant process of the service provision system in the data update process of the credit settlement terminal and the service provision system, respectively.
In the data update process, when the value of the clock counter of the credit settlement terminal matches the update time register, or when the free space in the temporary area becomes smaller than the set value AM, the credit settlement terminal performs data update. It starts by creating a process.
First, the credit settlement terminal displays “data updating in progress” on the LCD in step 8600, generates a data update request 5402 in step 8601, and checks whether or not the session is established from the terminal status in step 8602. If it is determined that the session is established, the generated data update request is transmitted to the merchant process in step 8604. If the session is not established, session establishment processing is performed in step 8603 to establish a session with the service providing system. Then, go to Step 8604.
The credit settlement terminal that has transmitted the data update request waits for reception of the data update response 5403 in steps 8605 and 8616. In step 8605, reception of a data update response is determined, and in step 8616, timeout is determined.
In the time-out determination at Step 8616, if the data update response is not received for the time-out time TRURM (TRURM> 0) or longer, the credit settlement terminal times out, and at Step 8617 performs merchant time-out error processing and data. Finish the update process.

If the data update response is received, the credit card terminal decrypts the encryption of the data update response with the merchant's private key in step 8606, performs a merchant validity check in step 8607, and checks the validity of the data update response. Validate.
If the merchant validity check is passed, the credit settlement terminal compresses the RAM and hard disk data in step 8608 to generate upload data 5404, and in step 8609 the generated upload data is merchant. Send to process.
If the merchant validity check fails, the credit terminal performs merchant session error processing in step 8618 and ends the data update processing.
In step 8610 and step 8619, the credit settlement terminal that has transmitted the upload data waits for reception of a message from the merchant process. In step 8610, it is determined whether to receive a message. In step 8619, a timeout is determined.
In the time-out determination in step 8619, if no message is received for the time-out time TDM (TDM> 0) or longer, the credit card terminal times out, and in step 8620 performs merchant time-out error processing, and data update processing. Exit.

If a message from the merchant process is received, the credit card terminal decrypts the received message with the merchant's private key in step 8611, performs a merchant validity check in step 8612, and validates the received message. Verify sex.
If the merchant validity check passes, the credit payment terminal proceeds to step 8613. If the merchant validity check fails, the credit payment terminal performs merchant session error processing in step 8621, End the data update process.
In step 8613, the credit settlement terminal determines whether the received message is the update data 5405 or the function stop command 5405 ′. The compression is released to update the data in the RAM and the hard disk. In step 8615, the display of “data update in progress” is released, and the data update process is terminated.

If the received message is a function stop command, the credit settlement terminal displays “unusable” on the LCD in step 8622, and clears the terminal enable bit in the EEPROM 22504 in step 8623 for operation. In step 8624, the terminal status is changed to unusable and the data update process is terminated.
On the other hand, in the merchant process, the data update process is started by receiving the data update request 5402. In step 8700, the merchant process first decrypts the received data update request with the service provider's private key, and in step 8701 performs a merchant process validity check to verify the validity of the data update request. .
If the merchant process validity check is passed, the merchant process generates a data update response 5403 at step 8702, and transmits the generated data update response to the credit settlement terminal at step 8703.

If the merchant process validity check fails, the merchant process determines that the received message is not valid, performs merchant process session error processing at step 8713, and ends the data update processing.
In step 8704 and step 8714, the merchant process that has transmitted the data update response waits for reception of the upload data 5404. In step 8704, reception of upload data is determined, and in step 8714, timeout is determined.
In the time-out determination at Step 8714, if the upload data is not received for the time-out time TUDM (TUDM> 0) or longer, the merchant process times out, and at Step 8715, the merchant process time-out error processing is performed to update the data. The process ends. With the merchant process timeout error handling, the merchant process is deleted by the service manager process, and the session with the credit settlement terminal and the line are disconnected. At this time, the merchant process transmits to the management system 407 a timeout error message indicating that timeout has occurred.
If the upload data is received, the merchant process decrypts the received upload data with the service provider's private key in step 8705, and in step 8706 performs a merchant process validity check to verify the upload data validity. To verify.
If the merchant process validity check passes, the merchant process proceeds to step 8707, and if the merchant process validity check fails, the merchant process determines that the received message is not valid and step 8716 Then, the merchant process, session error process is performed, and the data update process is terminated.

In step 8707, the merchant process releases the data compression of the terminal data 5531 of the upload data, and in step 8708, performs a data matching check to verify whether the terminal data has been tampered with. In the data collation check, the terminal data whose data compression has been canceled is collated with the terminal data 24006 of the merchant information server and data managed by the other merchant data management information 24000.
If the data verification check is passed, the merchant process first generates new terminal data in step 8709 based on the actual data area capacity of the credit payment terminal and the data generation time. The update data 5405 is generated by taking the difference between the terminal data from which the data compression has been released and the new terminal data. In step 8711, the generated update data is sent to the credit settlement terminal. Terminal data 24104 is updated, and the data update process is terminated.
If the data verification check fails, it is determined that the terminal data may have been tampered with, and the merchant process generates a function stop instruction 5405 ′ in step 8717, and generates in step 8718. In step 8719, the merchant status 24012 on the merchant information server is changed to “unusable”, and in step 8720, merchant process / session error processing is performed. The data update process is terminated.
In the generation of new terminal data in step 8709, the data stored in the RAM and the hard disk is reorganized so that the temporary area becomes empty. In particular, if there is not enough capacity in the actual data area, it is necessary to compare the sales time of each sales information, assign a local address to the sales information with the latest sales time, and upgrade the credit settlement terminal program. If there is, the basic program area data is also updated. However, the merchant area is updated to the merchant area data of the terminal data received from the credit settlement terminal.

Next, a process flow in the forced data update process will be described. FIG. 119 and FIG. 120 respectively show the processing flow of the compulsory data update process of the personal credit terminal and the user process of the service providing system in the compulsory data updating process of the personal credit terminal and the service providing system. Show.
The compulsory data update process is performed when the data in the RAM of the personal credit terminal 100 needs to be updated immediately, for example, when the service providing system 102 changes the contents of the contract with the user.
First, in step 8900, the user process generates a data update instruction 5106. In step 8901, the user process determines whether or not the session is established from the terminal status. If the data update command is transmitted to the personal credit terminal and the session is not established, a session establishment process is performed in step 8902, a session with the service providing system is established, and the process proceeds to step 8903.
In step 8904 and step 8914, the user process that has transmitted the data update command waits for reception of the upload data 5107. In step 8904, reception of upload data is determined, and in step 8914, timeout is determined.
In the time-out determination of Step 8914, if the upload data is not received for the time-out time TUDU (TUDU> 0) or longer, the user process times out, and in Step 8915, the user process time-out error processing is performed, and forced. End the data update process.

When the upload data is received, the user process decrypts the received upload data with the service provider's private key in step 8905, and in step 8906 performs a user process validity check to check the validity of the upload data. To verify.
If the user process validity check passes, the user process proceeds to step 8907, and if the user process validity check fails, the user process determines that the received message is not valid and step 8916 Then, the user process, session error process is performed, and the forced data update process is terminated.
In step 8907, the user process releases the data compression of the terminal data 5231 of the uploaded data, and in step 8908, performs a data verification check to verify whether the terminal data has been tampered with.
If the data verification check is passed, the user process first changes the access time of the credit card list 24008 of the user information server to the latest information based on the terminal data whose data compression has been released in step 8909. Next, in step 8910, new terminal data is generated on the basis of the capacity of the actual data area of the personal credit terminal, the data generation time, and the access time. The update data 5108 is generated by taking the difference between the data and the new terminal data, and the generated update data is transmitted to the personal credit terminal in step 8912. In step 8913, the terminal data 24006 of the user information server is transmitted. To update the forced data update process.
If the data verification check fails, it is determined that the terminal data may have been tampered with, and the user process generates a function stop instruction 5108 ′ in step 8917, and in step 8918 In step 8919, the user status 24012 on the user information server is changed to “unusable”, and in step 8920, user process / session error processing is performed. Then, the compulsory data update process is terminated.

In the generation of new terminal data in step 8910, the data stored in the RAM is reorganized so that the temporary area becomes empty. In particular, if there is not enough space in the actual data area 21812, the access time of each credit card is compared, a local address is assigned to the object data address of the credit card with the latest access time, and each use The use times of information are compared, and a local address is assigned to the use information address of the use information with the latest use time. When the personal credit terminal program needs to be upgraded, the data in the basic program area is updated. However, the user area is updated to the user area data of the terminal data received from the personal credit terminal.
On the other hand, in the personal credit terminal, the compulsory data update process is started by receiving the data update command 5106 and generating a compulsory data update process.
First, in step 8800, the personal credit terminal decrypts the encryption of the data update command with the user's private key, and in step 8801 performs a user validity check to verify the validity of the data update command.
If the user validity check is passed, the personal credit terminal displays “data updating in progress” on the LCD in step 8802, and compresses the data in the RAM in step 8803 to generate upload data 5107. In step 8804, the generated upload data is transmitted to the user process.
If the user validity check fails, the personal credit terminal performs user session error processing at step 8811 and ends the forced data update processing.

In step 8805 and step 8812, the personal credit terminal that has transmitted the upload data waits for reception of a message from the user process. In step 8805, reception of a message is determined, and in step 8812, timeout is determined.
In the time-out determination in step 8812, if no message is received for the time-out time TDU (TDU> 0) or more, the personal credit terminal times out, and in step 8813, the user time-out error processing is performed to force End the data update process.
If a message from the user process is received, the personal credit terminal decrypts the received message with the user's private key in step 8806, performs a user validity check in step 8807, and checks the received message. Validate the effectiveness.
If the user validity check passes, the personal credit terminal proceeds to step 8808, and if the user validity check fails, the personal credit terminal performs user session error processing in step 8814. To end the forced data update process.
In step 8808, the personal credit terminal determines whether the received message is update data 5108 or a function stop command 5108 ′. If it is update data, the data of the terminal data 5239 of update data is determined in step 8809. The compression is released and the data in the RAM is updated. In step 8810, the display of “data update in progress” is released, and the forced data update process is terminated.
If the received message is a function stop command, the personal credit terminal displays “unusable” on the LCD in step 8815, clears the terminal enable bit in the EEPROM 1503 in step 8816, and In step 8817, the terminal status is changed to unusable and the compulsory data update process is terminated.

121 and 122 show the processing flow of the forced data update process of the credit settlement terminal and the merchant process of the service provision system in the forced data update process of the credit settlement terminal and the service provision system, respectively. Show.
The compulsory data update process is performed when the data of the RAM and the hard disk of the credit card settlement terminal 101 needs to be updated immediately, for example, when the service providing system 102 changes the content of the contract with the merchant. .
In step 9100, the merchant process first generates a data update instruction 5406. In step 9101, the merchant process determines whether or not a session is established from the terminal status. When the data update command is transmitted to the credit settlement terminal and the session is not established, a session establishment process is performed in step 9102 to establish a session with the service providing system, and then the process proceeds to step 9103.
In step 9104 and step 9113, the merchant process that has transmitted the data update command waits for reception of the upload data 5407. In step 9104, reception of upload data is determined, and in step 9113, timeout is determined.
In the time-out determination of step 9113, if the upload data is not received for the time-out time TUDM (TUDM> 0) or longer, the merchant process times out, and in step 9114, the merchant process time-out error processing is performed and forced. End the data update process.
If the upload data is received, the merchant process decrypts the received upload data with the service provider's private key in step 9105, and in step 9106 performs a merchant process validity check to verify the upload data validity. To verify.
If the merchant process validity check passes, the merchant process proceeds to step 9107, and if the merchant process validity check fails, the merchant process determines that the received message is not valid and step 9115 Then, the merchant process / session error process is performed, and the forced data update process is terminated.
In step 9107, the merchant process releases the data compression of the terminal data 5531 of the upload data, and in step 9108, performs a data matching check to verify whether the terminal data has been tampered with.

If the data verification check is passed, the merchant process first generates new terminal data in step 9109 based on the capacity of the actual data area of the credit settlement terminal and the data generation time, and in step 9110, The update data 5408 is generated by taking the difference between the terminal data whose data compression has been released and the new terminal data, and the generated update data is transmitted to the credit settlement terminal in step 9111. In step 9112, the merchant information The server terminal data 24104 is updated, and the compulsory data update process is terminated.
If the data verification check fails, it is determined that the terminal data may have been tampered with, and the merchant process generates a function stop instruction 5408 ′ in step 9116 and generates in step 9117. In step 9118, the merchant status 24012 on the merchant information server is changed to “unusable”, and in step 9119, merchant process / session error processing is performed. Then, the forced data update process is terminated.
In the generation of new terminal data in step 9109, the data stored in the RAM and the hard disk is reorganized so that the temporary area becomes empty. In particular, if there is not enough capacity in the actual data area, it is necessary to compare the sales time of each sales information, assign a local address to the sales information with the latest sales time, and upgrade the credit settlement terminal program. If there is, the basic program area data is also updated. However, the merchant area is updated to the merchant area data of the terminal data received from the credit settlement terminal.

On the other hand, in the credit settlement terminal, the compulsory data update process is started by receiving the data update command 5406 and generating a compulsory data update process.
First, in step 9000, the credit settlement terminal decrypts the encryption of the data update command with the merchant's private key, and in step 9001, performs the merchant validity check to verify the validity of the data update command.
If the merchant validity check is passed, the credit settlement terminal displays “data update in progress” on the LCD in step 9002, and in step 9003 compresses the data in the RAM and the hard disk to upload data. 5407 is generated, and in step 9004, the generated upload data is transmitted to the merchant process.
If the merchant validity check fails, the credit terminal performs merchant session error processing in step 9011 and ends the forced data update processing.
In step 9005 and step 9012, the credit settlement terminal that has transmitted the upload data waits for reception of a message from the merchant process. In step 9005, the reception of the message is determined, and in step 9012, a timeout is determined.
If the message is not received for the timeout time TDM (TDM> 0) or longer in the determination of the timeout in step 9012, the credit card payment terminal times out, and in step 9013, the merchant timeout error process is performed to force the data. Finish the update process.
When receiving a message from the merchant process, the credit card terminal decrypts the received message with the merchant's private key in step 9006, performs a merchant validity check in step 9007, and validates the received message. Verify sex.
If the merchant validity check passes, the credit payment terminal proceeds to step 9008. If the merchant validity check fails, the credit payment terminal performs merchant session error processing in step 9014, The forced data update process is terminated.
In step 9008, the credit settlement terminal determines whether the received message is the update data 5408 or the function stop command 5408 ′. The compression is released, the data in the RAM and the hard disk are updated, and in step 9010, the display of “data update in progress” is released, and the compulsory data update process is terminated.
If the received message is a function stop command, the credit settlement terminal displays “unusable” on the LCD in step 9015, clears the terminal enable bit in the EEPROM 1503 in step 9016, and operates. In step 9017, the terminal status is changed to unusable and the compulsory data update process is terminated.

Next, a processing flow in the data backup process will be described.
FIG. 123 and FIG. 116 respectively show the processing flow of the data update process of the personal credit terminal and the user process of the service providing system in the data backup processing of the personal credit terminal and the service providing system. The process of the user process is the same as the data update process.
The data backup process is started when the personal credit terminal generates a data backup process when the battery capacity of the personal credit terminal becomes Q or less.
First, in step 9200, the personal credit terminal displays “data update in progress” on the LCD, generates a data update request 5109 in step 9201, and determines whether or not a session is established from the terminal status in step 9202. If the session is established, the generated data update request is transmitted to the user process in step 9204. If the session is not established, session establishment processing is performed in step 9203, and the service providing system After establishing the session, go to Step 9204.
In step 9205 and step 9216, the personal credit terminal that has transmitted the data update request waits for reception of the data update response 5110. In step 9205, reception of a data update response is determined, and in step 9216, timeout is determined.
In the time-out determination in Step 9216, if the data update response is not received for the time-out time TRURU (TRURU> 0) or longer, the personal credit terminal times out, and in Step 9217, user time-out error processing is performed. End the data backup process.
If the data update response is received, the personal credit terminal decrypts the encryption of the data update response with the user's private key in step 9206, performs the user validity check in step 9207, and validates the data update response. To verify.
If the user validity check is passed, the personal credit terminal compresses the RAM data in step 9208 to generate upload data 5111, and in step 9209 sends the generated upload data to the user process. To do.
If the user validity check fails, the personal credit terminal performs user session error processing in step 9218 and ends the data backup processing.

In step 9210 and step 9219, the personal credit terminal that has transmitted the upload data waits for reception of a message from the user process. In step 9210, it is determined whether to receive a message. In step 9219, a timeout is determined.
In the time-out determination of step 9219, if no message is received for the time-out time TDU (TDU> 0) or longer, the personal credit terminal times out, and in step 9220, user time-out error processing is performed and data backup is performed. The process ends.
When receiving a message from the user process, the personal credit terminal decrypts the received message with the user's private key in step 9211, performs a user validity check in step 9212, and Validate the effectiveness.
If the user validity check is passed, the personal credit terminal proceeds to step 9213. If the user validity check fails, the personal credit terminal performs user session error processing in step 9221. To complete the data backup process.
In step 9213, the personal credit terminal determines whether the received message is the update data 5112 or the function stop command 5112 ′. The data compression of 5239 is released, the RAM data is updated, “Low Battery” is displayed in Step 9215, and the terminal status is changed to “Write Protected” in Step 9225. The data backup process is terminated in such a manner that no data is written to the RAM.
If the received message is a function stop command, the personal credit terminal displays “unusable” on the LCD in step 9222, clears the terminal enable bit in the EEPROM 1503 in step 9223, and In step 9224, the terminal status is changed to unusable, and the data backup process is terminated.

Next, a processing flow in the “settlement” process will be described.
124 to 125 show the processing flow of the credit settlement terminal in the “settlement” process. The “settlement” process is started by the credit settlement terminal 300 generating a settlement process when the merchant presses the credit settlement switch of the register.
First, in step 9300, the credit settlement terminal generates four types of payment offer responses 5701 corresponding to the contents of the payment offer 5700 received from the personal credit terminal. The four types of payment offer responses are a payment offer response indicating that the payment amount specified by the user is lower than the amount charged by the merchant, and a payment indicating that the user specifies a credit card that the merchant cannot handle An offer response, a payment offer response indicating that the user has specified a payment option that the merchant cannot handle, and a payment offer response indicating that the merchant can handle the user's payment offer.
These four types of payment offer responses are different in the response message 5809 and transaction number 5810 of the payment offer response (FIG. 89 (b)), and the payment amount specified by the user is lower than the invoice amount of the merchant. In the case of a payment offer response indicating “”, a message indicating that the payment amount is insufficient is set in the response message, and zero is set in the transaction number. In addition, in the case of a payment offer response indicating that the user specifies a credit card that the merchant cannot handle, a message indicating that the card cannot be used is set in the response message, and the transaction number is set to zero. The In the case of a payment offer response indicating that the user has specified a payment option that the merchant cannot handle, a message indicating that the payment option is not available is set in the response message, and the transaction number is set to zero. Is done. In the case of a payment offer response indicating that the merchant can handle the user's payment offer, a greeting message is set in the response message, and a non-zero number that uniquely indicates the transaction with the user is set in the transaction number. The
The credit settlement terminal that generated the four types of payment offer responses displays “Waiting for payment operation” on the LCD in Step 9301, and waits for reception of the payment offer 5700 by infrared communication in Step 9302.

When the payment offer is received from the personal credit terminal, the credit settlement terminal verifies the content of the received payment offer in steps 9303 to 9305.
If the payment amount of the payment offer is less than the invoiced amount, the credit card transaction terminal proceeds to step 9317 and sends a payment offer response indicating that the user-specified payment amount is lower than the merchant invoiced amount to the infrared payment amount. By communication, the data is transmitted to the personal credit terminal. In Step 9318, the LCD displays an insufficient amount of payment, returns to Step 9302, and waits for receipt of a payment offer again.
If the service code of the payment offer does not exist in the service code list of the credit settlement terminal, the credit settlement terminal proceeds to step 9319 and indicates that the user designates a credit card that cannot be handled by the merchant. A payment offer response is transmitted to the personal credit terminal by infrared communication. In step 9320, the LCD displays that the credit card cannot be handled, returns to step 9302, and waits for receipt of the payment offer again.
If the payment option code of the payment offer does not exist in the service code list of the credit settlement terminal, the credit settlement terminal proceeds to step 9321 and confirms that the user has specified a payment option that the merchant cannot handle. A payment offer response shown is transmitted to the personal credit terminal by infrared communication. In step 9322, the LCD displays that the payment option cannot be handled, returns to step 9302, and waits for receipt of the payment offer again.

Otherwise, the credit card payment terminal proceeds to step 9306 and sends a payment offer response to the personal credit terminal via infrared communication indicating that the merchant can handle the user's payment offer, and then step 9307 In step 9308, a credit inquiry request 5702 is generated from the payment offer and the payment offer response. In step 9309, the terminal status is used to determine whether the session is established. If it is determined that the session is in the established state, the generated trust inquiry request is transmitted to the merchant process in step 9131. If it is not in the session established state, a session establishment process is performed in step 9310 to establish a session with the service providing system. Then, the process proceeds to step 9131.
The credit settlement terminal that has transmitted the credit inquiry request waits for reception of the credit inquiry response 5704 in steps 9132 and 9323. In step 9132, reception of a credit inquiry response is determined, and in step 9323, a timeout is determined.
In the time-out determination in Step 9323, if the credit inquiry response is not received for the time-out time TAR (TAR> 0) or longer, the credit settlement terminal times out, and in Step 9324, merchant time-out error processing is performed. The “settlement” process is terminated.
When the credit inquiry response is received, the credit settlement terminal decrypts the encryption of the credit inquiry response with the merchant's private key in step 9133, and performs the merchant validity check in step 9134 to confirm the validity of the credit inquiry response. Validate.
If the merchant validity check passes, the credit payment terminal proceeds to step 9315. If the merchant validity check fails, in step 9325, the merchant session error processing is performed and the “settlement” process is performed. Exit.
In step 9315, the credit payment terminal determines the credit inquiry result of the credit inquiry response. If the credit inquiry fails, the credit inquiry terminal displays the credit inquiry result on the LCD in step 9326 and ends the “settlement” process. If the credit inquiry is passed, in step 9316, the credit inquiry result and the contents of the user personal data are displayed on the LCD.
The credit settlement terminal displaying the credit inquiry result and the contents of the user personal data on the LCD waits for the settlement processing request operation 20616 by the merchant in step 9400 and step 9413. In step 9400, the settlement processing request operation by the merchant is determined, and in step 9413, a timeout is determined.
In the time-out determination in step 9413, if the payment processing request operation by the merchant is not performed for the time-out time TMAO (TMAO> 0) or longer, the credit payment terminal times out, and in step 9414 the merchant time-out error processing To complete the “settlement” process.
When a payment processing request operation is performed by the merchant, the credit payment terminal displays “settlement in progress” on the LCD in step 9401, and generates a payment request 5705 from the payment offer and the payment offer response in step 9402. In step 9403, the generated settlement request 5705 is transmitted to the merchant process.

The credit payment terminal that has transmitted the payment request 5705 to the merchant process waits to receive a payment completion notification 5708 from the merchant process in steps 9404 and 9415. In Step 9404, it is determined whether or not the payment completion notice 5708 is received. In Step 9415, a timeout is determined.
In the determination of timeout in step 9415, if the payment completion notification 5708 is not received for the timeout time TSPCC (TSPCC> 0) or more, the credit payment terminal times out, and in step 9416, merchant timeout error processing is performed. The “settlement” process is terminated.
When the payment completion notification 5708 is received, the credit payment terminal decrypts the received payment completion notification 5708 with the merchant's private key in step 9405, performs the merchant validity check in step 9406, and receives the received message. Verify the effectiveness of.
If the merchant validity check passes, the credit payment terminal proceeds to step 9407, and if the merchant validity check fails, the credit payment terminal performs merchant session error processing in step 9417, The “settlement” process is terminated.
In step 9407, the credit settlement terminal generates a receipt 5709. In step 9408, the credit settlement terminal transmits the generated receipt 5709 to the merchant process. In step 9409, the settlement completion notification 5708 decrypted in the encryption is stored in the temporary area of the RAM. In step 9410, the sales history list and the sales history list / address are updated. , “Settlement completed” is displayed. In step 9412, it is determined whether or not data update processing is necessary from the free space in the temporary area. If the free space in the temporary area is equal to or greater than the set value AM (AM> 0), the “settlement” When the processing of "" is completed and the value is smaller than the set value AM, a data update process is generated, and the process proceeds to the data update process.

126 to 127 show the processing flow of the merchant process in the “settlement” processing.
In the merchant process, the process of “settlement” is started by receiving a credit inquiry request 5702 from a credit settlement terminal. The merchant process first decrypts the received credit reference request cipher with the service provider's private key in step 9500, and in step 9501 performs a merchant process validity check to verify the validity of the credit reference request. .
If the merchant process validity check is passed, the merchant process determines in step 9502 whether or not it belongs to the process group based on the value of the service / director process ID in the merchant process management information, and belongs to the process group. If it is (service director process ID ≠ 0), in step 9515, the cipher decryption trust inquiry request is sent to the service director process, and if not belonging to the process group (service director process ID) = 0), in step 9503, a trust query request with the decrypted cipher is sent to the service manager process.
If the merchant process validity check fails, the merchant process determines that the received message is not valid, performs merchant process session error processing at step 9514, and ends the "settlement" process.
The merchant process that sent the credit inquiry request to the service director process or service manager process waits to receive a trust inquiry response 5840 from the service director process in step 9504. Upon receipt of the credit inquiry response 5840 from the service director process, the merchant process seals the credit inquiry response 5840 to the merchant in step 9505 and sends the credit inquiry response 5704 to the credit payment terminal in step 9506. .
In step 9507, the merchant process that transmitted the credit inquiry response 5704 to the credit settlement terminal waits to receive a settlement request 5705 from the credit settlement terminal. Upon receipt of the payment request 5705 from the credit payment terminal, the merchant process decrypts the encryption of the received payment request 5705 with the service provider's private key in step 9508, and in step 9509 performs a merchant process validity check, Validity of settlement request 5705 is verified.
If the merchant process validity check is passed, the merchant process sends the decryption payment request 5705 to the service director process in step 9510, and if it fails the merchant process validity check, it receives it. It is determined that the received message is not valid, and in step 9516, merchant process / session error processing is performed, and the “settlement” processing is terminated.

In step 9511, the merchant process that has transmitted the settlement request to the service director process waits to receive a settlement completion notification 5937 from the service director process. When the payment completion notification 5937 is received from the service director process, the merchant process seals the payment completion notification 5937 to the merchant in step 9512 and transmits the payment completion notification 5708 to the credit payment terminal in step 9513.
In step 9600, the merchant process that has transmitted the payment completion notice 5708 to the credit payment terminal waits to receive a receipt 5709 from the credit payment terminal. Upon receipt of the receipt 5709 from the credit payment terminal, the merchant process decrypts the received receipt 5709 with the service provider's private key in step 9601, and in step 9602 performs a merchant process validity check, Verify the validity of receipt 5709.
If the merchant process validity check passes, the merchant process sends the decrypted receipt 5709 to the service director process in step 9603, and in step 9604 the sales history list on the merchant information server. And the sales history list / address are updated, and the “settlement” process is terminated.

If the merchant process validity check fails, the merchant process determines that the received message is not valid, performs merchant process session error processing at step 9605, and ends the "settlement" process.
128 to 129 show a processing flow of the personal credit terminal in the “settlement” process. The process of “settlement” is started when the personal credit terminal generates a settlement process when the user performs a payment operation.
In step 9700, the personal credit terminal first generates a payment offer 5700 based on the credit card, the payment amount, and the payment option specified by the user in the payment operation. It is transmitted to the credit settlement terminal by communication.
In step 9702 and step 9713, the personal credit terminal that has transmitted the payment offer to the credit settlement terminal waits for reception of the payment offer response 5701. In step 9702, it is determined whether or not a payment offer response has been received. In step 9713, a timeout is determined.
In the determination of timeout in step 9713, if the payment offer response is not received for the timeout time TPOR (TPOR> 0) or more, the personal credit terminal times out, and in step 9714, the LCD displays the payment offer response timeout timeout. An error is displayed and the “settlement” process is terminated.

If a payment offer response is received, the personal credit terminal checks the service provider's digital signature on the service provider phone number in the payment offer response in step 9703 and passes the signature check. In Step 9704, if it fails, it is determined that the payment offer response is not valid. In Step 9715, an error in the payment offer response is displayed on the LCD, and the “settlement” process is terminated.
In step 9704, the personal credit terminal determines from the transaction number value of the payment offer response whether or not the payment offer transmitted to the credit settlement terminal has contents that the merchant can handle. If the transaction number in the payment offer response is not zero, the payment offer is content that the merchant can handle and the personal credit terminal proceeds to step 9705. If the transaction number in the payment offer response is zero, the payment offer is a content that the merchant cannot handle and the personal credit terminal displays an error in the payment offer response on the LCD in step 9716 to “settlement”. Terminate the process.
In step 9705, the personal credit terminal checks the payment amount of the payment offer with the charge amount of the payment offer response. If the payment amount and the charge amount are equal, the process proceeds to step 9708, where the payment amount is charged. If it is larger than the amount of money, a screen for confirming the amount of payment shown in FIG. 44 (i) is displayed on the LCD in step 9706. In steps 9707 and 9717, a confirmation operation by the user is awaited. If the confirmation operation is performed, the personal credit terminal proceeds to Step 9708. In step 9707, the personal credit terminal determines a confirmation operation by the user, and in step 9717 determines a timeout.
In the time-out determination in step 9717, if the confirmation operation is not performed for the time-out time TUAO (TUAO> 0) or more, the personal credit terminal times out, and in step 9718, the confirmation operation time-out error is displayed on the LCD. Is displayed and the “settlement” process is terminated.

The personal credit terminal displays “payment processing in progress” on the LCD in step 9708, and then generates a payment request 5703 from the payment offer and payment offer response in step 9709, and in step 9710, From the terminal status, it is determined whether or not the session is established. If the session is established, the generated payment request is transmitted to the user process in step 9712. Session establishment processing is performed to establish a session with the service providing system, and then the process proceeds to step 9712.
In the session establishment process of step 9971, the personal credit terminal calls the service provider telephone number of the payment offer response and connects to the service provision system in the merchant's home service area. In other words, if the personal credit terminal has already established a session with the service providing system during the “settlement” process, the personal credit terminal performs the “settlement” process with the service providing system, In addition, when establishing a session with the service providing system, a “settlement” process is performed with the service providing system in the service area where the merchant is located.
In step 9800 and step 9807, the personal credit terminal that has transmitted the payment request waits to receive a receipt 5710 from the user process. In step 9800, reception of receipt 5710 is determined. In step 9807, timeout is determined.
In the determination of timeout in step 9807, if the receipt 5710 is not received for the timeout time TSPR (TSPR> 0) or more, the personal credit terminal times out, and in step 9808, user timeout error processing is performed. The “settlement” process is terminated.

If the receipt 5710 is received, the personal credit terminal decrypts the receipt 5710 with the user's private key in step 9801, performs a user validity check in step 9802, and validates the receipt 5710. To verify.
If the user validity check is passed, the personal credit terminal proceeds to step 9803. If the user validity check fails, the personal credit terminal performs user session error processing in step 9809. To complete the “settlement” process.
In step 9803, the personal credit terminal stores the receipt 5710 decrypted in the cipher in the temporary area of the RAM, and in step 9804, updates the usage history list and the usage history list address, The receipt is displayed on the LCD. In step 9806, it is determined from the free space in the temporary area whether or not data update processing is necessary. When the processing of "" is finished and the value is smaller than the set value AU, a data update process is generated, and the process proceeds to the data update process.

FIG. 130 shows the process flow of the user process in the “settlement” process.
In the user process, the “settlement” process is started by receiving a payment request 5703 from the personal credit terminal. First, in step 9900, the user process decrypts the received payment request with the service provider's private key. In step 9901, the user process performs a user process validity check to verify the validity of the payment request.
If the user process validity check is passed, the user process determines in step 9902 whether or not it belongs to the process group from the value of the service / director process ID of the user process management information, and belongs to the process group. If it is (service director process ID ≠ 0), in step 9909, the payment request with the decrypted cipher is transmitted to the service director process, and if not belonging to the process group (service director process ID = 0), in step 9903, the payment request decrypted by the encryption is transmitted to the service manager process.
If the user process validity check fails, the user process determines that the received message is not valid, performs user process / session error processing in step 9908, and ends the “settlement” processing.

The user process that sent the payment request to the service director process or service manager process waits to receive receipt 6016 from the service manager process in step 9904. Upon receipt of the receipt 6016 from the service manager process, the user process seals the receipt 6016 to the user in step 9905, sends the receipt 5710 to the personal credit terminal in step 9906, and In step 9907, the usage history list and the usage history list / address on the user information server are updated, and the “settlement” process is terminated.
FIG. 131A shows the processing flow of the payment system in the “settlement” process. The “settlement” process is started by receiving a settlement request 5706 from the settlement processing organization process of the service providing system.
First, in step 10000, the payment system decrypts the encryption of the received payment request 5706 with the private key of the payment processing institution, and in step 10001, checks the validity of the payment processing institution and verifies the validity of the payment request 5706. To do.
If the payment processor validation is passed, the payment system updates the data of the subscriber information server, the member store information server, and the transaction information server based on the payment request 5706 in step 10002. In step 10003, a payment completion notification 5707 is generated. In step 10004, the generated payment completion notification 5707 is transmitted to the payment processing institution process, and the “settlement” process ends.

If the settlement processor validity check fails, the settlement system determines that the received message is not a valid message, performs a settlement processor session error process in step 10005, and sets the “settlement” The process ends. In the settlement processor session error processing, the settlement system sends a session error message to the settlement system management system, and sends a session error message to the settlement processing organization process of the service providing system. Disconnect the line.
In addition, the payment processing institution validity check is a process for verifying the validity of the message received from the payment processing institution process of the service providing system. As shown in FIG. 131 (b), in the payment processing institution validity check, Four types of verification are performed. First, in step 10006, the service provider's digital signature is verified, in step 10007, the service provider ID is verified, in step 10008, the validity period of the received message is verified, and further received in step 10009. Validate message issue time. In the issuance time verification in step 10009, the deviation between the issuance time of the received information and the current time is verified. If the deviation is equal to or greater than the time TTP (TTP> 0), it is determined that the information is invalid. . Therefore, only when the service provider's digital signature is verified, the service provider ID matches, the validity period is verified, and the issue time is verified, the settlement processor validity check is passed. Judgment is made. Otherwise, it is judged that a failure has occurred.

FIG. 132 (a) shows the processing flow of the payment processing institution process in the “settlement” process. In the payment processing organization process, the processing of “settlement” is started by receiving a payment request 5910 from the service director process.
The payment processing organization process first seals the payment request 5910 to the payment processing organization in step 10100, and transmits the payment request 5706 to the payment system in step 10101.
In step 10102, the payment processing institution process that has transmitted the payment request 5706 to the payment system waits to receive a payment completion notification 5707 from the payment system. Upon receipt of the payment completion notification 5707 from the payment system, the payment processing institution process decrypts the received payment completion notification 5707 with the service provider's private key in step 10103, and in step 10104 the payment processing institution process is enabled. A validity check is performed to verify the validity of the settlement completion notification 5707.
If the settlement processor process validity check is passed, the settlement processor process sends a settlement completion notification 5707 with decrypted encryption to the service director process in step 10105. In step 10106, the settlement processor process The settlement history list and settlement history list address on the information server are updated, and the “settlement” process is terminated.

If the payment processor process validity check fails, the payment processor process determines that the received message is not valid, performs payment processor process session error handling in step 10107, Terminate the process. Due to the clearing house process session error handling, the clearing house process is deleted by the service manager process and the line with the clearing system is disconnected. At this time, the payment processing institution process transmits to the management system 407 a session error message indicating that an invalid message has been received.
The payment processing organization process validity check is a processing for verifying the validity of information received from the payment system. As shown in FIG. 132 (b), the payment processing organization process validity check includes three types of verification. To do. First, in step 10108, the digital signature of the payment processing organization is verified, in step 10109, the payment processing organization ID is verified, and in step 10110, the issue time of the received information is verified. In the issuance time verification in step 10110, the deviation between the issuance time of the received information and the current time is verified. If the deviation is equal to or greater than the time TTPP (TTPP> 0), it is determined that the information is invalid. . Therefore, it is determined that the payment processing organization process validity check is passed only when the payment processing organization digital signature is verified, the payment processing organization ID matches, and the issue time verification is passed, and otherwise. Is determined to have failed.

133 to 134 show the processing flow of the service director process in the “settlement” process.
In the service director process, when a credit inquiry request 5820 and a payment request 5827 are received from a service manager process, or when a credit inquiry request 5820 is received from a merchant process, or from a user process, a payment request 5827 is received. The “settlement” process is started in the three cases of receiving.
If a credit inquiry request 5820 is received from the merchant process, the service director process waits in step 10216 to receive a payment request 5827 from the user process, and upon receiving a payment request 5827 from the user process, step 10200 Proceed to
Also, if the payment request 5827 is received from the user process, the service director process waits to receive the credit inquiry request 5820 from the merchant process in step 10217, and receives the credit inquiry request 5820 from the merchant process. Go to step 10200.
If a credit inquiry request 5820 and a payment request 5827 are received from the service manager process, the service director process proceeds directly to step 10200 to check the validity of the credit inquiry request 5820 and the payment request 5827. . In the validity check of the credit inquiry request and the payment request in step 10200, the service director process data on the payment offer and payment offer response part of the credit inquiry request and the payment offer and payment offer response part of the payment request. Validate the validity of the payment offer and payment offer response and verify the validity period of the payment offer and payment offer response, and pass the validity check of the credit inquiry request and payment request only if the data match matches and the validity period passes Otherwise, it is determined as fail.

If the validity check of the credit inquiry request and the payment request fails, the service director process performs service director process session error processing in step 10212 and ends the processing of “settlement”. By the service director process session error handling, the service director process and the user process and merchant process in the same process group as the service director process are deleted by the service manager process. At this time, the service director process transmits to the management system 407 a session error message indicating that an invalid message has been received.
If the credit check request and payment request validity check is passed, the service director process first refers to the merchant customer table in step 10201 to identify the customer number corresponding to the user ID of the payment request. Then, in step 10202, the information on the user information server corresponding to the user is accessed to generate a trust query response 5840, and in step 10203, the generated trust query response 5840 is sent to the merchant process, and In step 10204, the service provision history list 4303 is updated by adding the credit provision service provision history to the service provision history list 4303.

In generating the trust inquiry response 5840 at step 10202, the service director process does not set the user personal data 5834 if there is a problem with the user's credit status. Further, when there is no transaction by the personal remote credit settlement service between the user and the merchant before, the customer number corresponding to the user ID cannot be specified, so the customer number 5836 is not set also in this case.
In step 10204, the service director process that has updated the service provision history list waits in steps 10205 and 10213 to receive a payment request 5850 from the merchant process. In step 10205, reception of the payment request 5850 is determined, and in step 10213, timeout is determined.
In the time-out determination in step 10213, if the settlement request 5850 is not received for the time-out time TCR (TCR> 0) or longer, the service director process times out, and in step 10214, the service director process time-out error processing is performed. To complete the “settlement” process. By the service director process timeout error handling, the service director process and the user process and merchant process in the same process group as the service director process are deleted by the service manager process. At this time, the service director process transmits to the management system 407 a timeout error message indicating that timeout has occurred.

If the payment request 5850 is received from the merchant process, the service director process checks the validity of the payment request 5850 at step 10206. In the payment request validity check in step 10206, the service director process performs data matching between the payment offer and payment offer response portion of the payment request 5850 and the payment offer and payment offer response portion of the payment request, and the payment request. When the reference number of 5850 is matched with the reference number of the credit inquiry response and the validity period of the settlement request 5850 is verified, the data match is matched, the reference number is matched, and the validity period validation is passed Only if it is determined that the validity check of the settlement request has been passed, otherwise it is determined to be a failure.
If the payment request validity check fails, the service director process performs service director process session error processing at step 10215 and ends the “settlement” processing.
If the payment request validity check is passed, the service director process refers to the payment processing organization table 4304 in step 10207, selects a payment processing organization that requests the payment processing, and in step 10208 selects the service processing service. Send a member process request to the manager process, request a payment processor process corresponding to the selected payment processor as a member process of the same process group, and in step 10209, the requested payment processor process Wait to become a member process.

When the requested payment processor process becomes a member process, the service director process, in step 10210, information on the user information server corresponding to the user, information on the merchant information server corresponding to the merchant, and the payment processor To the information on the payment processing institution information server corresponding to, and generates a payment request 5910. In step 10211, the generated payment request 5910 is transmitted to the payment processing institution process.
In step 10300 and step 10311, the service director process that has transmitted the settlement request 5910 waits to receive a settlement completion notification 5927 from the settlement processing institution process. In step 10300, it is determined whether or not the payment completion notice 5927 is received. In step 10311, a timeout is determined.
In the determination of timeout in step 10311, if the payment completion notification 5927 is not received for the timeout time TTPCC (TTPCC> 0) or longer, the service director process times out, and in step 10312, the service director process timeout error occurs. The process is performed, and the “settlement” process ends.
If the payment completion notice 5927 is received from the payment processing institution process, the service director process determines in step 10301 whether there is a customer number corresponding to the user. If there is a customer number, the process proceeds to step 10303. If there is no customer number, in step 10302, a customer number uniquely indicating the user to the merchant is generated and registered in the merchant's customer table, and the process proceeds to step 10303.
In step 10303, the service director process generates a payment completion notification 5937 to the merchant from the payment completion notification 5927 and the payment request 5850. In step 10304, the service director process transmits the generated payment completion notification 5937 to the merchant process.
In step 10305 and step 10313, the service director process that has transmitted the payment completion notice 5937 waits to receive a receipt 6008 from the merchant process. In step 10305, reception of the receipt 6008 is determined, and in step 10313, timeout is determined.

If the receipt 6008 is not received for the time-out time TMR (TMR> 0) or more in the time-out determination at Step 10313, the service director process times out, and at Step 10314, the service director process time-out error processing is performed. To complete the “settlement” process.
When receiving the receipt 6008 from the merchant process, the service director process generates a receipt 6016 to the user from the receipt 6008 and the settlement completion notification 5927 in step 10306, and in step 10307 the generated receipt 6016 is generated. Is transmitted to the user process, and in step 10308, the service provision history list 4303 is updated by adding the credit settlement service provision history to the service provision history list 4303.
In step 10309, the service director process that has updated the service provision history list 4303 waits for the user process to complete the “settlement” process. When the user process completes the “settlement” process, the service director process proceeds to step 10310. -Sends the process deletion request of the director process itself to the service manager process, and ends the "settlement" process. By sending the process erase request in step 10310, the service director process is erased by the service manager process.

Next, a processing flow in the “cancel” process will be described.
FIG. 135 shows a processing flow of the credit settlement terminal in the “cancel” process. The “cancel” process starts when the merchant performs a cancel operation 901 and the credit settlement terminal 300 generates a cancel process.
First, in step 10400, the credit settlement terminal displays “sale cancel processing in progress” on the LCD. In step 10401, the credit settlement terminal generates a cancel request 6100 from the settlement completion notification 5937 of the transaction to be canceled. In step 10402, the terminal It is determined from the status whether the session is established. If the session is established, the generated cancel request is sent to the merchant process in step 10404. If the session is not established, the session is established in step 10403. Processing is performed to establish a session with the service providing system, and then the process proceeds to step 10404.
In step 10405 and step 10412, the credit settlement terminal that has transmitted the cancellation request waits to receive a cancellation completion notification 6104 from the merchant process. In step 10405, reception of the cancellation completion notification 6104 is determined, and in step 10412, timeout is determined.

In the time-out determination in step 10412, if the cancellation completion notification 6104 is not received for the time-out time TSPCC (TSPCC> 0) or longer, the credit settlement terminal times out, and in step 10413 performs merchant time-out error processing. The “Cancel” process is terminated.
When the cancellation completion notification 6104 is received, the credit settlement terminal decrypts the encryption of the received cancellation completion notification 6104 with the merchant's private key in step 10406, performs the merchant validity check in step 10407, and receives the received message. Verify the effectiveness of.
If the merchant validity check passes, the credit payment terminal proceeds to step 10408. If the merchant validity check fails, the credit payment terminal performs merchant session error processing in step 10414, The “Cancel” process is terminated.
In step 10408, the credit settlement terminal stores the cancellation completion notification 6104 obtained by decrypting the cipher in the temporary area of the RAM. In step 10409, the credit settlement terminal updates the sales history list and the sales history list / address. The completion of the cancellation process is displayed on the LCD. In step 10411, it is determined whether or not data update processing is necessary from the free space in the temporary area. If the free space in the temporary area is greater than or equal to the set value AM (AM> 0), “Cancel” is left as it is. When the processing of "" is completed and the value is smaller than the set value AM, a data update process is generated, and the process proceeds to the data update process.

FIG. 136 shows a process flow of the merchant process in the “cancel” process.
In the merchant process, the “cancel” process is started by receiving a cancel request 6100 from the credit settlement terminal. First, in step 10500, the merchant process decrypts the received cancel request with the private key of the service provider, and in step 10501 performs a merchant process validity check to verify the validity of the cancel request.
If the merchant process validity check is passed, in step 10502, the merchant process determines whether it belongs to the process group based on the value of the service / director process ID of the merchant process management information, and belongs to the process group. If it is (service director process ID ≠ 0), a cancel request for decrypting the cipher is transmitted to the service director process in step 10509, and if not belonging to the process group (service director process ID =). 0), at step 10503, a cancel request for decrypting the cipher is sent to the service manager process.
If the merchant process validity check fails, the merchant process determines that the received message is not valid, performs merchant process session error processing at step 10508, and ends the “cancel” processing.
In step 10504, the merchant process that has transmitted the cancel request 6205 to the service director process or the service manager process waits to receive a cancel completion notification 6241 from the service director process.
Upon receipt of the cancellation completion notification 6241 from the service director process, the merchant process seals the cancellation completion notification 6241 to the merchant in step 10505, and transmits the cancellation completion notification 6104 to the credit settlement terminal in step 10506. In step 10507, the sales history list and the sales history list address on the merchant information server are updated, and the “cancel” process is terminated.

FIG. 137 shows the process flow of the personal credit terminal in the “cancel” process. The “cancel” process is started when the personal credit terminal generates a cancel process when the user performs a cancel operation 904.
First, in step 10600, the personal credit terminal displays “payment cancellation processing in progress” on the LCD. Next, in step 10601, the personal credit terminal generates a cancel request 6101 from the receipt 6016 of the transaction to be canceled. In 10602, it is determined whether or not the session is established from the terminal status.If the session is established, the generated cancel request 6101 is transmitted to the user process in step 10604. In step 10603, session establishment processing is performed to establish a session with the service providing system, and then the process proceeds to step 10604.
In step 10605 and step 10612, the personal credit terminal that has transmitted the cancel request 6101 waits to receive a cancel processing receipt 6105 from the user process. In step 10605, reception of the cancel processing receipt 6105 is determined, and in step 10612, timeout is determined.
In the time-out determination at step 10612, if the cancel processing receipt 6105 is not received for the time-out time TSPCR (TSPCR> 0) or longer, the personal credit terminal times out, and at step 10613, the user time-out error processing is performed. To complete the “cancel” process.
When receiving the cancellation processing receipt 6105, the personal credit terminal decrypts the encryption of the cancellation processing receipt 6105 with the user's private key in step 10606, performs the user validity check in step 10607, and cancels the processing. Verify the validity of receipt 6105.
If the user validity check is passed, the personal credit terminal proceeds to step 10608. If the user validity check fails, the personal credit terminal performs user session error processing in step 10614. To complete the “cancel” process.

  In step 10608, the personal credit terminal stores the cancellation processing receipt 6105 obtained by decrypting the cipher in the temporary area of the RAM, and in step 10609, updates the usage history list and the usage history list address. In step 10610, a cancellation processing receipt is displayed on the LCD. In step 10611, it is determined whether or not data update processing is necessary from the free space in the temporary area. If the free space in the temporary area is greater than or equal to the set value AU (AU> 0), the “cancel” operation is continued. When the processing of "" is completed and the value is smaller than the set value AU, a data update process is generated, and the process proceeds to the data update process.

FIG. 138 shows the process flow of the user process in the “cancel” process.
In the user process, the “cancel” process is started by receiving a cancel request 6101 from the personal credit terminal. First, in step 10700, the user process decrypts the received cancel request 6101 using the service provider's private key, and in step 10701, the user process is checked for validity to verify the validity of the cancel request 6101. .
If the user process validity check is passed, the user process determines in step 10702 whether or not it belongs to the process group from the value of the service / director process ID of the user process management information, and belongs to the process group. If it is determined (service director process ID ≠ 0), a cancel request 6101 for decrypting the cipher is transmitted to the service director process in step 10709, and if not belonging to the process group (service director process ID) = 0), in step 10703, a cancel request 6101 obtained by decrypting the cipher is transmitted to the service manager process.

If the user process validity check fails, the user process determines that the received message is not valid, performs user process session error processing at step 10708, and ends the "cancel" processing.
In step 10704, the user process that has transmitted the cancel request 6213 to the service director process or the service manager process waits to receive a cancel processing receipt 6250 from the service director process. Upon receipt of the cancel processing receipt 6250 from the service director process, the user process seals the cancel processing receipt 6250 to the user in step 10705, and in step 10706, the cancel processing receipt 6105 is personal credited. In step 10707, the usage history list and the usage history list / address on the user information server are updated, and the “cancel” process is terminated.

FIG. 139 shows the processing flow of the payment system in the “cancel” process. The “cancel” process is started by receiving a cancel request 6102 from the payment processing organization process of the service providing system.
First, in step 10800, the payment system decrypts the received cancellation request 6102 using the payment processing institution's private key, and in step 10801, checks the validity of the payment processing institution and verifies the validity of the cancellation request 6102. To do.
If the payment processor validation is passed, the payment system updates the data of the subscriber information server, the member store information server, and the transaction information server based on the cancel request 6102 in step 10802. , Cancel the credit settlement process, generate a cancellation completion notification 6103 in step 10803, and send the generated cancellation completion notification 6103 to the settlement processing institution process in step 10804 to complete the “cancel” process. To do.
If the settlement processor validity check fails, the settlement system determines that the received message is not a valid message, and in step 10805, performs a settlement processor session error process to process “cancel”. Exit.

FIG. 140 shows the processing flow of the payment processing institution process in the “cancel” process. In the payment processor process, the “cancel” process is started by receiving a cancel request 6221 from the service director process.
The payment processing organization process first seals the cancellation request 6221 to the payment processing organization in Step 10900, and transmits the cancellation request 6102 to the payment system in Step 10901.
In step 10902, the payment processing institution process that has transmitted the cancellation request 6102 to the payment system waits to receive a cancellation completion notification 6103 from the payment system. Upon receipt of the cancellation completion notification 6103 from the payment system, the payment processing organization process decrypts the received cancellation completion notification 6103 with the service provider's private key in step 10903, and in step 10904, the payment processing organization process is enabled. A validity check is performed to verify the validity of the cancellation completion notification 6103.
If the settlement processor process validity check is passed, the settlement processor process sends a cancellation completion notification 6103 with the decrypted cipher to the service director process in step 10905. In step 10906, the settlement processor process The settlement history list and settlement history list address on the information server are updated, and the “cancel” process is terminated.
If the payment processor process validity check fails, the payment processor process determines that the received message is not valid, and in step 10907 performs payment processor process session error handling and “cancel”. Terminate the process.

FIG. 141 shows the process flow of the service director process in the “cancel” process.
In the service director process, when the cancel request 6205 and the cancel request 6213 are received from the service manager process, or when the cancel request 6205 is received from the merchant process, or the cancel request 6213 is received from the user process. In the three cases, the “cancel” process is started.
When the cancel request 6205 is received from the merchant process, the service director process waits to receive the cancel request 6213 from the user process in Step 11016. When the cancel request 6213 is received from the user process, the process proceeds to Step 11000. move on.
If the cancel request 6213 is received from the user process, the service director process waits to receive the cancel request 6205 from the merchant process in Step 11017, and receives the cancel request 6205 from the merchant process. Proceed to 11000.
When the cancel request 6205 and the cancel request 6213 are received from the service manager process, the service director process proceeds to step 11000 and checks the validity of the cancel request 6205 and the cancel request 6213. In the validity check of the cancel request 6205 and the cancel request 6213 in step 11000, the service director process performs data verification between the settlement completion notification 5937 of the cancel request 6205 and the data on the merchant information server, and a receipt 6016 of the cancel request 6213. Data verification with the data on the user information server, the verification number of the settlement completion notification 5937 of the cancellation request 6205 and the settlement number of the receipt 6016 of the cancellation request 6213, and the validity period of the cancellation request 6205 and the cancellation request 6213 Only when the payment completion notification 5937 and receipt 6016 data match, the payment number matches, and the validity period is passed, the validity check of the cancellation request and payment request is performed. It determines with having passed, and it determines with it failing otherwise.

When the validity check of the cancellation request and the payment request fails, the service director process performs service director process session error processing in step 11013 and ends the “cancel” processing.
If the validity check of the cancellation request and payment request is passed, the service director process sends a member process request to the service manager process in step 11001 to cancel as a member process of the same process group. A payment processing institution process corresponding to the payment processing institution that has performed the credit payment processing of the transaction to be performed is requested, and in step 11002, the requested payment processing institution process waits to become a member process.
When the requested payment processing institution process becomes a member process, the service director process accesses the information on the payment processing institution information server corresponding to the payment processing institution in step 11003, generates a cancel request 6221, At 11004, the generated cancel request 6221 is transmitted to the payment processing organization process.
In step 11005 and step 11014, the service director process that has transmitted the cancel request 6221 waits to receive a cancel completion notification 6232 from the payment processing institution process. In step 11005, reception of the cancel completion notification 6232 is determined, and in step 11014, timeout is determined.
In the time-out determination at Step 11014, if the cancel completion notification 6232 is not received for the time-out time TTPCC (TTPCC> 0) or longer, the service director process times out, and at Step 11015, the service director process time-out error occurs. The process is performed, and the “cancel” process ends.

When receiving the cancellation completion notification 6232 from the payment processor process, the service director process generates a cancellation completion notification 6241 to the merchant from the cancellation completion notification 6232 and the cancellation request 6205 in step 11006, and in step 11007. A cancellation processing receipt 6250 is generated from the cancellation request 6213 and the cancellation completion notification 6232 to the user. In step 11008, the generated cancellation completion notification 6241 is transmitted to the merchant process. In step 11009, the cancellation processing generated The receipt 6250 is transmitted to the user process. Further, in step 11010, the service provision history list 4303 is updated by adding the service provision history of the credit settlement cancellation to the service provision history list 4303.
In step 11011, the service director process that updated the service provision history list 4303 waits for the merchant process and the user process to complete the “cancel” process, and the merchant process and the user process “cancel”. When the process "" is completed, in step 11012, a process deletion request for the service director process itself is transmitted to the service manager process, and the "cancel" process is terminated. By sending the process erase request in step 11012, the service director process is erased by the service manager process.

Next, a processing flow in the “customer service call” processing will be described. FIG. 142 shows a processing flow of the credit settlement terminal in the “customer service call” processing. The processing of the “customer service call” is started by the credit settlement terminal 300 generating a customer service call process when the merchant performs a customer service call operation.
First, in step 11100, the credit card terminal displays “connection processing in progress” on the LCD. In step 11101, a customer service call request 6300 is generated. If the session is established, in step 11104, the generated customer service call request 6300 is transmitted to the merchant process. If the session is not established, session establishment processing is performed in step 11103 to provide the service. After establishing a session with the system, the process proceeds to step 11104.
In step 11105 and step 11113, the credit terminal that has transmitted the customer service call request 6300 waits to receive a customer service call response 6302 from the merchant process. In step 11105, reception of customer service call response 6302 is determined, and in step 11113, timeout is determined.
If the customer service call response 6302 is not received for the time-out time TCSCR (TCSCR> 0) or more in the time-out determination at step 11113, the credit settlement terminal times out, and performs merchant time-out error processing at step 11114. , “Customer Service Call” processing is terminated.

Upon receipt of the customer service call response 6302, the credit card terminal decrypts the received customer service call response 6302 with the merchant's private key in step 11106, and performs the merchant validity check in step 11107. Verify the validity of the message.
If the merchant validity check passes, the credit payment terminal proceeds to step 11108. If the merchant validity check fails, the credit payment terminal performs merchant session error processing in step 11115, Terminate the “customer service call” process.
In step 11108, the credit settlement terminal determines whether or not the response message of the customer service call response is a call is possible or not, and if the call is possible, the “calling” is displayed on the LCD in step 11109. In Step 11110, the process waits for the call response 6304 to be received from the merchant process. If the call cannot be made, an error message indicating that the user could not be accessed is displayed on the LCD in Step 11116, and “ The processing of “customer service call” is terminated.
Upon receipt of the call response 6304 from the merchant process, the credit card terminal decrypts the encryption of the received call response 6304 with the merchant's private key in step 11111, and displays “busy” on the LCD in step 11112. Shift to the voice call state. At this time, when the voice data encryption key 6439 is set in the call response 6304, the credit settlement terminal sets the voice data encryption key 6439 in the voice data encryption key register (CRYPT) 22611 and stores the voice data. Encrypt and make a voice call.

FIG. 143 shows a processing flow of the merchant process in the processing of “customer service call”.
In the merchant process, the processing of the “customer service call” is started by receiving a customer service call request 6300 from the credit settlement terminal. The merchant process first decrypts the received customer service call request 6300 cipher with the service provider's private key in step 11200 and performs a merchant process validity check in step 11201 to validate the customer service call request 6300. Verify sex.
If the merchant process validity check is passed, the merchant process determines in step 11202 whether or not it belongs to the process group from the value of the service / director process ID of the merchant process management information, and belongs to the process group. If this is the case (service director process ID ≠ 0), the customer service call request 6300 decrypted by the encryption is transmitted to the service director process in step 11212, and if not belonging to the process group (service director) For process ID = 0), in step 11203, the customer service call request 6300 obtained by decrypting the cipher is transmitted to the service manager process.
If the merchant process validity check fails, the merchant process determines that the received message is not valid, performs merchant process session error handling at step 11211, and terminates the "customer service call" process. To do.
The merchant process that sent the customer service call request 6406 to the service director process or service manager process waits to receive a customer service call response 6426 from the service director process at step 11204.
Upon receipt of the customer service call response 6426 from the service director process, the merchant process seals the customer service call response 6426 to the merchant in step 11205 and in step 11206 sends the customer service call response 6302 to the credit card payment terminal. Send to.
In step 11207, it is determined whether the response message of the customer service call response is a call is possible or not. If the call is possible, a call response 6440 is received from the service director process in step 11208. If the call cannot be made, the “customer service call” process is terminated.
Upon receipt of the call response 6440 from the service director process, the merchant process seals the call response 6440 to the merchant in step 11209 and sends the call response 6304 to the credit payment terminal in step 11210 for digital Transition to a voice call state in which voice data communication is performed.

FIG. 144 shows a processing flow of the personal credit terminal in the “customer service call” processing. Processing of a “customer service call” is initiated by the personal credit terminal generating a customer service call process upon receipt of a customer service call 6301 from the service providing system.
First, in step 11300, the personal credit terminal decrypts the received customer service call 6301 using the user's private key, and in step 11301, the user validity check is performed to verify the validity of the customer service call 6301. To do.
If the user validity check is passed, the personal credit terminal outputs a ring tone from the speaker in step 11302, displays the incoming customer service call on the LCD, and in step 11303, performs the user's call operation. Wait for.
If the user validity check fails, the personal credit terminal performs user session error processing in step 11307, and ends the "customer service call" processing.
When the user performs a call operation, the personal credit terminal generates an incoming response 6303 in step 11304, transmits the generated incoming response 6303 to the user process in step 11305, and further, on the LCD in step 11306. , “In-call” is displayed, and the state shifts to a voice call state.
When voice data is encrypted and a voice call is made, in step 11304, when generating the incoming response 6303, the personal credit terminal generates the voice data encryption key 6432 and sets it as the incoming response 6303. Further, the generated audio data encryption key 6432 is set in the audio data encryption key register (CRYPT) 21613, and the audio data is encrypted and decrypted.

FIG. 145 shows the process flow of the user process in the “customer service call” process.
In the user process, the processing of the “customer service call” is initiated by receiving a customer service call 6417 from the service director process. In step 11400, the user process first seals the received customer service call 6417 to the user. Next, in step 11401, the user process determines from the user status whether or not the session is established. In step 11403, the customer service call 6301 is transmitted to the personal credit terminal. If the session is not established, a session establishment process is performed in step 11402 to establish a session with the personal credit terminal. To step 11403.
In step 11404, the user process that sent the customer service call 6301 waits to receive an incoming response 6303 from the personal credit terminal, and when receiving the incoming response 6303, in step 11405, with the service provider's private key, The encryption of the received incoming response 6303 is decrypted, and in step 11406, the decrypted incoming response is transmitted to the service director process to shift to a voice call state in which digital voice data communication is performed.

FIG. 146 shows the processing flow of the service director process in the “customer service call” processing.
In the service director process, when a customer service call request 6406 is received from the service manager process, or when a customer service call request 6406 is received from the merchant process, processing of a “customer service call” is started.
The service director process first references the merchant's customer table in step 11500 to identify the user ID corresponding to customer number 6401 in the customer service call request, and then in step 11501 to the service manager process. Send a member process request to request a user process corresponding to the user who makes the customer service call as a member process of the same process group. In step 11502 and step 11512, the requested user process is sent to the member process. Wait for it to become. In step 11502, it is determined whether or not the requested user process has become a member process. In step 11512, a timeout is determined.
In step 11512, if the requested user process does not become a member process for the timeout time TUPMP (TUPMP> 0) or longer, the service director process times out, and in step 11513, the response message 6422 is displayed as a call. A customer service call response 6426 indicating failure is generated, and the generated customer service call response 6426 is transmitted to the merchant process in step 11514. In step 11515, the merchant process finishes processing the “customer service call”. Wait for. When the merchant process finishes processing the “customer service call”, the service director process sends a process deletion request for the service director process itself to the service manager process in step 11516 to process the “customer service call”. Exit. By sending the process erase request in step 11516, the service director process is erased by the service manager process.

If the requested user process becomes a member process, the service director process refers to the user access control information 24005 in step 11503 to determine whether the user can be accessed.
If it is determined in step 11503 that the user can be accessed, the service director process generates a customer service call 6417 in step 11504, and transmits the generated customer service call 6417 to the user process in step 11505. At 11506, the response message 6422 generates a customer service call response 6426 indicating that the call is allowed, and at step 11507, the generated customer service call response 6426 is sent to the merchant process.
If it is determined in step 11503 that the user cannot be accessed, the service director process proceeds to step 11513 and performs the processing from step 11513 to step 11516.
In step 11508 and step 11517, the service director process that has transmitted the customer service call response 6426 waits to receive an incoming response 6433 from the user process. In step 11508, reception of the incoming response 6433 is determined, and in step 11517, timeout is determined.
If the incoming response 6433 is not received for the timeout time TARU (TARU> 0) or longer in the determination of the timeout in step 11515, the service director process times out, and in step 11518, the service director process timeout error is processed. To complete the “customer service call” process.
When receiving the incoming response 6433 from the user process, the service director process generates a call response 6440 from the incoming response 6433 in step 11509, and sends the generated call response 6440 to the merchant process in step 11510. Further, in step 11511, the service provision history of the customer service call is added to the service provision history list 4303, the service provision history list 4303 is updated, and a transition is made to a voice call state in which digital voice data communication is performed.

Next, a processing flow in the “inquiry call” processing will be described.
FIG. 147 shows a processing flow of the personal credit terminal in the “inquiry call” processing. The processing of “inquiry call” is started by the personal credit terminal 100 generating an inquiry call process when the user performs an inquiry call operation.
First, in step 11600, the personal credit terminal displays “connection processing in progress” on the LCD, generates an inquiry call request 6306 in step 11601, and determines whether or not a session is established from the terminal status in step 11602. If the session is established, in step 11604, the generated inquiry call request 6306 is transmitted to the user process. If the session is not established, session establishment processing is performed in step 11603, and the service providing system After the session with is established, the process proceeds to step 11604.
In step 11605 and step 11613, the personal credit terminal that has transmitted the inquiry call request 6306 waits to receive an inquiry call response 6308 from the user process. In step 11605, reception of inquiry call response 6308 is determined. In step 11613, timeout is determined.
If the inquiry call response 6308 is not received for the time-out time TICR (TICR> 0) or more in the time-out determination at Step 11613, the personal credit terminal times out and performs user time-out error processing at Step 11614. The “inquiry call” process is terminated.

When receiving the inquiry call response 6308, the personal credit terminal decrypts the received inquiry call response 6308 with the user's private key in step 11606, performs the user validity check in step 11607, and receives it. Validate the validity of the message.
If the user validity check passes, the personal credit terminal proceeds to step 11608. If the user validity check fails, the personal credit terminal performs user session error processing in step 11615. To end the “inquiry call” process.
In step 11608, the personal credit terminal determines whether or not the response message of the inquiry call response is a call is possible or not. If the call is possible, in step 11609, “calling” is displayed on the LCD. In Step 11610, the process waits for the call response 6310 to be received from the user process. If the call cannot be made, an error message indicating that the merchant could not be accessed is displayed on the LCD in Step 11616. The processing of “inquiry call” is terminated.

  Upon receiving the call response 6310 from the user process, the personal credit terminal decrypts the received call response 6310 with the user's private key in step 11611 and displays “in call” on the LCD in step 11612. Then, it shifts to a voice call state. At this time, if the voice data encryption key 6537 is set in the call response 6310, the personal credit terminal sets the voice data encryption key 6537 in the voice data encryption key register (CRYPT) 21613, and the voice data encryption key 6537 is set. Make a voice call by encrypting.

FIG. 148 shows the process flow of the user process in the “inquiry call” process.
In the user process, the processing of “inquiry call” is started by receiving an inquiry call request 6306 from the personal credit terminal. First, in step 11700, the user process decrypts the received inquiry call request 6306 using the service provider's private key. In step 11701, the user process checks the validity of the inquiry call request 6306. Validate.
If the user process validity check is passed, the user process determines in step 11702 whether or not it belongs to the process group from the value of the service / director process ID of the user process management information, and belongs to the process group. If the service call is not in the process group (service director process ID ≠ 0), an inquiry call request 6306 with decrypted encryption is transmitted to the service director process in step 11712. For ID = 0), in step 11703, an inquiry call request 6306 obtained by decrypting the cipher is transmitted to the service manager process.

If the user process validity check fails, the user process determines that the received message is not valid, performs user process / session error processing at step 11711, and ends the “inquiry call” processing. .
The user process that sent the inquiry call request 6506 to the service director process or the service manager process waits to receive an inquiry call response 6524 from the service director process at step 11704.
Upon receipt of the inquiry call response 6524 from the service director process, the user process seals the inquiry call response 6524 to the user at step 11705 and sends the inquiry call response 6308 to the personal credit terminal at step 11706. . In step 11707, it is determined whether the response message of the inquiry call response is a call is possible or not. If waiting and calling is impossible, the “inquiry call” process is terminated.
Upon receipt of the call response 6538 from the service director process, the user process seals the call response 6538 to the user at step 11709 and sends the call response 6310 to the personal credit terminal at step 11710, Transition to a voice call state in which digital voice data communication is performed.

FIG. 149 shows a processing flow of the credit settlement terminal in the “inquiry call” processing. The processing of “inquiry call” starts when the credit settlement terminal generates an inquiry call process upon receipt of an inquiry call 6307 from the service providing system.
First, in step 11800, the credit settlement terminal decrypts the received inquiry call 6307 with the merchant's private key, and in step 11801, the merchant validity check is performed to verify the validity of the inquiry call 6307.
If the merchant validity check is passed, the credit card settlement terminal outputs a ring tone from the speaker in step 11802, displays the incoming call for the inquiry call on the LCD, and waits for the merchant call operation in step 11803. .
If the merchant validity check fails, the credit terminal performs merchant session error processing in step 11807 and ends the “inquiry call” processing.
When the merchant performs a call operation, the credit settlement terminal generates an incoming response 6309 in step 11804, transmits the generated incoming response 6309 to the merchant process in step 11805, and further, on the LCD in step 11806, Displays “busy” and shifts to voice call state.
When voice data is encrypted and voice call is performed, in step 11804, when generating the incoming response 6309, the credit card settlement terminal generates the voice data encryption key 6530 and sets it as the incoming response 6309. The generated voice data encryption key 6530 is set in the voice data encryption key register (CRYPT) 22611, and the voice data is encrypted and decrypted.

FIG. 150 shows a processing flow of the merchant process in the “inquiry call” processing.
In the merchant process, the processing of the “inquiry call” is initiated by receiving an inquiry call 6515 from the service director process. In step 11900, the merchant process first seals the received inquiry call 6515 to the merchant. Next, in step 11901, the merchant process determines from the merchant status whether the session is in an established state. In step 11903, the inquiry call 6307 is transmitted to the credit settlement terminal. If the session is not established, the session establishment process is performed in step 11902 to establish a session with the credit settlement terminal, and then in step 11903. Proceed to
In step 11904, the merchant process that sent the inquiry call 6307 waits to receive the incoming response 6309 from the credit card payment terminal. The encryption of the incoming response 6309 is decrypted, and in step 11906, the decrypted incoming response is transmitted to the service director process to shift to a voice call state in which digital voice data communication is performed.

FIG. 151 shows the processing flow of the service director process in the “inquiry call” processing.
The service director process starts “inquiry call” processing when an inquiry call request 6506 is received from the service manager process or when an inquiry call request 6506 is received from the user process.
In step 12000, the service director process first sends a member process request to the service manager process to request a merchant process corresponding to the merchant making the inquiry call as a member process of the same process group. In 12001 and step 12010, it waits for the requested merchant process to become a member process. In step 12001, it is determined whether or not the requested merchant process has become a member process. In step 12010, a timeout is determined.
If the requested merchant process does not become a member process for the timeout time TMPMP (TMPMP> 0) or longer, the service director process times out and the response message 6422 is called in step 12011. A customer service call response 6426 indicating the impossibility is generated, and the generated inquiry call response 6524 is transmitted to the user process in step 11512. In step 12513, the user process terminates the processing of the “inquiry call call”. wait. When the user process finishes the “inquiry call” process, in step 12014, the service director process sends the service director process's own process deletion request to the service manager process and finishes the “inquiry call” process. To do. By sending the process deletion request in step 12014, the service director process is deleted by the service manager process.

If the requested merchant process becomes a member process, the service director process generates an inquiry call 6515 in step 12002, sends the generated inquiry call 6515 to the merchant process in step 12003, and further in step 12004. Then, the response message 6422 generates an inquiry call response 6524 indicating that the call is allowed, and in step 12005, the generated inquiry call response 6524 is transmitted to the user process.
In Step 12006 and Step 12015, the service director process that has transmitted the inquiry call response 6524 waits to receive the incoming response 6531 from the merchant process. In step 12006, reception of the incoming response 6531 is determined, and in step 12015, timeout is determined.
If the incoming response 6531 is not received for the timeout time TARM (TARM> 0) or longer during the timeout judgment in step 12015, the service director process times out, and in step 12016, the service director process timeout error handling is performed. To complete the “inquiry call” process.
When receiving the incoming response 6531 from the merchant process, the service director process generates a call response 6538 from the incoming response 6531 in Step 12007, and sends the generated call response 6538 to the user process in Step 12008. Further, in step 12009, the service provision history list 4303 is added to the service provision history list 4303, the service provision history list 4303 is updated, and a transition is made to a voice call state in which digital voice data communication is performed.

Next, an operation when the user uses the personal remote credit settlement service in the user's home service area or a service area other than the home service area will be described.
FIG. 152 (a) shows an operation when the user performs a “settlement” process or a “cancel” process in the home service area with a merchant having the same home service area.
In this case, the personal credit terminal 100 and the credit settlement terminal 300 communicate with the service providing system 102 in the home service area (service area 1 12100) to perform “settlement” processing or “cancel” processing. To do.
In the service providing system 102, the service manager process 23800 generates and generates a user process 23802, a merchant process 23803, a service director process 23801, and a payment processing institution process 23804 on the service server of the service providing system 102. The service director process 23801, the user process 23802, the merchant process 23803, and the payment processing institution process 23804 cooperate to perform “payment” processing or “cancel” processing.

FIG. 152 (b) shows an operation when the user performs a “settlement” process or a “cancel” process in a merchant with a different home service area and the merchant's home service area.
In this case, the personal credit terminal 100 and the credit payment terminal 300 communicate with the service providing system 102 in the merchant's home service area (service area 1 12100), and process “payment” or “cancel”. Perform the following process.
In the service providing system 102, the service manager process 23800 generates a mobile user process 12105, a merchant process 23803, a service director process 23801, and a payment processor process 23804 on the service server of the service providing system 102, On the other hand, in the service providing system 12102 in the user's home service area (service area 2 12101), the service manager process 12103 generates a home user process 12104 on the service server of the service providing system 12102, and the generated service. The director process 23801, the home user process 12104, the mobile user process 12105, the merchant process 23803, and the payment processing institution process 23804 cooperate to perform a “settlement” process or a “cancel” process.
When the service manager process 23800 creates the mobile user process 12105, the home user process 12104 sends a message requesting the service manager process 12103 to create a home user process corresponding to the user. If the home user process 12104 is generated and cannot be generated (for example, if a user process corresponding to the user has already been generated), the mobile user process 12105 is not generated.

FIG. 153 (a) shows an operation when the user and the merchant perform “cancel” processing in the home service areas when the user and the merchant have different home service areas.
In this case, the personal credit terminal 100 communicates with a service providing system 12202 in the user's home service area (service area 2 12201), and the credit settlement terminal 300 is a service in the merchant's home service area (service area 1 12200). It communicates with the providing system 102 to perform “cancel” processing.
In the service providing system 12202, the service manager process 12203 generates a user process 23802 on the service server of the service providing system 12202, while in the service providing system 102, the service manager process 23800 A merchant process 23803, a service director process 23801, and a payment processor process 23804 are generated on the service server, and the generated service director process 23801, user process 23802, merchant process 23803, and payment processor process In cooperation with 23804, a “cancel” process is performed.
The cancel request 6213 transmitted from the user process 23802 to the service manager process 12203 is transmitted by the service manager process 12203 to the service manager process 23800, and the cancel request 6205 transmitted from the merchant process 23803 to the service manager process 23800. And a process group is generated by the service director process 23801, the user process 23802, the merchant process 23803, and the payment processing institution process 23804.

FIG. 153 (b) shows an operation when the user performs a “cancel” process from outside the user or the merchant's home service area when the user and the merchant's home service area are different. .
In this case, the personal credit terminal 100 communicates with the service providing system 12206 in the nearest service area (service area 2 12204), and the credit settlement terminal 300 provides the service in the merchant's home service area (service area 1 12200). It communicates with the system 102 to perform “cancel” processing.
In the service providing system 12206, the service manager process 12208 generates a mobile user process 12211 on the service server of the service providing system 12206, while in the service providing system 12207 in the user's home service area (service area 3 12205). The service manager process 12209 generates a home user process 12210 on the service server of the service providing system 12207. Further, in the service providing system 102, the service manager process 23800 is generated on the service server of the service providing system 102. A merchant process 23803, a service director process 23801, and a payment processing institution process 23804, and the generated service director process 23801, home user process 12210, mobile user process 12211, And Yantopurosesu 23803, settlement processing engine processes 23,804 and work together carry out the processing of the "Cancel".
When the home user process 12210 creates the mobile user process 12211, the home user process 12210 sends a message requesting the creation of a home user process corresponding to the user to the service manager process 12209. If the home user process 12210 cannot be generated (for example, if a user process corresponding to the user has already been generated), the mobile user process 12211 is not generated.
The cancel request 6213 sent from the mobile user process 12211 to the service manager process 12208 is sent by the service manager process 12208 to the service manager process 23800 and sent from the merchant process 23803 to the service manager process 23800. By collating with 6205, a process group is generated by a service director process 23801, a mobile user process 12211, a merchant process 23803, and a payment processing institution process 23804.

FIG. 154 (a) shows an operation when a “customer service call” process or an “inquiry call” process is performed between a user and a merchant having the same home service area.
In this case, the personal credit terminal 100 and the credit settlement terminal 300 communicate with the service providing system 102 in the home service area (service area 1 12300) to process the “customer service call” or “inquiry call”. ”Is performed.
In the service providing system 102, the service manager process 2900 generates a user process 23802, a merchant process 23803, and a service director process 2901 on the service server of the service providing system 102, and the generated service director process 2901 The user process 23802 and the merchant process 23803 cooperate to perform a “customer service call” process or an “inquiry call” process.
FIG. 154 (b) shows an operation when the merchant processes a “customer service call” with a user having a different home service area. In this case, the personal credit terminal 100 communicates with a service providing system 12302 in the user's home service area (service area 2 12301), and the credit settlement terminal 300 is a service in the merchant's home service area (service area 1 12300). It communicates with the providing system 102 to process a “customer service call”.
In the service providing system 102, the service manager process 23800 creates a merchant process 23803 and a service director process 23801 on the service server of the service providing system 102, while in the service providing system 12302, the service manager process 12303 However, the user process 23802 is generated on the service server of the service providing system 12302, and the generated service director process 23801, the user process 23802, and the merchant process 23803 cooperate to process the “customer service call”. To do.
The user process 23802 of the service provision system 12302 of the user's home service area indicates that the service manager process 23800, which has received the member process request from the service director process 23801, sends a service process corresponding to the user to the service manager process 12303. Generated by sending a message requesting generation.

FIG. 155 (a) shows an operation when the user performs an “inquiry call” process from the user's home service area to a merchant with a different home service area.
In this case, the personal credit terminal 100 communicates with a service providing system 12402 in the user's home service area (service area 2 12401), and the credit settlement terminal 300 is a service in the merchant's home service area (service area 1 12400). It communicates with the providing system 102 to process an “inquiry call”.
In the service providing system 12402, the service manager process 12403 generates a user process 23802 on the service server of the service providing system 12402, while in the service providing system 102, the service manager process 23800 A merchant process 23803 and a service director process 23801 are generated on the service server, and the generated service director process 23801, user process 23802, and merchant process 23803 cooperate to process an “inquiry call”. Do.
The inquiry call request 6506 sent from the user process 23802 to the service manager process 12203 is sent by the service manager process 12203 to the service manager process 23800, where the service director process 23801, the user process 23802, the merchant process 23803, A process group is generated.

FIG. 155 (b) shows an operation when the user performs an “inquiry call” process with a merchant having a different home service area from a service area other than the home service area of the user or the merchant. .
In this case, the personal credit terminal 100 communicates with the service providing system 12406 in the nearest service area (service area 2 12404), and the credit settlement terminal 300 provides the service in the merchant's home service area (service area 1 12400). It communicates with the system 102 to perform “inquiry call” processing.
In the service providing system 12406, the service manager process 12408 creates a mobile user process 12411 on the service server of the service providing system 12406, while in the service providing system 12407 of the user's home service area (service area 3 12405) The service manager process 12409 generates a home user process 12410 on the service server of the service providing system 12407, and in the service providing system 102, the service manager process 23800 is generated on the service server of the service providing system 102. The merchant process 23803 and the service director process 23801 are generated, and the generated service director process 23801, the home user process 12410, the mobile user process 12411, and the merchant process 23803 are linked. Te, a process of "inquiry call".
The home user process 12410 sends a message requesting the service manager process 12409 to create a home user process corresponding to the user when the service manager process 12408 creates the mobile user process 12411. If the home user process 12410 is generated and cannot be generated (for example, if a user process corresponding to the user has already been generated), the mobile user process 12411 is not generated.
The inquiry call request 6506 sent from the mobile user process 12411 to the service manager process 12408 is sent by the service manager process 12408 to the service manager process 23800, where the service director process 23801, the mobile user process 12411, and the merchant process A process group according to 23803 is generated.

As described above, the personal credit terminal 100, the credit settlement device 101, the service providing system 102, and the settlement system 103 operate to provide a personal remote credit settlement service. The user can receive the same personal remote credit settlement service anywhere in the region where the personal remote credit settlement service is provided.
In the personal credit terminal 100, instead of the ROM 1501 and the EEPROM 1503, a ferroelectric nonvolatile memory may be used as a memory device for storing a program executed by the CPU 1500 and a public key of the service provider. . Ferroelectric non-volatile memory, like EEPROM and flash memory, can be written, but can hold data without battery, and has a higher read / write speed than EEPROM and flash memory. It is a memory device with the characteristics of low power consumption.
When a ferroelectric non-volatile memory is used instead of the ROM 1501 and the EEPROM 1503, for example, a significant version upgrade of the program of the personal credit terminal 100 and a regular service provision by a process similar to the data update process. There is an advantage that the public key of the user can be updated in a relatively short time without sacrificing the life of the battery.
Further, a ferroelectric nonvolatile memory may be used as the RAM 1502 that stores data processed by the CPU 1500 and data processed by the CPU 1500. In this case, even if the battery runs out, the data is retained, so there is no need for data backup processing, and there is no need for a power source for retaining the RAM data, thus reducing the power consumption of the personal credit terminal. There is an advantage that

In the above description, the personal credit terminal 100 and the credit settlement device 101 constituting the personal remote credit settlement system are the optimum hardware for realizing each function in the personal remote credit settlement service. The function is configured by a computer having a wireless telephone communication function (or telephone communication function), an infrared communication function, a display, a keyboard (or pen input device), a microphone, and a speaker. You can also.
In this case, hardware in which the computer does not have functionally compatible hardware among the hardware in the personal credit terminal 100 or the credit settlement apparatus 101 (eg, data codec, cryptographic processor, control logic) The software program is converted into a software program that operates on the OS (Operating System) of the personal computer together with the program stored in the ROM 1501 (22501). Is stored in a place that can be executed from a computer (eg, hard disk).

  The personal electronic payment system of the present invention can be applied to various electronic payments such as credit electronic payment.

The block block diagram of the personal electronic payment system in the 1st, 2nd embodiment of this invention, FIG. 2 is an overview diagram of a personal credit terminal according to the first and second embodiments of the present invention; FIG. 2 is a schematic view of a credit payment terminal according to the first and second embodiments of the present invention; The block block diagram of the service provision system in the 1st, 2nd embodiment of this invention, The block block diagram of the payment system in the 1st, 2nd embodiment of this invention, The processing flow figure of "settlement" in the 1st embodiment of the present invention, Schematic diagrams (a) to (h) of screens displayed on the LCD of the personal credit terminal at the time of “settlement” processing in the first embodiment of the present invention; Schematic diagrams (a) to (g) of screens displayed on the LCD of the credit card settlement terminal during the “settlement” process in the first embodiment of the present invention; FIG. 5 is a flowchart illustrating a “cancel” process in the first and second embodiments of the present invention; Schematic diagrams (a) to (e) of screens displayed on the LCD of the personal credit terminal at the time of “cancel” processing in the first and second embodiments of the present invention, Schematic diagrams (a) to (g) of screens displayed on the LCD of the credit card settlement terminal during the “cancel” process in the first and second embodiments of the present invention, (A) Process flow diagram of “customer service call” in the first embodiment of the present invention, (b) Process flow diagram of “inquiry call” in the first embodiment of the present invention, The schematic diagram (a) of the screen displayed on the LCD of the personal credit terminal during the processing of the “customer service call” in the first and second embodiments of the present invention, and the “customer service call” Schematic diagram (b) of the screen displayed on the LCD of the personal credit terminal during processing and “inquiry call” processing, and displayed on the LCD of the personal credit terminal during the processing of “inquiry call” Schematic diagrams (c) to (i) Schematic diagrams (a) to (e) and (g) of screens displayed on the LCD of the credit settlement terminal during the processing of “customer service call” in the first and second embodiments of the present invention, A schematic diagram (f) of a screen displayed on the LCD of the credit settlement terminal during the processing of the “customer service call” and the “inquiry call”, and a credit settlement terminal during the processing of the “inquiry call” Schematic diagram (h) of the screen displayed on the LCD of (A) Block configuration diagram of the personal credit terminal in the first and second embodiments of the present invention, (b) Infrared communication module of the personal credit terminal in the first and second embodiments of the present invention Block diagram, FIG. 4 is a schematic diagram of a RAM map of the personal credit terminal according to the first embodiment of the present invention. FIG. 4 is a schematic diagram of data stored in the service data area of the personal credit terminal according to the first embodiment of the present invention; (A) Configuration diagram of the internal register of the personal credit terminal in the first embodiment of the present invention, (b) Bit field configuration diagram of the INT register of the personal credit terminal in the first embodiment of the present invention, (C) Bit field configuration diagram of variable interrupt on the RAM of the personal credit terminal according to the first embodiment of the present invention; FIG. 5 is a process flow diagram performed by the CPU of the personal credit terminal according to the first embodiment of the present invention; (A) Flow chart of digital signature processing in the first embodiment of the present invention, (b) Flow explanatory diagram of digital signature processing in the first embodiment of the present invention, (A) Flow diagram of message sealing processing in the first embodiment of the present invention, (b) Flow explanatory diagram of message sealing processing in the first embodiment of the present invention, (A) Flow chart of decryption processing of sealed message in the first embodiment of the present invention, (b) Flow of decryption processing of sealed message in the first embodiment of the present invention Explanatory drawing, (A) Flow diagram of digital signature verification processing in the first embodiment of the present invention, (b) Flow explanatory diagram of digital signature verification processing in the first embodiment of the present invention, (A) The block block diagram of the credit payment terminal in the 1st Embodiment of this invention, (b) The block block diagram of the infrared rays light emitting / receiving module of the credit payment terminal in the 1st Embodiment of this invention, FIG. 4 is a schematic diagram of a RAM map of the credit settlement terminal according to the first embodiment of the present invention; FIG. 4 is a schematic diagram of data stored in a service data area of the credit settlement terminal according to the first embodiment of the present invention; (A) Configuration diagram of internal register of credit settlement terminal according to the first embodiment of the present invention, (b) Bit field configuration diagram of INT register of credit settlement terminal according to the first embodiment of the present invention, (c) ) Bit field configuration diagram of variable interrupt on the RAM of the credit settlement terminal according to the first embodiment of the present invention; The flowchart of the process which CPU of the credit payment terminal in the 1st Embodiment of this invention performs, FIG. 4 is a schematic diagram of data stored for one user in the user information server of the service providing system according to the first embodiment of the present invention; FIG. 5 is a schematic diagram of data stored for one merchant in the merchant information server of the service providing system according to the first embodiment of the present invention; FIG. 4 is a schematic diagram of data stored in one settlement processing organization in the settlement processing organization information server of the service providing system according to the first embodiment of the present invention; FIG. 5 is a schematic diagram of data stored in the service director information server of the service providing system according to the first embodiment of the present invention; (A) Flow chart of remote access processing in the first embodiment of the present invention, (b) Flow chart of data update processing in the first embodiment of the present invention, (A) Schematic diagram of the data structure of the remote access request in the first embodiment of the present invention, (b) Schematic diagram of the data structure of the remote access data in the first embodiment of the present invention, (c) ) Schematic diagram of the data structure of the data update request in the first embodiment of the present invention, (d) Schematic diagram of the data structure of the data update request response in the first embodiment of the present invention, (e) FIG. 4 is a schematic diagram of a data structure of upload data in the first embodiment of the present invention; (f) A schematic diagram of a data structure of update data in the first embodiment of the present invention; (A) Schematic diagram of a data structure of a function stop instruction in the first embodiment of the present invention, (A) Schematic diagram of data structure of payment offer in the first embodiment of the present invention, (b) Schematic diagram of data structure of payment offer response in the first embodiment of the present invention, (c) (D) Schematic diagram of the data structure of the payment request in the first embodiment of the present invention; (e) Schematic diagram of the data structure of the payment request in the first embodiment of the present invention; (F) A data structure of a payment request transmitted from the credit payment terminal to the service providing system according to the first embodiment of the present invention. Figure, (A) Schematic diagram of the data structure of a payment request transmitted from the service providing system to the payment system in the first embodiment of the present invention, (b) Service from the payment system in the first embodiment of the present invention (C) Formula of data structure of settlement completion notification transmitted from service providing system to credit settlement terminal in first embodiment of the present invention Figure, (A) Schematic diagram of the data structure of a receipt transmitted from the credit settlement terminal to the service providing system in the first embodiment of the present invention, (b) the service providing system in the first embodiment of the present invention Schematic diagram of the data structure of the receipt sent to the personal credit terminal from (A) Schematic diagram of the data structure of a cancel request transmitted from the credit settlement terminal to the service providing system in the first embodiment of the present invention, (b) Personal credit in the first embodiment of the present invention (C) Schematic diagram of the data structure of the cancel request transmitted from the service providing system to the settlement system in the first embodiment of the present invention. FIG. 6 is a schematic diagram of a data structure of a cancel request transmitted from the service providing system to the settlement system in the embodiment of the present invention; (E) Service in the first embodiment of the present invention Schematic diagram of the data structure of the cancellation completion notification transmitted from the subject system to the credit settlement terminal, schematic view of a data structure of the cancel processing receipt in the first embodiment of the present invention (f), (A) Schematic diagram of the data structure of the customer service call request in the first embodiment of the present invention, (b) Schematic diagram of the data structure of the customer service call in the first embodiment of the present invention, c) Schematic diagram of the data structure of the customer service call request response in the first embodiment of the present invention. (d) The data structure of the incoming response in the case of the customer service call in the first embodiment of the present invention. (E) A schematic diagram of a data structure of a call response in the case of a customer service call in the first embodiment of the present invention, (A) Schematic diagram of the data structure of the inquiry call request in the first embodiment of the present invention, (b) Schematic diagram of the data structure of the inquiry call in the first embodiment of the present invention, (c) FIG. 4 is a schematic diagram of a data structure of an inquiry call request response in the first embodiment of the present invention; (d) A schematic diagram of a data structure of an incoming response in the case of an inquiry call in the first embodiment of the present invention; (E) Schematic diagram of a data structure of a call response at the time of an inquiry call in the first embodiment of the present invention, Block diagram of a conventional payment system, FIG. 10 is a processing flow diagram of “settlement” in the second embodiment of the present invention; Schematic diagrams (a) to (h) of screens displayed on the LCD of the personal credit terminal during the “settlement” process, (A) Process flow diagram of “customer service call” in the second embodiment of the present invention, (b) Process flow diagram of “inquiry call” in the second embodiment of the present invention, The block diagram of the internal register of the personal credit terminal in the 2nd Embodiment of this invention, (A) Bit field configuration diagram of the INT register of the personal credit terminal in the second embodiment of the present invention, (b) Variable interrupt on the RAM of the personal credit terminal in the second embodiment of the present invention Bit field configuration diagram, FIG. 4 is a schematic diagram of a RAM map of the personal credit terminal according to the second embodiment of the present invention. FIG. 5 is a schematic diagram of data stored in the service data area of the personal credit terminal according to the second embodiment of the present invention; (A) Process list of CPU of personal credit terminal in the second embodiment of the present invention, (b) Process list update by process management process of personal credit terminal in the second embodiment of the present invention Explanatory diagram to explain FIG. 9 is a conceptual diagram of a processing flow performed by the CPU of the personal credit terminal according to the second embodiment of the present invention. (A) Conceptual diagram of processing flow at the time of reset performed by the CPU of the personal credit terminal and credit settlement terminal according to the second embodiment of the present invention; (b) Personal credit terminal according to the second embodiment of the present invention; And a conceptual diagram of a processing flow at the time of power-on performed by the CPU of the credit settlement terminal. , FIG. 5 is a conceptual diagram of a processing flow at a normal time performed by the CPU of the personal credit terminal according to the second embodiment of the present invention; FIG. 10 is a conceptual diagram of a processing flow at the time of “settlement” processing performed by the CPU of the personal credit terminal according to the second embodiment of the present invention; (A) The block block diagram of the credit settlement terminal in the 2nd Embodiment of this invention, (b) The block block diagram of the infrared rays light emitting / receiving module of the credit settlement terminal in the 2nd Embodiment of this invention, The block diagram of the internal register of the credit payment terminal in the 2nd Embodiment of this invention, (A) Bit field configuration diagram of INT register of credit settlement terminal according to the second embodiment of the present invention, (b) Bit field of variable interrupt on RAM of credit settlement terminal according to the second embodiment of the present invention Diagram, FIG. 4 is a schematic diagram of a RAM map of a credit settlement terminal according to the second embodiment of the present invention. FIG. 4 is a schematic diagram of data stored in a service data area of a credit card settlement terminal according to the second embodiment of the present invention; (A) Process list of CPU of credit settlement terminal in the second embodiment of the present invention, (b) Process list update by process management process of credit settlement terminal in the second embodiment of the present invention. To explain, FIG. 7 is a conceptual diagram of a processing flow performed by the CPU of the credit settlement terminal according to the second embodiment of the present invention. FIG. 7 is a conceptual diagram of a processing flow at a normal time performed by the CPU of the credit settlement terminal according to the second embodiment of the present invention. FIG. 9 is a conceptual diagram of a processing flow at the time of “settlement” processing performed by the CPU of the credit settlement terminal in the second embodiment of the present invention; (A) Digital signature processing flow diagram in the second embodiment of the present invention, (b) Digital signature processing flow explanatory diagram in the second embodiment of the present invention, (A) Flow chart of message sealing processing in the second embodiment of the present invention, (b) Flow explanatory diagram of message sealing processing in the second embodiment of the present invention, (A) Flow chart of decrypted message decryption process in the second embodiment of the present invention, (b) Flow of decrypted message decryption process in the second embodiment of the present invention Explanatory drawing, (A) Flow diagram of verification processing of digital signature in the second embodiment of the present invention, (b) Flow explanatory diagram of verification processing of digital signature in the second embodiment of the present invention, FIG. 5 is a diagram illustrating a processing architecture of the service providing system according to the second embodiment of the present invention. FIG. 6 is a list of processes of a service providing system according to a second embodiment of the present invention. List of processes of the service providing system according to the second embodiment of the present invention (continued), FIG. 5 is a schematic diagram of data stored for one user in the user information server of the service providing system according to the second embodiment of the present invention; FIG. 5 is a schematic diagram of data stored for one merchant in the merchant information server of the service providing system according to the second embodiment of the present invention; FIG. 5 is a schematic diagram of data stored for one payment processing organization in the payment processing organization information server of the service providing system according to the second embodiment of the present invention; FIG. 5 is a schematic diagram of data stored in the service director information server of the service providing system according to the second embodiment of the present invention; (A) Schematic diagram of user process management information generated for one user process in the service providing system according to the second embodiment of the present invention. (B) In the second embodiment of the present invention. In the service providing system, a schematic diagram of merchant process management information generated for one merchant process. (C) In the service providing system according to the second embodiment of the present invention, for one settlement processor process. (D) Service director process management generated for one service director process in the service providing system according to the second embodiment of the present invention. (E) Service providing system according to the second embodiment of the present invention In, schematic view of a process group management information generated for the one process group, schematic view of the message list that is generated in the service providing system according to the second embodiment of the present invention (f), The flowchart of the session establishment process in the case of connecting to the service provision system from the personal credit terminal in the 2nd Embodiment of this invention, The flowchart of the session establishment process in the case of connecting to the personal credit terminal from the service provision system in the 2nd Embodiment of this invention, (A) Schematic diagram of data structure of authentication test A, (b) Data of authentication test A response, for session establishment processing when connecting from service providing system to personal credit terminal in second embodiment of the present invention (C) Schematic diagram of data structure of authentication test B response, (d) Session establishment process when connecting to personal credit terminal from service providing system according to second embodiment of the present invention (d) ) Schematic diagram of data structure of certification test C, (e) Schematic diagram of data structure of certification test C response, (f) Schematic diagram of data structure of certification test D response, The flowchart of the session establishment process in the case of connecting to the service provision system from the credit settlement terminal in the 2nd Embodiment of this invention, The flowchart of the session establishment process in the case of connecting to the credit settlement terminal from the service provision system in the 2nd Embodiment of this invention, (A) Schematic diagram of the data structure of authentication test A, (b) Data structure of authentication test A response, for session establishment processing when connecting from the service providing system to the credit settlement terminal in the second embodiment of the present invention (C) Schematic diagram of data structure of authentication test B response, (d) Authentication of session establishment process when connecting to credit settlement terminal from service providing system in second embodiment of the present invention Schematic diagram of data structure of test C, (e) Schematic diagram of data structure of authentication test C response, (f) Schematic diagram of data structure of authentication test D response, (A) Flow chart of remote access processing, (b) Flow chart of data update processing, (c) Flow chart of forced data update processing, by personal credit terminal and user process in the second embodiment of the present invention, (D) Flow chart of data backup processing, (A) Schematic diagram of data structure of remote access request exchanged between personal credit terminal and user process in the second embodiment of the present invention; (b) Schematic diagram of data structure of remote access data; c) Schematic diagram of data structure of data update request, (d) Schematic diagram of data structure of data update response, (e) Schematic diagram of data structure of upload data, (f) Schematic diagram of data structure of update data Formula, (A) Schematic diagram of data structure of function stop command exchanged between personal credit terminal and user process in second embodiment of the present invention, (b) Schematic diagram of data structure of data update command, (A) Flow diagram of remote access processing, (b) Flow diagram of data update processing, (c) Flow diagram of compulsory data update processing, by credit settlement terminal and merchant process in the second embodiment of the present invention (A) Schematic diagram of data structure of remote access request exchanged between credit settlement terminal and merchant process in second embodiment of the present invention, (b) Schematic diagram of data structure of remote access data, (c) ) Schematic diagram of data structure of data update request, (d) Schematic diagram of data structure of data update response, (e) Schematic diagram of data structure of upload data, (f) Formula of data structure of update data Figure, (A) Schematic diagram of data structure of function stop command exchanged between credit settlement terminal and merchant process in the second embodiment of the present invention, (b) Schematic diagram of data structure of data update command, Explanatory drawing of the message exchange procedure of the “settlement” process in the second embodiment of the present invention, (A) Schematic diagram of data structure of payment offer in the second embodiment of the present invention, (b) Schematic diagram of data structure of payment offer response in the second embodiment of the present invention, (c) (D) Schematic diagram of the data structure of the credit request in the second embodiment of the present invention, (d) Schematic diagram of the data structure of the payment request in the second embodiment of the present invention, (e) (F) A data structure of a payment request data structure transmitted from the credit payment terminal to the service providing system in the second embodiment of the present invention. Figure, (A) Schematic diagram of the data structure of a payment request transmitted from the service providing system to the payment system in the second embodiment of the present invention, (b) Service from the payment system in the second embodiment of the present invention (C) Formula of data structure of settlement completion notification transmitted from service providing system to credit settlement terminal in second embodiment of the present invention Figure, (A) Schematic diagram of the data structure of a receipt transmitted from the credit settlement terminal to the service providing system in the second embodiment of the present invention, (b) the service providing system in the second embodiment of the present invention Schematic diagram of the data structure of the receipt sent to the personal credit terminal from Explanatory drawing of the message exchange procedure of “cancel” processing in the second embodiment of the present invention, (A) Schematic diagram of the data structure of a cancellation request transmitted from the credit settlement terminal to the service providing system in the second embodiment of the present invention, (b) Personal credit in the second embodiment of the present invention Schematic diagram of data structure of cancellation request transmitted from terminal to service providing system, (c) Formula of data structure of cancellation request transmitted from service providing system to settlement system in second embodiment of the present invention. FIG. 4D is a schematic diagram of a data structure of a cancellation completion notification transmitted from the settlement system to the service providing system in the second embodiment of the present invention. FIG. 4E is a service in the second embodiment of the present invention. (F) A schematic diagram of a data structure of a cancellation completion notification transmitted from the providing system to the credit settlement terminal; Schematic diagram of the data structure of the cancellation processing receipt in the second embodiment, (A) Message exchange procedure explanatory diagram of “customer service call” processing in the second embodiment of the present invention; (b) Message exchange procedure of “inquiry call” processing in the second embodiment of the present invention; Explanatory drawing, (A) Schematic diagram of the data structure of the customer service call request in the second embodiment of the present invention, (b) Schematic diagram of the data structure of the customer service call in the second embodiment of the present invention, c) Schematic diagram of the data structure of the customer service call response in the second embodiment of the present invention, (d) 摸 The data structure of the incoming response in the case of the customer service call in the second embodiment of the present invention (E) Schematic diagram of a data structure of a call response in the case of a customer service call in the second embodiment of the present invention, (A) Schematic diagram of the data structure of the inquiry call request in the second embodiment of the present invention, (b) Schematic diagram of the data structure of the inquiry call in the second embodiment of the present invention, (c) (D) A schematic diagram of a data structure of an incoming call response in the case of an inquiry call in the second embodiment of the present invention. e) Schematic diagram of a data structure of a call response at the time of an inquiry call in the second embodiment of the present invention, FIG. 1 is a main processing flow diagram of a service manager process according to the second embodiment of the present invention; FIG. 2 is a main process flow diagram of the service manager process in the second embodiment of the present invention; FIG. 7 is a flowchart of process generation processing by a service manager process according to the second embodiment of the present invention; The main processing flow figure of the user process in a 2nd embodiment of the present invention, The main processing flow figure of a merchant process in a 2nd embodiment of the present invention, The main processing flow figure of the settlement processing organization process in the 2nd embodiment of the present invention, The flowchart of the session establishment process by the personal credit terminal in the case of connecting to the service provision system from the personal credit terminal in the 2nd Embodiment of this invention, The flowchart of the session establishment process by the user process in the case of connecting to the service provision system from the personal credit terminal in the 2nd Embodiment of this invention. The flowchart of the session establishment process by the credit settlement terminal in the case of connecting to the service provision system from the credit settlement terminal in the 2nd Embodiment of this invention, The flowchart of the session establishment process by a merchant process in the case of connecting to the service provision system from the credit settlement terminal in the 2nd Embodiment of this invention, The flowchart of the session establishment process by the user process in the case of connecting to the personal credit terminal from the service provision system in the 2nd Embodiment of this invention, The flowchart of the session establishment process by the personal credit terminal in the case of connecting to the personal credit terminal from the service provision system in the 2nd Embodiment of this invention, The flowchart of the session establishment process by a merchant process in the case of connecting to the credit settlement terminal from the service provision system in the 2nd Embodiment of this invention, The flowchart of the session establishment process by the credit settlement terminal in the case of connecting to the credit settlement terminal from the service provision system in the 2nd Embodiment of this invention, (A) Flow chart of remote access processing by personal credit terminal in the second embodiment of the present invention, (b) Flow chart of user validity check by personal credit terminal in the second embodiment of the present invention. , (A) Flow chart of remote access processing by user process in the second embodiment of the present invention, (b) Flow chart of user process validity check by user process in the second embodiment of the present invention, (A) Flow chart of remote access processing by credit settlement terminal in the second embodiment of the present invention, (b) Flow chart of bill merchant validity check by credit settlement terminal in the second embodiment of the present invention, (A) Flow chart of remote access processing by merchant process in the second embodiment of the present invention, (b) Flow chart of merchant process validity check by merchant process in the second embodiment of the present invention, The flowchart of the data update process by the personal credit terminal in the 2nd Embodiment of this invention, The flowchart of the data update process by the user process in the 2nd Embodiment of this invention, The flowchart of the data update process by the credit payment terminal in the 2nd Embodiment of this invention, The flowchart of the data update process by the merchant process in the 2nd Embodiment of this invention, FIG. 5 is a flowchart of compulsory data update processing by a personal credit terminal according to the second embodiment of the present invention; The flowchart of the forced data update process by the user process in the 2nd Embodiment of this invention, FIG. 5 is a flowchart of compulsory data update processing by a credit settlement terminal according to the second embodiment of the present invention; FIG. 5 is a flowchart of compulsory data update processing by a merchant process according to the second embodiment of the present invention; FIG. 8 is a flowchart of data backup processing by a personal credit terminal according to the second embodiment of the present invention; FIG. 1 is a flowchart of processing of “settlement” by a credit settlement terminal according to the second embodiment of the present invention; FIG. 2 is a flowchart of processing of “settlement” by the credit settlement terminal according to the second embodiment of the present invention; FIG. 1 is a flowchart of processing of “settlement” by a merchant process in the second embodiment of the present invention; FIG. 2 is a flowchart of processing of “settlement” by a merchant process according to the second embodiment of the present invention; FIG. 1 is a flowchart of processing of “settlement” by a personal credit terminal according to the second embodiment of the present invention; FIG. 2 is a flowchart of processing of “settlement” by a personal credit terminal according to the second embodiment of the present invention; The flowchart of the process of "settlement" by the user process in the second embodiment of the present invention, (A) Flow chart of processing of “settlement” by the settlement system according to the second embodiment of the present invention, (b) Flow chart of settlement processor validity check by the settlement system according to the second embodiment of the present invention. , (A) Flow chart of processing of “settlement” by the settlement processor process in the second embodiment of the present invention, (b) Effectiveness of the settlement processor process by the settlement processor process in the second embodiment of the present invention Flow chart of sex check, FIG. 1 is a flowchart of processing of “settlement” by a service director process according to the second embodiment of the present invention; FIG. 2 is a flowchart of processing of “settlement” by the service director process according to the second embodiment of the present invention; The flowchart of the process of "cancellation" by the credit payment terminal in the 2nd Embodiment of this invention, FIG. 5 is a flowchart of “cancel” processing by a merchant process according to the second embodiment of the present invention; FIG. 8 is a flowchart of processing of “cancel” by the personal credit terminal according to the second embodiment of the present invention; FIG. 10 is a flowchart of “cancel” processing by a user process according to the second embodiment of the present invention; FIG. 9 is a flowchart of “cancel” processing by the payment system according to the second embodiment of the present invention; The flowchart of the process of "cancellation" by the payment processing organization process in the second embodiment of the present invention, FIG. 8 is a flowchart of “cancel” processing by a service director process according to the second embodiment of the present invention; The flowchart of the process of the "customer service call" by the credit payment terminal in the 2nd Embodiment of this invention, The flowchart of the processing of the “customer service call” by the merchant process in the second embodiment of the present invention, FIG. 10 is a flowchart of processing of “customer service call” by the personal credit terminal according to the second embodiment of the present invention; FIG. 9 is a flowchart of processing of a “customer service call” by a user process according to the second embodiment of the present invention. FIG. 10 is a flowchart of processing of “customer service call” by a service director process according to the second embodiment of the present invention; The flowchart of the process of the "inquiry call" by the personal credit terminal in the 2nd Embodiment of this invention, FIG. 10 is a flowchart of processing of an “inquiry call” by a user process according to the second embodiment of the present invention; The flowchart of the process of the "inquiry call" by the credit settlement terminal in the 2nd Embodiment of this invention, The flowchart of the processing of the “inquiry call” by the merchant process in the second embodiment of the present invention, FIG. 10 is a flowchart of processing of an “inquiry call” by a service director process according to the second embodiment of the present invention. (A) Operation in the second embodiment of the present invention when the user and the merchant have the same home service area and the user performs a “settlement” process or a “cancel” process in the home service area (B) The user and merchant's home service area in the second embodiment of the present invention are different, and the user performs a “settlement” process or a “cancel” process in the merchant's home service area. Operation explanation diagram when performing, (A) Operation explanatory diagram when the user and the merchant's home service area are different in the second embodiment of the present invention, and the user performs “cancel” processing in the user's home service area, (b) book FIG. 5 is an operation explanatory diagram when the user and the merchant's home service area are different in the second embodiment of the invention, and the user performs a “cancel” process in a service area other than the user or the merchant's home service area; (A) The home service area of the user and the merchant in the second embodiment of the present invention is the same, and the user and the merchant process “customer service call” or “inquiry call” in the home service area (B) Operation explanation diagram when the home service area of the merchant is different from that of the user in the second embodiment of the present invention, and the merchant processes the “customer service call” to the user. , (A) Operation explanatory diagram when the user and the merchant's home service area are different from each other in the second embodiment of the present invention, and the user performs an “inquiry call” process from the user's home service area, (b) FIG. 10 is an operation explanatory diagram when the home service area of the user and the merchant is different in the second embodiment of the present invention, and the user performs an “inquiry call” process from a service area other than the user or the merchant home service area. is there.

Explanation of symbols

100 personal credit terminals
101 Credit payment device
102 Service delivery system
103, 4202 payment system
104 base station
108 digital public network
200 Infrared communication port
201 Antenna
202 Receiver Speaker
203, 302 LCD
204, 304 Mode switch
205 Call switch
206 Exit switch
207, 306 Function switch
208, 307 numeric keypad switch
209, 309 Power switch
210 microphone
211, 308 execution switch
212 Headset jack
300 Credit payment terminal
301 Infrared light emitting module
303 handset
305 Hook switch
310 serial cable
311 Cash register
312 Credit payment switch
313 RS-232C cable
400 service server
401 Server Director Information Server
402 User information server
403 Merchant Information Server
404 Payment processing agency information server
405, 408, 504, 507 ATM-LAN switch
406, 505 ATM switch
407, 506 management system
500 transaction processing server
501 subscriber information server
502 Merchant information server
503 transaction information server
1507 infrared communication module
1500, 2400, 22500 CPU
1501, 2401, 22501 ROM
1502, 2402, 22502 RAM
1503, 2404, 22504 EEPROM
1504, 2405, 22505 LCD controller
1505, 2406, 22506 cryptographic processor
1506, 2407, 22507 Data codec
1508, 2410, 22510 Control logic
1509, 2411, 22511 Key operation control unit
1510, 2412, 22512 Speaker
1511, 2413, 22513 Audio processor
1512, 2414, 22514 audio codec
1513, 2415, 22515 channel codecs
1514 Modulator
1515 Demodulator
1517 RF section
1518 Battery capacity detector
1560, 2408, 22508 Series-parallel converter
1561, 2456, 22556 Modulation / demodulation circuit
1800, 21600 frame counter
1801, 21601 Start frame counter
1802, 2700, 21602, 22600 clock counter
1803, 2701, 21603, 22601 Update time register
1804, 2702, 21604, 22602 Interrupt register
1805, 2703, 21605, 22603 ID register
1806, 2704, 21606, 22604 Channel codec control register
1807, 2705, 21607, 22605 Audio transmission buffer
1808, 2706, 21608, 22606 Audio reception buffer
1809, 2707, 21609, 22607 Data transmission buffer
1810, 2708, 21610, 22608 Data reception buffer
1811, 2709, 21611, 22609 Audio processor control register
1812, 2710, 21612, 22610 Key operation control register
21613, 22611 Voice data encryption key register
2403, 22503 hard disk
2409, 2455, 22503, 22555 Serial port
2416, 22516 Digital communication adapter
2417, 22517 RS-232C interface
4200 credit card
4201 Credit payment terminal
4203 public network

Claims (2)

A personal electronic payment system comprising a payment means, a billing means, and a service providing means,
The claim means is:
Holding first data indicating completion of the payment process with the payment means, the first data includes identification information of the payment process;
Generating second data as data for requesting cancellation of the settlement processing including the first data, and transmitting the second data to the service providing means;
The payment means is:
Holding third data indicating completion of the settlement process with the billing means, the third data includes identification information of the settlement process;
Generating fourth data as data for requesting cancellation of the settlement process including the third data, and transmitting the fourth data to the service providing means;
The service providing means includes:
Holding the first data and the third data;
A first collation process for collating the first data included in the second data received from the billing unit and the first data held by the service providing unit;
A second verification process for verifying third data included in the fourth data received from the payment means and third data held by the service providing means;
Performing a third matching process for matching the identification information of the payment process included in the first data and the identification information of the payment process included in the third data;
When the first verification process, the second verification process, and the third verification process are successful, the settlement process is canceled.
A personal electronic payment system characterized by that. A CPU for executing settlement processing between the payment means and the billing means;
Communication means;
First data indicating completion of settlement processing between the payment means and the billing means transmitted by the CPU to the billing means via the communication means, and the CPU via the communication means the payment means Storage means for storing third data indicating completion of settlement processing between the payment means and the billing means transmitted to
A service providing means comprising:
Each of the first data and the third data includes identification information of a settlement process executed by the CPU,
Receiving second data as data for requesting cancellation of the settlement process including the first data from the billing means via the communication means; and receiving the third data from the payment means via the communication means. When receiving fourth data as data for requesting cancellation of the settlement process including data,
A first collation process for collating the first data included in the second data received from the billing unit and the first data held by the service providing unit;
A second verification process for verifying third data included in the fourth data received from the payment means and third data held by the service providing means;
Performing a third matching process for matching the identification information of the payment process included in the first data and the identification information of the payment process included in the third data;
Service providing means for canceling the settlement process when the first matching process, the second matching process, and the third matching process are successful.

Images