JP5018137B2 - IC card authentication device and IC card authentication system - Google Patents

Description

  The present invention relates to an IC card authentication device and an IC for authenticating an IC card based on authentication data for authenticating an IC card transmitted from an IC card reader adopting basic type authentication that performs IC card authentication online. The present invention relates to a card authentication system.

  There are two methods for authenticating an IC card mounted on an automatic transaction apparatus (hereinafter referred to as ATM): an elapsed period authentication method performed offline and a basic authentication method performed online, and each financial institution adopts one of them. . In recent years, as an IC card authentication, it is recommended to shift from an elapsed period authentication to a basic authentication.

  Here, a method for authenticating an IC card attached to an ATM using an elapsed period authentication method and a method for authenticating an IC card attached to an ATM using a basic authentication method will be described separately. In the elapsed period authentication, authentication data encrypted from the mounted IC card, plain text data before the authentication data is encrypted, and an encrypted public key are read from the IC card by ATM. Next, the ATM decrypts the encrypted public key read out previously with a private key stored in advance, and decrypts the encrypted authentication data using the decrypted public key. After that, the ATM compares the decrypted authentication data with the plain text data, and if they match, the ATM performs authentication to permit the use of the IC card. Authenticate not allowed.

  In basic authentication, encrypted authentication data is read from an IC card with an ATM, and the authentication data is transmitted to an authentication server. The authentication server decrypts the authentication data using a common key that is common to a key for generating authentication data by encrypting plaintext. After that, the authentication server compares the decrypted authentication data with the plaintext stored in advance, and if they match, the authentication server authenticates the use of the IC card and sends the authentication result to the ATM. On the other hand, if they do not match, authentication is performed to prohibit the use of the IC card, and the authentication result is transmitted to the ATM.

By the way, ATMs installed in financial institutions adopting basic authentication as an IC card authentication method can authenticate IC cards issued by other financial institutions adopting elapsed period authentication. (For example, refer to Patent Document 1).
JP-A-10-149103

  As described above, in an ATM installed in a financial institution adopting basic type authentication as an IC card authentication method, when performing basic type authentication, the authentication data is read from the IC card and this authentication data is transmitted to the authentication server. However, in the elapsed period authentication, it is necessary to perform many authentication processes as described above. For this reason, ATMs installed in financial institutions that have adopted basic authentication must add a function to authenticate the elapsed period. As a result, the price increases and financial institutions use this ATM. However, there is a problem that the cost increases when constructing the system.

  Therefore, in view of the above-described problems, the present invention suppresses the price in ATMs installed in financial institutions that employ basic authentication as an IC card authentication method, and financial institutions that employ basic authentication use this ATM. An object of the present invention is to provide an IC card authentication device and an IC card authentication system that can reduce the cost for constructing a system.

The present invention adopts the following configuration in order to solve the above points.
<Configuration 1>
I C card financial institutions authenticate adopting the basic form authentication performed online is transmitted from the automatic teller machine installed, based on the authentication data for authenticating the IC card, IC card to perform authentication of the IC card In the authentication device, a transition completion determination information indicating whether or not another financial institution has transitioned to the basic authentication, and an inquiry as to whether or not the other financial institution has transitioned to the basic authentication. Transitioned determination data storage means for storing transitioned determination data describing inquiry final date information indicating the last date performed, and authentication data for authenticating the IC card transmitted from the automatic transaction apparatus IC card issuer determination means for determining whether the card is an IC card issued by the financial institution or an IC card issued by another financial institution, When the C card issuer determination means determines that the authentication data for authenticating the IC card transmitted from the automatic transaction apparatus is an IC card issued by another financial institution, the transition completed determination data The transition determination unit that refers to the transition determination data stored in the storage unit and determines whether or not the other financial institution has transitioned to the basic type authentication, and the transition determination unit, Authentication data transmitting means for transmitting the authentication data of the IC card issued by the other financial institution to the other financial institution, when it is determined that If it is determined by the transfer completion determination means that the other financial institution has not transferred to the basic type authentication, the authentication of the IC card issued by the other financial institution is off-line with the other financial institution. And age authenticator employing an elapsed time authentication performed in emissions, by the migrated determination unit, when the other financial institution is determined not already migrated to Basic authentication, the current date, the migrated A period for determining whether or not a predetermined period has elapsed from the final date described in the transferred determination data of the other financial institution money stored in the determination data storage means Progress determination means, authentication result reception means for receiving the authentication result for the authentication data transmitted by the authentication data transmission means from the other financial institution, the authentication result received by the authentication result reception means, and one of age authenticated authentication result by the elapsed time authentication unit, and a verification result transmitting means for transmitting to said automatic transaction apparatus, the elapsed time authentication If the period determination means determines that the current date has not passed a predetermined period from the final date, the stage authenticates the IC card issued by the other financial institution. Elapsed period authentication performed offline with the other financial institution is employed.

According to the automatic transaction system of configuration 1, when it is determined by the transition completion determination means that another financial institution has been transferred to the basic type authentication, the authentication data transmission means is issued by this other financial institution. When the authentication data of the IC card is transmitted to the other financial institution, and the transition completion determination means determines that the other financial institution has not transitioned to the basic authentication, the elapsed period authentication means Since the authentication of the IC card issued by the other financial institution is performed offline with another financial institution, the ATM does not need to have a function for performing the authentication of the elapsed time. As a result, it is possible to reduce the price at ATMs installed in financial institutions adopting basic type authentication as an IC card authentication method, and for financial institutions adopting basic type authentication to construct a system using this ATM. Cost can be reduced.
Further, according to the automatic transaction system of the configuration 1, when it is determined by the period elapsed determination means that the current date has not passed the predetermined period from the final date, the elapsed period authentication means However, since it adopts an elapsed period authentication in which an IC card issued by another financial institution is authenticated offline with the other financial institution, an IC card issued by a financial institution adopting a frequently used elapsed period authentication In each case, it is possible to prevent the process of inquiring whether or not the transition from the elapsed period authentication to the basic authentication is performed. Thereby, the authentication process of the IC card can be accelerated.

<Configuration 2>
In the structure 1 of the automated trading system, by the period of time judging means, if it is determined that the current date is beyond the period are predetermined from the date of the final, the inquiry said other financial The inquiry transmission means for transmitting to the institution, the inquiry result reception means for receiving the inquiry result for the inquiry to the inquiry transmission means, and the inquiry result received by the inquiry result reception means have been transferred to the basic authentication. If the content is described, the determination information stored in the transferred determination data storage means and described in the transferred determination data of the other financial institution is updated to transferred. It is further characterized by further comprising a migrated determination data update means .

<Configuration 3>
It includes an automatic teller machine financial institutions placed adopting the basic form authentication for authenticating the I C card online, and an IC card authentication system that performs authentication of the IC card based on the authentication data for authenticating the IC card In the IC card authentication system in which the automatic transaction apparatus and the IC card authentication apparatus are communicatively connected, the automatic transaction apparatus includes an authentication data reading means for reading authentication data from the IC card, and an authentication data reading means. Authentication data transmitting means for transmitting the read authentication data to the IC card authenticating apparatus, and authentication result receiving means for receiving an authentication result for the authentication data transmitted by the authentication data transmitting means from the IC card authenticating apparatus. The IC card authentication device has been transferred to the basic authentication by another financial institution Transition determination information indicating whether or not the transaction has been completed, and inquiry final date information indicating the final date when the other financial institution has been inquired whether or not the transition to the basic authentication has been performed. The migrated judgment data storage means described and storing the migrated judgment data and the confirmation data for authenticating the IC card transmitted from the automatic transaction apparatus is an IC card issued by the financial institution, or IC card issuer determination means for determining whether the IC card has been issued by another financial institution, and authentication data for authenticating the IC card transmitted from the automatic transaction apparatus by the IC card issuer determination means Is determined to be an IC card issued by another financial institution, the transferred determination data stored in the transferred determination data storage means is referred to and the other financial institution is referred to. A transition completion determination means for determining whether or not the function has been transferred to the basic form authentication; and when the other financial institution has been transferred to the basic form authentication by the transfer completion determination means, The authentication data transmission means for transmitting the authentication data of the IC card issued by another financial institution to the other financial institution and the transition completion determination means determine that the other financial institution has not transitioned to the basic type authentication. is the case was includes age authenticator employing an elapsed time authentication for authenticating the IC card said other financial institutions issued by said other financial institutions and offline by the migrated determination means, of the other If it is determined that the financial institution has not transitioned to the basic type authentication, the current date is stored in the transition determination data storage means, and the transition determination data of the other financial institution money is stored. Than the final date described in a period of time determining means for determining whether the elapsed time that has been determined in advance, an authentication result of the authentication data sent by the authentication data transmission unit, Any one of the authentication result receiving means received from the other financial institution, the authentication result received by the authentication result receiving means, and the authentication result authenticated for the elapsed period by the elapsed period authenticating means, and a verification result transmitting means for transmitting to the age authentication means, by the period of time judging means, if it is determined that the current date has not elapsed period is predetermined from the date of the last Adopts elapsed period authentication in which the authentication of the IC card issued by the other financial institution is performed offline with the other financial institution.

According to the IC card authentication system of configuration 3, if the transition determination unit of the IC card authentication apparatus determines that another financial institution has transitioned to basic authentication, the authentication data transmission unit If the IC card authentication data issued by the other financial institution is transmitted to the other financial institution, and the transition determining means determines that the other financial institution has not transitioned to the basic authentication, the elapsed period Since the authentication means performs the elapsed period authentication with the other financial institution for the authentication of the IC card issued by the other financial institution, the ATM need not have a function for performing the elapsed period authentication. As a result, it is possible to reduce the price at ATMs installed in financial institutions adopting basic type authentication as an IC card authentication method, and for financial institutions adopting basic type authentication to construct a system using this ATM. Cost can be reduced.
Further, according to the IC card authentication system of configuration 3, when the period elapsed determination unit determines that the current date has not passed the predetermined period from the final date, the elapsed period authentication Since the means adopts the elapsed period authentication in which the IC card issued by another financial institution is authenticated offline with the other financial institution, the IC card issued by the financial institution adopting the frequently used elapsed period authentication In each case, it is possible to prevent the process of inquiring whether or not the transition from the elapsed period authentication to the basic type authentication is made. Thereby, the authentication process of the IC card can be accelerated.

<Configuration 4>
In the configuration 3 IC card authentication system, the IC card authentication device, by the period of time judging means, if it is determined that the current date is beyond the period are predetermined from the date of the final The inquiry result received by the inquiry result receiving means, the inquiry result receiving means for receiving the inquiry result for the inquiry to the inquiry sending means, and the inquiry result receiving means. In the case where the content indicating that the basic form authentication has been transferred is described, the transfer determination data stored in the transfer determination data storage means is described in the transfer determination data of the other financial institution. It further comprises a migrated judgment data update means for updating judgment information to migrated .

  As described above, according to the present invention, the price in an ATM installed in a financial institution adopting basic type authentication as an IC card authentication method is suppressed, and a financial institution adopting basic type authentication constructs a system using this ATM. The cost at the time can be reduced.

  Next, the best mode for carrying out the present invention will be described.

  FIG. 1 is a block diagram showing a configuration of an IC card authentication system according to the present invention. As shown in FIG. 1, this IC card authentication system includes an ATM 10 installed in a bank A (financial institution) that adopts a basic authentication system as an IC card authentication system, and an authentication server 11 installed in the bank A. A host computer 12 installed at the head office of the bank A, a host computer 13-1 installed at the head office of the bank B, a host computer 13-2 installed at the head office of the bank C, and a head office of the bank D A host computer 13-3 installed at the head office, a host computer 13-4 installed at the head office of the E bank, and the like. The ATM 10 and the authentication server 11 and the authentication server 11 and the host computer 12 of the A bank are connected by dedicated lines 30 and 31 respectively, and the host computer 12 of the A bank and banks such as BE. The host computers 13-1 to 13-4 are connected to each other by an ATM network 40 shared by financial institutions.

  The bank A ATM 10 reads the card information stored in the IC card 20 and transmits this card information to the bank A authentication server 11 via the dedicated line 30. Here, in the card information, the authentication data in which the encrypted authentication information for permitting the use of the IC card 20 is described, the plaintext corresponding to the authentication information, and the encrypted authentication information are decrypted. There are an encrypted public key and a bank name that issued the IC card.

  Further, the ATM 10 receives the authentication result for the IC card 20 from which the card information has been read out from the authentication server 11 of the A bank via the dedicated line 30, and the authentication result for permitting the use of the IC card 20 as the authentication result. If the authentication result is an authentication result that does not permit the use of the IC card 20 as an authentication result, for example, a normal transaction such as withdrawal, deposit, or transfer is started. For example, “This IC card cannot be used” is displayed on the display panel.

  The authentication server 11 of bank A includes a bank information DB 111, plain text data 112, a SAM storage unit 113, and a control unit 114. The bank information DB 111 stores bank information data shown in FIG. As shown in FIG. 2, the bank information data includes a financial institution code column in which a financial institution code is described, a bank name column in which a bank name is described, and basic type authentication in which whether or not the basic type authentication has been transferred is described. Column, and a final check date / time column in which the date / time when the bank that issued the IC card 20 issued by a bank other than the bank A inquires whether or not it has finally shifted to basic authentication is described.

  The plaintext data 112 stores plaintext corresponding to the encrypted authentication information described in the authentication data stored in the IC card 20 when the bank A issues the IC card 20. This plain text is unique certificate data issued by a bank. Here, the authentication information described in the authentication data is obtained by encrypting plaintext with a secret key.

  The SAM storage unit 113 illustrated in FIG. 1 stores a SAM (Security Application Module) including a program that causes the control unit 114 to perform the elapsed period authentication of the IC card 20.

  The control unit 114 performs the following processing by executing a control program formed by a CPU and stored in a ROM (not shown). That is, when the authentication server 11 of bank A receives the card information from the ATM 10, the control unit 114 reads the name of the bank that issued the IC card 20 from the card information, and whether or not the read bank name is the bank (A bank). Determine whether. As a result of the determination, if the control unit 114 determines that the read bank name is A bank, the authentication data read first is decrypted with the common key read first, and the decrypted authentication data and plaintext data are decrypted. By verifying whether or not the plaintext data stored in 112 matches, authentication processing is performed to determine whether to permit or disallow use of the IC card 20. Thereafter, the control unit 114 transmits the authentication result to the ATM 10 via the dedicated line 30.

  If the control unit 114 determines that the read bank name is not bank A, that is, if it is determined to be that of another bank, the bank information in which the bank name that issued the IC card 20 from the bank information DB 111 is described. Read the data, and determine whether the basic type authentication column in the read bank information data is “transferred” indicating that the bank has been transferred to basic type authentication, or “not yet” indicating that it has not been transferred To do. When it is determined that the basic type authentication column in the read bank information data is “transferred”, the control unit 114 reads out the authentication data from the card information stored in the RAM, and uses this authentication data for exclusive use. The data is transmitted to the host computer 12 of the A bank via the line 31.

  When the control unit 114 determines that the basic form authentication column in the read bank information data is “not yet”, the bank information in which the bank name read from the RAM previously stored in the bank information DB 111 is described. The data is read out, and it is determined whether or not the period between the last check date and time described in the bank information data and the current date and time has passed for a predetermined period or more. As a result, if the control unit 114 determines that the period between the last check date and the current date and time is equal to or longer than a predetermined period, an inquiry is made as to whether or not the basic form authentication has been performed. The data is transmitted to the host computer of the other bank through the host computer 12 of the A bank.

  When receiving the inquiry result from the host computer of the other row, the control unit 114 determines whether the content of the inquiry result has been transferred to the basic form authentication or has not been transferred yet. If the control unit 114 determines that the content of the inquiry result has been transferred to the basic authentication, the bank name column stored in the bank information DB 111 is included in the bank information data of this other bank. Update the described basic type authentication column from “not yet” to “migrated”. On the other hand, if the control unit 114 determines that the content of the inquiry has not been transferred to the basic authentication, the control unit 114 sets the date and time described in the last check date and time column described in the bank information data to the IC card. 20 is updated to the current date and time of authentication.

  In addition, when the control unit 114 determines that the period between the last check date and the current date is a predetermined period, for example, less than one week, the control unit 114 forms the SAM from the SAM storage unit 113. The program is read sequentially, and the elapsed period authentication is performed. That is, the control unit 114 reads from the RAM the encrypted public key issued by the certificate authority that is already stored in the RAM, and decrypts the public key with the private key stored in advance in the flash memory. Next, the control unit 114 reads out from the encrypted authentication data RAM already stored in the RAM, and decrypts the read-out encrypted authentication data with the previously decrypted public key.

  Further, the control unit 114 reads plaintext corresponding to the authentication data already stored in the RAM from the RAM, matches the plaintext with the authentication data, and indicates that the IC card 20 is permitted to use when the two match. An authentication result describing “permitted” or “not permitted” that does not permit the use of the IC card 20 when the two do not match is generated and transmitted to the ATM 10 via the dedicated line 30. In other words, the control unit 114 includes a migration completion determination data storage unit, an IC card issuer determination unit, a migration completion determination unit, an authentication data transmission unit, an elapsed period authentication unit, an authentication result reception unit, and an authentication result transmission unit. .

  The host computer 12 of the A bank transmits the authentication data transmitted from the authentication server 11 via the ATM network 40 to the host computer of another bank that performs basic authentication. In addition, the host computer 12 of the A bank transmits the above-described inquiry transmitted from the authentication server 11 to the corresponding host computer of another bank, and transmits the inquiry result to the authentication server 11.

  The bank B host computer 13-1 includes plain text data corresponding to the authentication information described in the authentication data stored in the issued IC card 20. When the host computer 13-1 of the B bank receives the authentication data from the authentication server 11 via the host computer 12 of the A bank, the host computer 13-1 performs an authentication process on the authentication data based on the plain text data, and displays the authentication result as A. The data is transmitted to the authentication server 11 via the bank host computer 12.

  When receiving the inquiry, the bank C host computer 13-2 transmits the inquiry result to the authentication server 11 via the bank A host computer 12.

  Upon receiving the inquiry, the bank D host computer 13-3 transmits an inquiry result for the inquiry to the authentication server 11 via the bank A host computer 12.

  The host computer 13-4 of E bank is provided with plain text data corresponding to the authentication information described in the authentication data stored in the issued IC card 20. Further, when the host computer 13-4 of the E bank receives the authentication data from the authentication server 11 via the host computer 12 of the A bank, the E bank performs an authentication process on the authentication data based on the plain text data, and the authentication result is displayed as A. The data is transmitted to the authentication server 11 via the bank host computer 12.

  Next, the operation of the IC card authentication system according to the present invention will be described.

  4 and 5 are flowcharts showing the operation of the IC card authentication system according to the present invention. First, when the user inserts the IC card 20 into the card reading portion of the ATM 10 of the A bank, the ATM 10 reads the card information stored in the IC card 20 (step S1), and this card via the dedicated line 30. Information is transmitted to the authentication server 11 of A bank (step S2).

  In the case of the IC card 20 used for basic authentication, the card information transmitted to the authentication server 11 includes the name of the bank that issued the IC card 20 and the encrypted authentication for authenticating the IC card 20. There is authentication data in which information is described.

  In the case of the IC card 20 used for the elapsed period authentication, the name of the bank that issued the IC card 20, the authentication data in which the authentication information for permission to use the encrypted IC card 20 is described, and this authentication data is decrypted There is an encrypted public key for authentication, and plain text data to be associated with the authentication data decrypted during the authentication process.

  When the authentication server 11 of bank A receives the card information from the ATM 10 (step S3), the control unit 114 of the authentication server 11 temporarily stores the received card information in the RAM. Next, the control unit 114 reads the name of the bank that issued the IC card 20 from the card information stored in the RAM. Next, the control unit 114 determines whether or not the read bank name is the bank (A bank) (step S4). When it is determined that the read bank name is the bank (step S4; YES), the control unit 114 reads the encrypted authentication data from the card information stored in the RAM.

  Next, the control unit 114 decrypts the read authentication data with a common key stored in a flash memory (not shown). Thereafter, the control unit 114 verifies whether or not the decrypted authentication data matches the stored plaintext data, thereby determining whether to permit or disallow the use of the IC card 20. Processing is performed (step S5). When completing the authentication process, the control unit 114 transmits the authentication result to the ATM 10 via the dedicated line 30 (step S6). In the authentication result, “permitted” is described when the use of the IC card 20 is permitted, and “not permitted” is described when the use of the IC card 20 is not permitted.

  The ATM 10 of the bank A receives the authentication result from the authentication server 11 (step S7), and determines whether the authentication result is a result of permitting use of the IC card 20 or a result of disapproval ( Step S8). When the ATM 10 determines that the authentication result is a result of “permitting” the use of the IC card 20 (step S8; YES), after that, for example, normal transaction processing such as withdrawal processing, deposit processing, transfer processing, etc. (Step S9), and the authentication process is terminated.

  In step S8, when the ATM 10 determines that the authentication result is a result of “not permitting” the use of the IC card 20 (step S8; NO), the ATM 10 displays a display panel (not shown) on the display panel. “This IC card cannot be used as a result of authentication” is displayed (step S10), and the authentication process is terminated.

  In step S4, if the control unit 114 determines that the read bank name is not the bank (A bank) (step S4; NO), that is, if it is determined that the bank name is that of another bank, the control unit 114 reads the IC from the bank information DB 111. The bank information data describing the name of the bank that issued the card 20 is read. Next, the control unit 114 indicates that the basic type authentication column in the read bank information data is “transferred” indicating that the bank has been transferred to the basic type authentication, or “not yet” indicating that the bank has not been transferred. It is determined whether or not there is (step S11).

  When it is determined that the basic form authentication column in the read bank information data is “transferred” (step S11; “transferred”), the control unit 114 authenticates the card information stored in the RAM. The data is read, and this authentication data is transmitted to the host computer 12 of the A bank via the dedicated line 31 (step S12).

  For example, when the bank name read out from the card information in the RAM by the control unit 114 is B bank, as shown in FIG. 2, the bank information in the bank information DB B 111 stored in the bank information DB 111 is used. Since “transferred” is described in the basic type authentication column, the authentication data of the IC card 20 issued by the B bank is transmitted to the host computer 12 of the A bank.

  The bank A host computer 12 transmits the authentication data transmitted from the authentication server 11 via the ATM network 40 to another bank host computer, for example, the bank B host computer 13-1 in the above example (step S13). ).

  When the host computer of another bank, for example, the host computer 13-1 of the bank B in the above example, receives the authentication data from the host computer 12 of the bank A (step S14), it performs an authentication process (step S15). That is, since the host computer 13-1 of the B bank has already shifted to the basic type authentication, the authentication process similar to the above-described authentication process in step S5 is performed using the stored plaintext data. Thereafter, the bank B host computer 13-1 transmits the authentication result to the bank A host computer 12 via the ATM network 40 (step S16).

  When receiving the authentication result from the bank B host computer 13-1, the bank A host computer 12 transmits the authentication result to the authentication server 11 via the dedicated line 31 (step S17).

  When the authentication server 11 receives the authentication result from the bank A host computer 12 (step S18), the control unit 114 shifts the process to step S6 and continues the same process as described above.

  In step S11, if the control unit 114 determines that the basic form authentication column in the read bank information data is “not yet” (step S11; “not yet”), the control unit 114 first stores it in the bank information DB 111. The bank information data in which the bank name read from the RAM is described is read, and a period between the last check date described in the bank information data and the current date is determined in advance, for example, one week or more It is determined whether or not it has elapsed (step S19).

  For example, in the case of the IC card 20 issued by bank C, as shown in FIG. 2, the control unit 114 determines that the basic form authentication column in the bank information data is “not yet”.

  When the control unit 114 determines that the period between the last check and the current date and time is a predetermined period, for example, one week or more (step S19; YES), for example, in the above example, An inquiry is sent to the host computer 12 of the A bank via the dedicated line 31 as to whether or not the basic type authentication is transmitted to the host computer 13-2 of the bank C name (step S20).

  Upon receiving the inquiry, the bank A host computer 12 transmits the inquiry to the bank C host computer 13-2 via the ATM network 40 (step S21).

  When the bank C host computer 13-2 receives the query from the bank A host computer 12 (step S22), the bank A host computer 12 transmits the query result for the query via the ATM network 40 (step S22). S23).

  When the host computer 12 of the A bank receives the inquiry result from the host computer 13-2 of the C bank, it transmits it to the authentication server 11 via the dedicated line 31 (step S24).

  When the authentication server 11 receives the inquiry result from the bank A host computer 12 (step S25), the control unit 114 indicates that the content of the inquiry result has been transferred to basic authentication or has not yet been transferred. Is determined (step S26). When the control unit 114 determines that the content of the inquiry result has been transferred to the basic form authentication (step S26; YES), the bank name column stored in the bank information DB 111 is C bank. The basic form authentication field described in the bank information data is updated from “not yet” to “transferred” (step S27). Next, the control unit 114 proceeds to step S12 and continues the same processing as described above.

  On the other hand, if the control unit 114 determines that the content of the inquiry has not been transferred to the basic form authentication (step S26; NO), the control unit 114 is the last described in the bank information data whose bank name column is C bank. The date and time described in the check date and time column is updated to the current date and time when this IC card is authenticated (step S28), and the process proceeds to step S29.

  In step S19, when the control unit 114 determines that the period between the last check date and the current date is a predetermined period, for example, less than one week (step S19; NO), the SAM The program for forming the SAM is sequentially read from the storage unit 113, and the elapsed period authentication is performed (step S29). That is, the control unit 114 reads from the RAM the encrypted public key issued by the certificate authority that is already stored in the RAM, and decrypts the public key with the private key stored in advance in the flash memory. Next, the control unit 114 reads the encrypted authentication data already stored in the RAM from the RAM, and decrypts the read encrypted authentication data with the previously decrypted public key.

  Next, the control unit 114 reads the plaintext corresponding to the authentication data already stored in the RAM from the RAM, matches this plaintext with the authentication data, and indicates the permission to use the IC card 20 when the two match. An authentication result in which “permitted” and “not permitted” that does not permit the use of the IC card 20 when both are not matched is generated, the process proceeds to step S6, and the same process as described above is continued. Let

  According to the embodiment, when the control unit 114 of the authentication server 11 determines that another bank has already shifted to the basic authentication, the authentication data of the IC card issued by the other bank is used as the other bank. On the other hand, if it is determined that the other bank has not transitioned to the basic type authentication, the authentication of the IC card issued by this other bank is authenticated with this other bank, so the ATM 10 Eliminates the need for a function to perform elapsed period authentication. As a result, the price of ATM 10 installed in a bank adopting basic type authentication as an IC card authentication method can be suppressed, and the cost for a financial institution adopting basic type authentication to construct a system using ATM 10 can be reduced. Can be reduced.

  In addition, according to the embodiment, when the control unit 114 of the authentication server 11 determines that the current date and time has not passed the predetermined period from the final date and time, the IC issued by another bank Since the card authentication is performed offline with other banks, the IC card 20 issued by a bank adopting the frequently used elapsed time authentication is transferred from the elapsed time authentication to the basic authentication each time. It is possible to prevent the process of inquiring whether or not it has been done. Thereby, the authentication process of the IC card 20 can be accelerated.

  In the above-described embodiments, a bank is described as an example of a financial institution. However, when it is necessary to perform IC card authentication, the same can be realized in other cases. In this embodiment, the elapsed period authentication is performed in the authentication server 11 of the bank A, and the basic type authentication is executed by the host computer of each bank. An authentication process may be executed.

It is a block diagram which shows the structure of the IC card authentication system of the Example which concerns on this invention. It is a figure which shows the bank information data memorize | stored in bank information DB in FIG. It is a figure which shows the plaintext data in FIG. It is a flowchart (the 1) which shows operation | movement of the IC card authentication system of the Example which concerns on this invention. It is a flowchart (the 2) which shows operation | movement of the IC card authentication system of the Example which concerns on this invention.

Explanation of symbols

10 ATM
11 Authentication server 111 Bank information DB
112 plaintext data 113 SAM storage unit 114 control unit 12 A bank host computer 13-1 B bank host computer 13-2 C bank host computer 13-3 D bank host computer 13-4 E bank host computer 30, 31 Dedicated line 40 ATM network

Claims (4)

IC card authentication for authenticating an IC card based on authentication data for authenticating the IC card, which is transmitted from an automatic transaction apparatus installed by a financial institution adopting basic authentication that performs online authentication. In the device
The transition determination information indicating whether or not another financial institution has transitioned to the basic type authentication, and the final inquiry that has made an inquiry about whether or not the other financial institution has transitioned to the basic type authentication. A migration completion determination data storage means for storing migration completion determination data in which inquiry final date information indicating a date is described;
IC for determining whether the authentication data for authenticating the IC card transmitted from the automatic transaction apparatus is an IC card issued by this financial institution or an IC card issued by another financial institution A card issuer determination means;
If the IC card issuer determination means determines that the authentication data for authenticating the IC card transmitted from the automatic transaction apparatus is an IC card issued by another financial institution, the transition completion determination A transition determination unit that refers to the transition determination data stored in the data storage unit and determines whether the other financial institution has transitioned to basic authentication;
If it is determined by the transition completion determination means that the other financial institution has transitioned to basic authentication, the authentication data of the IC card issued by the other financial institution is sent to the other financial institution. Authentication data transmitting means for transmitting;
By the migrated determination unit, when the other financial institution is determined not already migrated to Basic authentication, the elapsed for authenticating the IC card issued by said other financial institutions said other financial institutions and offline An elapsed period authentication means that employs period authentication;
If it is determined by the transition completion determination means that the other financial institution has not yet transitioned to the basic type authentication, the current date is stored in the transition completion determination data storage means, the other financial institution A period elapsed determination means for determining whether or not a predetermined period has elapsed from the last date described in the transferred determination data of gold;
An authentication result receiving means for receiving an authentication result for the authentication data transmitted by the authentication data transmitting means from the other financial institution;
The authentication result received by the verification result receiving unit, and, one of the age authenticated authentication result by the elapsed time authentication unit, and a verification result transmitting means for transmitting to said automatic transaction apparatus,
The elapsed period authentication means determines that an IC issued by the other financial institution is determined by the period elapse determination means when the current date is determined not to have passed a predetermined period from the final date. An IC card authenticating apparatus characterized by adopting an elapsed period authentication in which card authentication is performed off-line with the other financial institution . An inquiry transmission means for transmitting the inquiry to the other financial institution when the period elapse determination means determines that the current date has passed a predetermined period from the final date; ,
An interim result receiving means for receiving an inquiry result for the inquiry to the inquiry transmitting means;
If the inquiry result received by the inquiry result receiving means describes that the inquiry has been transferred to the basic authentication, the other financial data stored in the transferred determination data storage means Transitioned judgment data updating means for updating the judgment information described in the transition judgment data of the institution to migrated;
The IC card authentication apparatus according to claim 1, further comprising: An automatic transaction apparatus installed by a financial institution adopting basic authentication for performing IC card authentication online, and an IC card authentication apparatus for authenticating the IC card based on authentication data for authenticating the IC card, In the IC card authentication system in which the automatic transaction apparatus and the IC card authentication apparatus are communicatively connected,
The automatic transaction apparatus is
Authentication data reading means for reading authentication data from the IC card;
Authentication data transmitting means for transmitting the authentication data read by the authentication data reading means to the IC card authenticating device;
An authentication result receiving means for receiving an authentication result for the authentication data transmitted by the authentication data transmitting means from the IC card authenticating device;
The IC card authentication device
The transition determination information indicating whether or not another financial institution has transitioned to the basic type authentication, and the final inquiry that has made an inquiry about whether or not the other financial institution has transitioned to the basic type authentication. A migration completion determination data storage means for storing the migration completion determination data in which the inquiry final date information indicating the date is described;
IC card for determining whether the confirmation data for authenticating the IC card transmitted from the automatic transaction apparatus is an IC card issued by this financial institution or an IC card issued by another financial institution An issuer determination means;
If the IC card issuer determination means determines that the authentication data for authenticating the IC card transmitted from the automatic transaction apparatus is an IC card issued by another financial institution, the transition completion determination A transition determination unit that refers to the transition determination data stored in the data storage unit and determines whether the other financial institution has transitioned to basic authentication;
If it is determined by the transition completion determination means that the other financial institution has transitioned to basic authentication, the authentication data of the IC card issued by the other financial institution is sent to the other financial institution. Authentication data transmitting means for transmitting;
By the migrated determination unit, when the other financial institution is determined not already migrated to Basic authentication, the elapsed for authenticating the IC card issued by said other financial institutions said other financial institutions and offline An elapsed period authentication means that employs period authentication;
If it is determined by the transition completion determination means that the other financial institution has not yet transitioned to the basic type authentication, the current date is stored in the transition completion determination data storage means, the other financial institution A period elapsed determination means for determining whether or not a predetermined period has elapsed from the last date described in the transferred determination data of gold;
An authentication result receiving means for receiving an authentication result for the authentication data transmitted by the authentication data transmitting means from the other financial institution;
The authentication result received by the verification result receiving unit, and, one of the age authenticated authentication result by the elapsed time authentication unit, and a verification result transmitting means for transmitting to said automatic transaction apparatus,
The elapsed period authentication means determines that an IC issued by the other financial institution is determined by the period elapse determination means when the current date is determined not to have passed a predetermined period from the final date. An IC card authentication system characterized by adopting elapsed period authentication in which card authentication is performed offline with the other financial institution . The IC card authentication device
An inquiry transmission means for transmitting the inquiry to the other financial institution when the period elapse determination means determines that the current date has passed a predetermined period from the final date; ,
An interim result receiving means for receiving an inquiry result for the inquiry to the inquiry transmitting means;
If the inquiry result received by the inquiry result receiving means describes that the inquiry has been transferred to the basic authentication, the other financial data stored in the transferred determination data storage means Transitioned judgment data updating means for updating the judgment information described in the transition judgment data of the institution to migrated;
The IC card authentication system according to claim 3, further comprising:

Images