JP6578659B2 - Transaction system and transaction method - Google Patents

Description

  The present invention relates to a technique for preventing illegal transactions.

  2. Description of the Related Art Conventionally, there is a technique for preventing illegal transactions in electronic transactions. For example, in Patent Document 1, after a temporary reception ID is displayed on a first user terminal such as a personal computer, a temporary reception ID is transmitted by a second user terminal such as a mobile phone, thereby authenticating the user at the time of login. A technique for strengthening is disclosed. Non-Patent Documents 1 and 2 disclose security threats when performing online banking. For example, in Non-Patent Document 1, in online banking via the Internet, malware (virus) that has secretly entered a user terminal such as a personal computer or smartphone monitors the communication status, and the user performs online banking. When it is detected that the browser has started, a “Man-in-the-Browser attack” that steals and alters the communication content of the browser is disclosed.

JP-A-2005-202806

Bank of Japan Financial Research Institute homepage, Discussion Paper No. 2013-J-4, Measures against Man-in-the-Browser Attack against Online Banking Safety Evaluation of “Transaction Authentication”, Masataka Suzuki, Junji Nakayama, Kunikuni Furuhara, [Search on August 26, 2013] Internet <URL: http://www.imes.boj.or.jp/research/abstracts/japanese/13-J-04.html> FFRI website, security report Monthly Research July 2012, new attacks on browsers and new countermeasures, Tsukasa Oi, [searched on August 26, 2013], Internet <URL: http: //www.fourteenforty .jp / research / monthly_research.htm>

  When a user terminal used for online banking is infected with a virus and is subjected to a Man-in-the-Browser attack, the web browser is hijacked, so that authentication of the user at login to online banking is strengthened. There is a problem that the countermeasures cannot prevent fraudulent transactions. This invention makes it a main subject to provide the transaction system which can detect an unauthorized transaction reliably.

One aspect of the present invention is a transaction system including a server that executes a process related to a transaction, and a first terminal and a second terminal that instruct the server to execute the process related to the transaction. The terminal includes: display control means for displaying a transaction screen for inputting the details of the transaction; first transmission means for transmitting input information to the transaction screen to the server; and image data indicating the transaction screen. and a second transmission means for transmitting to said second terminal, said server, said first extracting transaction information from the input information received from the terminal, the third transmission to be transmitted to the second terminal comprising means, the second terminal, and transaction information extracted from the image data received from said first terminal, said comparing the transaction information received from the server, a fraudulent transaction detection means for displaying a comparison result Prepare.

The transaction system includes a server that executes a process related to a transaction, and first and second terminals that instruct the server to execute the process related to the transaction. In the first terminal, a transaction screen for inputting the contents of the transaction is displayed, input information to the transaction screen is transmitted to the server by the first transmission means, and image data indicating the transaction screen is displayed by the second transmission means. Is transmitted to the second terminal. Further, the server extracts transaction information from the input information received from the first terminal, and transmits it to the second terminal. Then, the second terminal compares the transaction information extracted from the image data received from the first terminal with the transaction information received from the server, and displays the comparison result.

According to the trading system, the even if the input information to the transaction screen to be transmitted from the first terminal to the server has been tampered with, the second terminal is image data to be transmitted directly from the first terminal By using the extracted transaction information , it is possible to detect the presence or absence of tampering.

In one aspect of the transaction system, the second transmission unit transmits image data captured from the input transaction screen to the second terminal, and the fraudulent transaction detection unit includes the first transaction system . The transaction information is extracted by performing a character recognition process on the image data received from the terminal . In this aspect, even if the first terminal is infected with a virus, the correct transaction information can be transmitted to the second terminal using the image data.

In another aspect of the transaction system, the second transmission unit transmits image data in which input information to the transaction screen is embedded to the second terminal, and the unauthorized transaction detection unit includes the first The transaction information is extracted from input information embedded in image data received from one terminal . In this aspect, even when the terminal is infected with a virus, correct transaction information can be transmitted to the second terminal by the input information embedded in the image data.

In the other one aspect | mode of said transaction system, a said 2nd transmission means transmits the said image data to a said 2nd terminal by near field communication. As a result, it is ensured that one user is operating the first terminal and the second terminal at the same place, thereby ensuring the safety of the transaction.

In another mode of the trading system, the fraudulent transactions detecting means, execution of the transaction if the transaction information received the extracted transaction information from the image data received from the first terminal from the server matches Is displayed, and when the transaction information extracted from the image data received from the first terminal does not match the transaction information received from the server, a display recommending that the transaction be stopped is performed. As a result, the user can cancel the illegal transaction.

In another aspect of the transaction system, the first terminal further includes position information transmission means for transmitting information indicating the position of the first terminal to the second terminal, and the fraudulent transaction detection means. Displays a recommendation to execute the transaction only when the position of the first terminal is within a predetermined range from the position of the second terminal. As a result, it is ensured that one user is operating the first terminal and the second terminal at the same place, thereby ensuring the safety of the transaction.

In another aspect of the present invention, a transaction method executed by a transaction system including a server that executes a process related to a transaction, and a first terminal and a second terminal that instruct the server to execute the process related to the transaction. A display step of displaying a transaction screen for inputting the details of the transaction by the first terminal, and a first transmission step of transmitting input information to the transaction screen to the server by the first terminal. And the second transmission step of transmitting image data indicating the transaction screen to the second terminal by the first terminal, and the server received from the first terminal in the first transmission step by the server. extracts the transaction information from the input information, and a third transmission step of transmitting to said second terminal, said the second terminal, transaction information extracted from the image data received from said first terminal, said server Comparing the al received transaction information, having a fraudulent transaction detection step of displaying the comparison results. According to this method, even if the input information to the transaction screen transmitted from the first terminal to the server is falsified, the second terminal is extracted from the image data transmitted directly from the first terminal . by using the transaction information, it is possible to detect the presence or absence of falsification.

Another aspect of the present invention is a transaction system including a server that executes a process related to a transaction, and a first terminal and a second terminal that instruct the server to execute the process related to the transaction. The terminal includes: display control means for displaying a transaction screen for inputting the details of the transaction; first transmission means for transmitting input information to the transaction screen to the server; and image data indicating the transaction screen. and a second transmission means for transmitting to said second terminal, said server, said first extracting transaction information from the input information received from the terminal, the third transmission to be transmitted to the second terminal comprising means, said second terminal, said first extracted transaction information from the image data received from the terminal, said comparing the transaction information received from the server, the image received from the first terminal Extract from data When the the transaction information received transaction information from the server do not match, transmits an instruction to cancel the transaction to the server.

The transaction system includes a server that executes a process related to a transaction, and first and second terminals that instruct the server to execute the process related to the transaction. In the first terminal, a transaction screen for inputting the contents of the transaction is displayed, input information to the transaction screen is transmitted to the server by the first transmission means, and image data indicating the transaction screen is displayed by the second transmission means. Is transmitted to the second terminal. Further, the server extracts transaction information from the input information received from the first terminal, and transmits it to the second terminal. Then, the second terminal compares the transaction information extracted from the input image data received from the first terminal with the transaction information received from the server, and if the two do not match, an instruction to stop the transaction To the server.

According to the transaction system, since the transaction is stopped when the input information to the transaction screen transmitted from the first terminal to the server is falsified, the security can be further improved.

Another aspect of the present invention is a transaction method executed by a transaction system including a server that executes a process related to a transaction, and a first terminal and a second terminal that instruct the server to execute the process related to the transaction. A display step of displaying a transaction screen for inputting the contents of the transaction by the first terminal, and a first step of transmitting input information to the transaction screen to the server by the first terminal. A transmission step, a second transmission step for transmitting image data indicating the transaction screen to the second terminal by the first terminal, and a reception by the server from the first terminal in the first transmission step. and was extracted transaction information from said input information, and a third transmission step of transmitting to said second terminal, by said second terminal, and transaction information extracted from the image data received from said first terminal, said S Comparing the transaction information received from the server, when said transaction information received extracted and the transaction information from said server from said image data received from the first terminal does not match, an instruction to cancel the transaction And a transaction canceling step for transmitting to the server.

  According to the transaction method described above, since the transaction is stopped when the input information to the transaction screen transmitted from the first terminal to the server is falsified, the security can be further improved.

  According to the transaction system of the present invention, even if a terminal that displays a transaction screen or the like is infected with a virus or the like, it is possible to accurately determine whether or not the transaction content has been tampered with based on the input information on the transaction screen, and fraud Can be reliably prevented.

The structure of the transaction system which concerns on embodiment is shown. The block diagram of a service provider server is shown. The block diagram of a user terminal is shown. It is a flowchart which shows the process sequence in 1st Embodiment. A display example of the login screen is shown. The example of a display of a transaction screen is shown. A display example of a capture instruction screen is shown. A display example of the transaction content confirmation screen is shown. It is a display example of a transfer completion screen. It is a flowchart which shows the process sequence in 2nd Embodiment. The example of the additional image by the modification of 4th Embodiment is shown. The structure of the transaction system which concerns on a modification is shown.

  Hereinafter, preferred embodiments for carrying out the present invention will be described with reference to the drawings. The transaction system described below is a system that can suitably prevent tampering of transaction contents when performing electronic transactions such as online banking using the Internet.

[First Embodiment]
(Structure of transaction system)
FIG. 1 shows a configuration of a transaction system according to the present embodiment. The transaction system includes a service provider server 1 managed by a service provider such as a bank, and user terminals 3A and 3B used by users who receive the services described above. The user terminal 3A is a PC, for example, and is used by the user to input a transaction instruction. On the other hand, the user terminal 3B is, for example, a smartphone, and is used to check whether the transaction content input by the user through the user terminal 3A has been tampered with. The service provider server 1 and the user terminals 3A and 3B perform data communication via a communication network 2 such as the Internet. Further, in the example of FIG. 1, an attacker server 4 that attempts to execute unauthorized transactions by altering the communication content between the service provider server 1 and the user terminal 3 </ b> A is connected to the communication network 2.

  When the user terminal 3A is infected with malware (virus) that can be controlled by the attacker server 4, the attacker server 4 receives or inputs the content displayed by the user terminal 3A on the Web browser via the malware. Steal or alter contents. For example, the attacker server 4 falsifies the input content on the screen (also referred to as “transaction screen”) for specifying the transaction content displayed by the user terminal 3A using the Web browser, and transmits it to the service provider server 1. The response content from the service provider server 1 is also rewritten so that it has not been altered. Thereby, the attacker server 4 tries to tamper with the transaction contents so that the user of the user terminal 3A does not notice. Thus, the attacker server 4 performs a so-called Man-in-the-Browser attack. As will be described later, the transaction system according to the present embodiment prevents unauthorized transactions due to such alteration of transaction contents of the attacker server 4.

  FIG. 2 is a block diagram of the service provider server 1. The service provider server 1 includes a display unit 11 such as a display, an input unit 12 such as a keyboard, a storage unit 13, a communication unit 14 that performs data communication, and a control unit 15. Each of these elements is connected to each other via a bus line 10.

  The storage unit 13 is configured by a hard disk or a memory such as a ROM or a RAM. The storage unit 13 stores information necessary for user authentication such as a login ID and a password and other user information in a database. The storage unit 13 also stores information necessary for generating display information for each screen such as a program necessary for the service provider server 1 to function as a Web server and a transaction screen displayed by the user terminal 3A. Remember.

  The control unit 15 includes a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like (not shown), and performs various controls on each component in the service provider server 1.

  FIG. 3A is a block diagram of the user terminal 3A. The user terminal 3 </ b> A includes a display unit 31 such as a display, an input unit 32 such as a keyboard, a storage unit 33, a communication unit 34 that performs data communication, and a control unit 35. These elements are connected to each other via a bus line 30.

  The storage unit 33 is configured by a hard disk or a memory such as a ROM or a RAM. The storage unit 33 stores each program executed by the control unit 35. For example, the storage unit 33 stores a program for starting a Web browser (viewer) that displays a predetermined Web page based on an HTML file or the like received from the service provider server 1.

  Further, the storage unit 33 operates in cooperation with the service provider server 1 and stores a program (also referred to as “agent program”) for determining whether or not the transaction content has been tampered with. The agent program is activated, for example, when the user terminal 3A is activated, or when the web browser is activated or when the user terminal 3A displays a transaction screen using the web browser.

  The storage unit 33 stores in advance a public key (encryption key) for encrypting data transmitted from the user terminal 3A to the user terminal 3B based on the agent program.

  The communication unit 34 communicates with the service provider server 1 through the communication network 2. The communication unit 34 communicates with the user terminal 3B by short-range wireless communication such as Bluetooth (registered trademark).

  The control unit 35 includes a CPU, a ROM, a RAM, and the like (not shown), and performs various controls on each component in the user terminal 3A. The control unit 35 performs predetermined processing by executing each program stored in the storage unit 33. For example, the control unit 35 executes the agent program to generate image data (also referred to as “capture image data Im”) indicating the transaction screen in which the transaction content is input, and the storage unit 33 stores the image data. It is encrypted with the public key and transmitted to the user terminal 3B. The control unit 35 functions as display control means, first transmission means, and second transmission means in the present invention.

  FIG. 3B is a block diagram of the user terminal 3B. The user terminal 3B includes a display unit 41 such as a display, an input unit 42 such as a touch panel provided on the display, a storage unit 43, a communication unit 44 that performs data communication, and a control unit 45. Each of these elements is connected to each other via a bus line 40.

  The storage unit 43 is configured by a hard disk or a memory such as a ROM or a RAM. The storage unit 43 stores each program executed by the control unit 45. The storage unit 43 stores a secret key (decryption key) for decrypting the encrypted data transmitted from the user terminal 3A.

  The control unit 45 decrypts the encrypted captured image data Im transmitted from the user terminal 3A using the secret key. Further, the control unit 45 executes the character recognition program stored in the storage unit 43 and extracts transaction information from the captured image data Im. Further, the control unit 45 receives the transaction information included in the input information of the transaction screen transmitted from the user terminal 3A to the service provider server 1 from the service provider server 1, and extracts the transaction extracted from the captured image data IM. The comparison result is displayed on the display unit 41 in comparison with the information. The control unit 45 functions as an unauthorized transaction detection unit in the present invention.

  The communication unit 44 communicates with the service provider server 1 through the communication network 2. The communication unit 44 communicates with the user terminal A by short-range wireless communication such as Bluetooth (registered trademark).

(Processing flow)
Next, processing of the transaction system in the present embodiment will be described. Schematically, the user terminal 3B refers to the captured image data Im transmitted from the user terminal 3A based on the agent program, so that the input information indicating the transaction content transmitted based on the function of the Web browser is falsified. Check if it has been done. Thereby, even if the Web browser of the user terminal 3A is hijacked by a virus, unauthorized transactions are reliably prevented.

  FIG. 4 is a flowchart showing a processing procedure executed by the transaction system in the present embodiment. In FIG. 4, for the user terminal 3A, processing based on the function of the Web browser and processing based on the agent program are described separately.

  First, the user terminal 3A displays a login screen using a Web browser based on the display information received from the service provider server 1, and accepts input of login information such as a login ID and password (step S101). A display example of the login screen will be described later with reference to FIG. Then, the user terminal 3 transmits the login information input on the login screen to the service provider server 1.

  Next, the service provider server 1 identifies and authenticates the user based on the login information received from the user terminal 3 (step S102). For example, the service provider server 1 identifies the user of the login information transmission source by the login ID included in the login information, and authenticates the user by the password received together with the login ID. And service provider server 1 complete | finishes a process, when a user's authentication is not successful (step S103; No).

  When the user authentication is successful (step S103; Yes), the service provider server 1 transmits display information on the transaction screen to the user terminal 3A (step S104). A display example of the transaction screen will be described later with reference to FIG. Then, the user terminal 3A receives display information from the service provider server 1, displays a transaction screen by a Web browser, and accepts an input for specifying transaction details (step S105).

  Next, based on the agent program, the user terminal 3A accepts an instruction to generate captured image data Im indicating a transaction screen for which input of transaction details has been input, and generates captured image data Im (step S106). For example, the user terminal 3A displays a window having a button for instructing generation of the captured image data Im based on the agent program, and when detecting that the button is pressed, the user terminal 3A displays the captured image data Im. Generated and stored in the storage unit 33. A display example of this window will be described later with reference to FIG. In another example, the user terminal 3 </ b> A stores, in the storage unit 33, captured image data Im indicating a displayed transaction screen when detecting a key input with a predetermined keyboard for instructing screen capture.

  Next, based on the agent program, the user terminal 3A encrypts the captured image data Im with the public key stored in the storage unit 33, and the encrypted captured image data Im is transmitted to the user terminal 3B by short-range wireless communication. (Step S107).

  The user terminal 3B receives the encrypted captured image data Im and decrypts it with the secret key stored in advance in the storage unit 13 (step S108). Thereby, the user terminal 3B acquires the captured image data Im. Next, the user terminal 3B extracts information (also referred to as “transaction information Ia”) indicating transaction contents displayed in the captured image data Im by character recognition (step S109). For example, the user terminal 3B extracts, as the transaction information Ia, a character string representing each item such as a bank name and a branch name, an account number, and a transfer amount input on the transaction screen by character recognition.

  Next, based on the function of the Web browser, the user terminal 3A detects an input information transmission instruction indicating the transaction content input on the transaction screen, and transmits the input information (step S110). For example, the user terminal 3A transmits the input information on the transaction screen when a predetermined transmission button provided on the transaction screen is selected and pressed by a mouse operation or the like. In this case, the user terminal 3A transmits the above-described input information by the POST method of HTTP (Hyper Text Transfer Protocol). Note that the communication in step S110 is encrypted by, for example, encrypted communication using SSL (Secure Socket Layer).

  Next, the service provider server 1 receives the transaction screen input information from the user terminal 3A, and extracts information (also referred to as “transaction information Ib”) indicating the transaction content from the input information (step S111). Here, the service provider server 1 extracts, as the transaction information Ib, a character string representing each item such as a bank name, a branch name, an account number, and a transfer amount, as with the transaction information Ia.

  Next, the user terminal 3B inquires of the transaction content to the service provider server 1 based on the user's operation (step S112). On the other hand, the service provider server 1 transmits the transaction information Ib extracted in step S111 to the user terminal 3B, and the user terminal 3B acquires the transaction information Ib (step S113). Then, the user terminal 3B determines whether or not the transaction information Ia acquired from the user terminal 3A and the transaction information Ib acquired from the service provider server 1 show the same content, that is, whether or not both match. Determination is made (step S114). As a result, the service provider server 1 determines whether or not the input information on the transaction screen transmitted by the HTTP POST method has been tampered with.

  When the transaction information Ia and the transaction information Ib indicate different contents (step S114; No), the user terminal 3B may have altered the transaction screen input information received by the service provider server 1 in step S111. It is determined that there is a transaction, and a confirmation screen that prompts cancellation of the transaction is displayed (step S115). When the user operates the user terminal 3B to instruct the service provider server 1 to cancel the transaction, the service provider server 1 stops the transaction (step S116). In this way, the user can prevent fraudulent transactions.

  On the other hand, when the transaction information Ia and the transaction information Ib show the same content (step S114; Yes), the user terminal 3B has not tampered with the input information on the transaction screen received by the service provider server 1 in step S111. And a confirmation screen that prompts the execution of the transaction is displayed (step S117). When the user operates the user terminal 3B to instruct the service provider server 1 to execute a transaction, the service provider server 1 executes the transaction indicated by the transaction information Ib received in step S111 (step S118).

(If tampered with)
Next, the case where the input information on the transaction screen transmitted from the user terminal 3A to the service provider server 1 is falsified, that is, the case where there is a Man-in-the-Browser attack will be described. Specifically, the user terminal 3A is infected with a virus controlled by the attacker server 4, and the contents displayed on the web browser and the input to the transaction screen being displayed on the web browser can be stolen and altered. Shall.

  First, in step S106, the user terminal 3A generates captured image data Im, and in step S107, the captured image data Im is encrypted with a public key and transmitted to the user terminal 3B. In this case, since the user terminal 3A executes steps S106 and S107 by an agent program different from the Web browser program, the user terminal 3A generates and transmits the captured image data Im without being affected by the virus infection. Thereby, user terminal 3B acquires transaction information Ia which has not been tampered with at Step S110.

  Thereafter, in step S110, the user terminal 3A transmits the input information on the transaction screen to the service provider server 1 based on the function of the Web browser. At this time, the attacker server 4 controls the virus infected by the user terminal 3 </ b> A, thereby falsifying the input information on the transaction screen and transmits the falsified input information to the service provider server 1. Even when the user terminal 3A performs encrypted communication using SSL or the like, the attacker server 4 falsifies the input information before encryption, encrypts the input information before encryption, and then provides the service provider server 1 Send to. Therefore, the transaction screen input information transmitted by the function of the Web browser is falsified regardless of whether or not encrypted communication is performed.

  Then, in step S111, the service provider server 1 extracts the transaction information Ib from the received input information. In this case, since the input information has been tampered with by the attacker server 4, the transaction information Ib indicates an unauthorized transaction content rewritten by the attacker server 4.

  Next, in step S114, the user terminal 3B compares the transaction information Ia and the transaction information Ib, and determines that the transaction information Ia and the transaction information Ib are not the same content. Therefore, the user terminal 3B displays a confirmation screen that prompts the customer to cancel the transaction.

  As described above, even when the user terminal 3A is infected with a virus and the communication data transmitted to the service provider server 1 is falsified, the user terminal 3B captures the capture transmitted by the user terminal 3A. It is possible to detect falsification based on the image data Im and reliably prevent execution of illegal transactions.

(Display screen example)
Next, display screen examples of the user terminals 3A and 3B related to the processing of the flowchart of FIG. 4 will be described with reference to FIGS. FIG. 5 to FIG. 9 show examples in which transfer is performed by online banking.

  FIG. 5 shows a display example of a login screen displayed by the user terminal 3A using the web browser in step S101. As shown in FIG. 5, the user terminal 3A displays a login ID input field 50 for inputting a login ID, a password input field 51 for inputting a password, and a login button 52 on the login screen. is doing. When the user terminal 3 </ b> A detects that the login button 52 has been selected by a mouse click operation or the like, the login including the login ID input in the login ID input field 50 and the password input in the password input field 51. Information is transmitted to the service provider server 1.

  FIG. 6 shows a display example of the transaction screen displayed by the user terminal 3A using the web browser in step S105. FIG. 7 shows a display example of a screen (also referred to as “capture instruction screen”) displayed on the user terminal 3A by the agent program.

  On the transaction screen shown in FIG. 6, the user terminal 3 </ b> A displays the transfer destination designation fields 54 to 56 for designating the bank name, branch name, and account number of the transfer destination, and the transfer amount for designating the transfer amount. A designation field 57 and a transfer execution button 58 are displayed. In addition to the transaction screen shown in FIG. 6, the user terminal 3A displays a capture instruction screen shown in FIG. 7 for the user to instruct generation and transmission of the captured image data Im based on the agent program.

  Therefore, the user of the user terminal 3 first inputs information on the transfer destination and the transfer amount into each designation column 54 to 57 on the transaction screen, and then clicks the capture execution button 60 on the capture instruction screen shown in FIG. select. Then, the user terminal 3A detects the selection of the capture execution button 60, generates captured image data Im indicating the transaction screen in FIG. 6, encrypts it with a public key, and transmits it to the user terminal 3B.

  Next, the user of the user terminal 3A selects the transfer execution button 58 on the transaction screen shown in FIG. As a result, the user terminal 3A transmits the information input in the transfer destination designation fields 54 to 56 and the transfer amount designation field 57 to the service provider server 1 by the HTTP POST method in step S110.

  FIG. 8A shows a display example of a confirmation screen that prompts execution of the transaction displayed on the user terminal 3B in step S117. As shown in FIG. 8 (A), the user terminal 3B displays a transfer destination and transfer amount as transaction contents on a confirmation screen for prompting transaction execution, and a confirmation button 61 for final confirmation of transaction execution. And a cancel button 62 for canceling transaction execution. When the user terminal 3B detects that the confirmation button 61 has been selected, the user terminal 3B transmits information instructing transaction execution to the service provider server 1, and the service provider server 1 executes the transaction. Thereafter, the user terminal 3B receives the display information related to the transaction completion from the service provider server 1, and displays a screen indicating that the transaction is completed by the Web browser. FIG. 9 is a display example of a transfer completion screen. In the example of FIG. 9, the user terminal 3 displays the reception number assigned by the service provider server 1 for the executed transfer transaction.

  FIG. 8B shows a display example of a confirmation screen prompting to cancel the transaction displayed on the user terminal 3B in step S115. As shown in FIG. 8 (B), the user terminal 3B includes a confirmation button 61 for final confirmation of transaction execution and a cancellation button 62 for canceling transaction execution, as in FIG. 8 (A). indicate. In addition to this, the user terminal 3B displays the transaction content that may have been tampered with, that is, the transaction information Ib acquired from the service provider server 1, and displays a message 63 indicating that the transaction should be stopped. indicate. When the user terminal 3B detects that the confirmation button 62 has been selected, the user terminal 3B transmits information instructing to stop the transaction to the service provider server 1 to stop the transaction.

  Here, a supplementary description will be given of a case where a Man-in-the-Browser attack has occurred. The attacker server 4 transmits to the service provider server 1 information obtained by illegally rewriting the transfer destination and transfer amount of the transaction screen shown in FIG. 6 by controlling the virus infected by the user terminal 3A. Furthermore, since the attacker server 4 disguises that the transaction has been normally performed, the attacker server 4 generates a transaction content confirmation screen showing the transfer destination and transfer amount before falsification, and displays it on the Web browser of the user terminal 3A. Even in this case, the user terminal 3B can accurately determine the presence / absence of tampering by referring to the captured image data Im, and prevent execution of unauthorized transactions. In this way, the service provider server 1 can prevent unauthorized transactions by detecting that online transactions are subject to a Man-in-the-Browser attack.

[Second Embodiment]
In the first embodiment described above, in the process of FIG. 4, when the transaction information Ia and the transaction information Ib indicate different contents in step S114 (step S114; No), the user terminal 3B displays a confirmation screen that prompts the customer to cancel the transaction. Display (step S115), and then the user operates the user terminal 3B to instruct the service provider server 1 to cancel the transaction, and then the service provider server 1 has stopped the transaction (step S116). . Instead, in the second embodiment, when the transaction information Ia and the transaction information Ib do not match, the user terminal 3B immediately instructs the service provider server 1 to stop the transaction.

  FIG. 10 is a flowchart showing a processing procedure in the second embodiment. Specifically, as shown in FIG. 10, when the transaction information Ia and the transaction information Ib indicate different contents in step S114 (step S114; No), the user terminal 3B immediately stops the transaction to the service provider server 1. Instruct. In this case, it is preferable that the user terminal 3B displays a screen indicating that the transaction is stopped. In addition, the user end 3B may display the screen which shows the comparison result of transaction information Ia and transaction information Ib, and does not need to display it.

According to the second embodiment, when there is a possibility of falsification, the transaction is forcibly stopped, so that security can be further improved.
[Third Embodiment]
In the first and second embodiments described above, the user terminal 3A executes a transaction-related process using a Web browser and an agent program. On the other hand, in the third embodiment, processing related to transactions is executed by one program (hereinafter referred to as “integrated program” for convenience). An example of the integrated program is a program in which a Web browser function is incorporated into a program for electronic transactions such as online banking. The integrated program has a transaction content input / display function and a screen information acquisition / transmission function.

  In the third embodiment, the transaction content input / display function of the integrated program executes the same processing as the Web browser in the first and second embodiments, and the screen information acquisition / transmission function is the same as the agent program in the first and second embodiments. Execute the same process. That is, in the third embodiment, the processing executed by the user terminal 3A is the same as the processing in the first and second embodiments shown in FIG. In addition, the processes executed by the service provider server 1 and the user terminal 3B in the third embodiment are the same as those in the first and second embodiments. Thereby, also in 3rd Embodiment, the alteration of the input information by an attacker server can be detected similarly to 1st and 2nd embodiment, and an unauthorized transaction can be prevented.

[Fourth Embodiment]
In the first to third embodiments described above, the user terminal 3A transmits the captured image data Im of the transaction screen to the user terminal 3B, and the user terminal 3B displays the transaction content by character recognition from the captured image data Im. Information Ia is extracted. Instead, in the fourth embodiment, the user terminal 3A embeds text (character data) input to the transaction screen in the captured image data Im of the transaction screen and transmits it to the user terminal 3B. The user terminal 3B extracts character data embedded in the captured image data Im, and uses it as transaction information Ia indicating transaction details. Except for this point, the fourth embodiment is basically the same as the first to third embodiments.

  As described above, in the fourth embodiment, the user terminal 3A embeds and transmits the text input to the transaction screen in the captured image data Im, and the user terminal 3B extracts the text from the captured image data Im. Thus, it is not necessary to perform character recognition on the captured image data Im on the user terminal 3B side as in the first to third embodiments.

  As a technique for embedding text in captured image data, various known techniques can be applied. For example, techniques such as steganography and digital watermarking can be used. The digital watermark may be perceptible or difficult to perceive. Further, for example, as described in Japanese Patent No. 5359650, a method of embedding text information in a gap between image formats may be applied.

  As a modified example in this case, an image corresponding to the text content may be added to the captured image. For example, the text “25 yen” may be represented by an image using a rectangle and a circle as shown in FIG. 11, and this image may be drawn in the captured image.

[Modification]
Next, a modification of this embodiment will be described. The following modifications may be applied in any combination to the above-described embodiment.

(Modification 1)
In the above embodiment, communication between the user terminal 3A and the user terminal 3B is performed by short-range wireless communication such as Bluetooth. This has the significance of preventing unauthorized operation by a third party or the like by ensuring that the user terminal 3A and the user terminal 3B are in the same place and operated by the same user. From this point of view, the user terminal 3B may confirm that the user terminal A and the user terminal 3B exist in the same place instead of or in addition to using the short-range wireless communication.

  Specifically, each of the user terminals 3A and 3B has a function of detecting its own position by GPS or the like. In step S107, the user terminal 3A transmits information indicating the current position of the user terminal 3B together with the captured image data to the user terminal 3B. When the user terminal 3B determines that the transaction information Ia and the transaction information Ib are the same in step S114, the position of the user terminal 3A is further the same as the position of the user terminal 3B (actually, several tens of meters The confirmation screen for prompting the execution of the transaction is displayed only when the distance is within a predetermined distance. By doing so, the transaction can be executed only when the user terminals 3A and 3B are operated by the same user at the same place.

  For example, in order to prevent the user terminal 3A from being operated due to unauthorized access from overseas, it is detected that the two terminals are in the same area based on the global IP addresses of the user terminals 3A and 3B. Also good.

(Modification 2)
The configuration of the transaction system shown in FIG. 1 is an example, and the configuration to which the present invention can be applied is not limited to this. For example, the service provider server 1 may be composed of a plurality of servers.

  FIG. 12 shows a schematic configuration of a transaction system according to a modification. In the example of FIG. 12, the service provider server 1 includes a service provider authentication server 1A that performs user authentication in steps S102 and S103 in FIG. 4, and a service provider transaction server 1B that performs processing related to transactions after user authentication. And two servers. Then, the service provider authentication server 1A and the service provider transaction server 1B perform transmission / reception of data necessary for executing the assigned processing as necessary.

(Modification 3)
In the description of FIG. 4, the user terminal 3 </ b> A and the user terminal 3 </ b> B encrypted and transferred the captured image data Im using a public key cryptosystem. Instead, the user terminal 3A and the user terminal 3B may encrypt the captured image data Im by a common key encryption method and exchange the captured image data Im. In this case, each of the user terminal 3 and the user terminal 3B stores a common key in advance before executing the flowchart of FIG. Thus, the present invention is preferably applied even when the same (common) key is used for encryption and decryption.

(Modification 4)
In the description of FIG. 4, the user terminal 3A transmits the captured image data Im necessary for generating the transaction information Ia to the user terminal 3B in step S107. Instead of this, the user terminal 3A may encrypt the record of the input by the keyboard on the transaction screen and transmit it to the user terminal 3B instead of the captured image data Im. In this case, for example, the user terminal 3B generates transaction information Ia based on the keyboard input record character string obtained by decrypting the encrypted keyboard input record information.

DESCRIPTION OF SYMBOLS 1 ... Service provider server 2 ... Communication network 3A, 3B ... User terminal 4 ... Attacker server

Claims (9)

A transaction system comprising a server that executes a process related to a transaction, and a first terminal and a second terminal that instruct the server to execute the process related to the transaction,
The first terminal is
Display control means for displaying a transaction screen for inputting the details of the transaction;
First transmission means for transmitting input information to the transaction screen to the server;
Second transmission means for transmitting image data indicating the transaction screen to the second terminal;
With
The server
Extracts the transaction information from the input information received from the first terminal, a third transmission means for transmitting to said second terminal,
Said second terminal, comprising: a transaction information extracted from the image data received from said first terminal, said comparing the transaction information received from the server, a fraudulent transaction detection means for displaying a comparison result And trading system. The second transmission means transmits the image data obtained by capturing the input transaction screen to the second terminal,
The fraudulent transaction detection means transaction system according to claim 1, characterized in that to extract the transaction information by performing character recognition process on the image data received from the first terminal. The second transmission means transmits image data in which input information to the transaction screen is embedded to the second terminal,
The transaction system according to claim 1, wherein the fraudulent transaction detection means extracts the transaction information from input information embedded in image data received from the first terminal . The transaction system according to any one of claims 1 to 3, wherein the second transmission unit transmits the image data to the second terminal by short-range wireless communication. The fraudulent transaction detection means performs a display recommending execution of a transaction when the transaction information extracted from the image data received from the first terminal matches the transaction information received from the server, and the first terminal The display which recommends cancellation of a transaction is performed when the transaction information extracted from the image data received from the transaction information received from the server does not match. 5. Trading system. The first terminal further includes position information transmitting means for transmitting information indicating the position of the first terminal to the second terminal,
6. The fraudulent transaction detection means performs display for recommending execution of the transaction only when the position of the first terminal is within a predetermined range from the position of the second terminal. The transaction system described. A transaction method executed by a transaction system comprising a server that executes a process related to a transaction, and a first terminal and a second terminal that instruct the server to execute the process related to the transaction,
A display step of displaying a transaction screen for inputting the details of the transaction by the first terminal;
A first transmission step of transmitting input information to the transaction screen to the server by the first terminal;
A second transmission step of transmitting image data indicating the transaction screen to the second terminal by the first terminal;
By the server, and a third transmission step of extracting transaction information from said input information received from the first terminal in the first transmission step, transmitting to said second terminal,
By the second terminal, and transaction information extracted from the image data received from said first terminal, said comparing the transaction information received from the server, and fraudulent transactions detection step of displaying a comparison result,
A transaction method characterized by comprising: A transaction system comprising a server that executes a process related to a transaction, and a first terminal and a second terminal that instruct the server to execute the process related to the transaction,
The first terminal is
Display control means for displaying a transaction screen for inputting the details of the transaction;
First transmission means for transmitting input information to the transaction screen to the server;
Second transmission means for transmitting image data indicating the transaction screen to the second terminal;
With
The server
Extracts the transaction information from the input information received from the first terminal, a third transmission means for transmitting to said second terminal,
It said second terminal, and transaction information extracted from the image data received from said first terminal, said comparing the transaction information received from the server, and extracted from the image data received from said first terminal transaction system and transaction information received from the the transaction information server when there is no match, an instruction to cancel the transaction and transmits to the server. A transaction method executed by a transaction system comprising a server that executes a process related to a transaction, and a first terminal and a second terminal that instruct the server to execute the process related to the transaction,
A display step of displaying a transaction screen for inputting the details of the transaction by the first terminal;
A first transmission step of transmitting input information to the transaction screen to the server by the first terminal;
A second transmission step of transmitting image data indicating the transaction screen to the second terminal by the first terminal;
By the server, and a third transmission step of extracting transaction information from said input information received from the first terminal in the first transmission step, transmitting to said second terminal,
By the second terminal, and transaction information extracted from the image data received from said first terminal, said comparing the transaction information received from the server, and extracted from the image data received from said first terminal if the transaction information received from the the transaction information server does not match, the transaction abort process of transmitting an instruction to cancel the transaction to the server,
A transaction method characterized by comprising: