JP7368150B2 - Program, information processing device and information processing method - Google Patents

Description

The present disclosure relates to a program, an information processing device, and an information processing method.

In recent years, credit cards have been widely used when purchasing products or services at stores or EC (Electronic Commerce) sites. When using a credit card for purchase on an EC site, for example, a user transmits card information such as a card number and expiration date to the EC site via an input screen on the EC site. Then, the e-commerce site sends the card information to the card company's authentication device, inquires whether the use of the credit card is permitted, and if permission to use the credit card is received from the authentication device, payment using this credit card becomes possible. . Therefore, since it is possible to make a payment using only the card information of the credit card, there is a possibility that the credit card may be used illegally if the card information is leaked.

In Patent Document 1, recognition data such as a user's fingerprint, voice, retinal pattern, facial features, and DNA pattern are registered in the memory of the card body, and when the user uses the card, the user registers his or her recognition data. A technology has been proposed in which the card can be used when the input recognition data matches the registered recognition data. In the technology disclosed in Patent Document 1, the user's recognition data is input before the card is used, and if the input recognition data does not match the registered recognition data, the card is not allowed to be used. Cards can be prevented from being used fraudulently.

Japanese Patent Application Publication No. 2003-67687

In the technique disclosed in Patent Document 1, it is necessary to provide the card body with an input section for inputting the user's recognition data (body pattern information), and there is a problem that the card has a complicated configuration. In addition, with the technology disclosed in Patent Document 1, when the card is inserted into an external device such as an ATM machine and used, it is possible to prevent use by anyone other than the authorized user (card owner). The problem is that it is difficult to prevent unauthorized use of credit cards.

The present disclosure has been made in view of such circumstances, and its purpose is to provide a program etc. that can prevent unauthorized use of credit cards without complicating the structure of the card. There is a particular thing.

A program according to the present disclosure acquires card information regarding a credit card, acquires an invisible light image taken by irradiating the invisible light on a credit card whose information can be acquired by irradiating the invisible light, and acquires the card information. and a process of requesting permission to use the credit card from a predetermined device based on the invisible light image, the process being when an instruction to obtain permission to use the credit card is obtained from a website that accepts a purchase application for a product. , causing a computer to execute a process of requesting a predetermined device permission to use the credit card on the website based on the card information, the invisible light image, and site information regarding the website.

In the present disclosure, when using a credit card, it is determined whether or not to use the credit card using not only card information but also an invisible light image taken by irradiating the credit card with invisible light. Therefore, it is only necessary to configure the credit card so that information can be obtained by irradiating it with invisible light, and the configuration of the credit card does not become complicated. It is possible to prevent unauthorized use of credit cards.

1 is a schematic diagram showing a configuration example of an information processing system. It is a schematic diagram showing an example of the appearance of a credit card. It is a block diagram showing a configuration example of a card company server and an EC site server. It is a schematic diagram showing the example of composition of DB memorized by the card company server and the EC site server. FIG. 2 is a block diagram showing a configuration example of a user terminal. It is a flowchart which shows an example of a credit card authentication processing procedure. It is a flowchart which shows an example of a credit card authentication processing procedure. It is a schematic diagram which shows the example of a screen in a user terminal. 7 is a flowchart illustrating an example of a credit card authentication processing procedure in Embodiment 2. FIG. FIG. 7 is a schematic diagram showing a configuration example of a customer information DB according to a third embodiment. It is a flowchart which shows an example of the user registration processing procedure by the server for EC sites. It is a flowchart showing an example of a user registration processing procedure by an EC site server. It is a schematic diagram which shows the example of a screen in a user terminal. It is a flowchart showing an example of a payment processing procedure at an EC site. FIG. 3 is a schematic diagram showing a configuration example of an information processing system according to a fourth embodiment. It is a block diagram showing an example of a structure of a card company server and a credit card processing terminal. 2 is a flowchart illustrating an example of a credit card authentication processing procedure. It is a flowchart showing an example of a payment processing procedure using a credit card. FIG. 2 is a schematic diagram showing an example of the appearance of a card authentication device. FIG. 2 is a schematic diagram showing a configuration example of a card authentication device. FIG. 12 is a schematic diagram showing a configuration example of a subscriber information DB stored in a card company server according to a fifth embodiment. 12 is a flowchart illustrating an example of a credit card authentication processing procedure in Embodiment 5.

Below, a program, an information processing device, and an information processing method of the present disclosure will be described in detail based on drawings showing embodiments thereof. In each of the embodiments below, a system for determining whether or not a credit card having a code, design, pattern, etc. printed on its outer surface using ultraviolet light-emitting paint will be described as an example. However, the present disclosure is not limited to such a configuration, and can be applied to a system that determines whether or not to use a credit card that can acquire information by irradiating invisible light. For example, the present invention can be applied to a system for determining whether to use a credit card whose information can be obtained by irradiating infrared rays or X-rays.

(Embodiment 1)
FIG. 1 is a schematic diagram showing an example of the configuration of an information processing system. The information processing system of this embodiment includes a card company server 10 managed by a credit card company, an EC site server 20 that operates an EC site (website), a user terminal 30 of a user who uses the EC site, and the like. The card company server 10, the EC site server 20, and the user terminal 30 are configured to be connectable to a network N such as the Internet. The card company server 10 and the EC site server 20 are each an information processing device capable of various information processing and transmission/reception of information, and are, for example, a server computer or a personal computer. One card company server 10 may be provided for each card company, or a plurality of card company servers 10 may be provided for each card company. One EC site server 20 may be provided for each EC site, or a plurality of EC site servers 20 may be provided for each EC site. Further, the card company server 10 and the EC site server 20 may each be realized by a plurality of virtual machines provided in one server device, or may be realized using a cloud server. The user terminal 30 is an information processing device capable of various information processing and transmission/reception of information, and is, for example, a smartphone, a tablet terminal, a personal computer, or the like.

FIG. 2 is a schematic diagram showing an example of the appearance of a credit card. In the information processing system of this embodiment, a credit card 40 as shown in FIG. 2 is used for credit card payment at an EC site that accepts purchase applications for products or services. The upper side of FIG. 2 shows the front side of the credit card 40, and the lower side shows the back side of the credit card 40. The credit card 40 shown in FIG. 2 has a credit card name (ABC CARD) printed on its surface, and an IC (Integrated Circuit) chip 44 that stores information regarding the credit card 40 and information regarding the user (contractor). It has been incorporated. The credit card name is the name given to the credit card 40 issued by the card company, and various information is stored in the IC chip 44 by the card company when the credit card 40 is issued. Further, on the surface of the credit card 40, a card number 41, an expiration date 42, and a subscriber's name 43 are printed. The card number 41 is identification information assigned to the credit card 40, the expiration date 42 is the expiry date set for the credit card 40, and the contractor's name 43 is the contractor or authority to use the credit card 40. The name of the user with The name 43 is written, for example, in Roman letters, and is printed, for example, by embossing. Furthermore, in the credit card 40 of this embodiment, a predetermined object is printed at a predetermined location (multiple areas) using ultraviolet luminescent paint. For the object, a code, a pattern, a pattern, etc., which is a combination of alphabets and numbers, can be used, for example. In the example shown in FIG. 2, an object 45a with a predetermined pattern is printed on one place on the front side of the credit card 40, and an object 45b with a predetermined pattern and an object 45c with a predetermined code are printed on two places on the back side. . The number, printing positions, and types of objects printed on the credit card 40 are not limited to the example shown in FIG. Can be created. To prevent unauthorized use of the card by authenticating the holder of such a credit card 40 based on credit card information and UV image information and allowing use of the credit card. I can do it.

In the information processing system of this embodiment, a user accesses the EC site server 20 using the user terminal 30 and requests the purchase of a product or service sold on the EC site. If the user specifies credit card payment at that time, the user inputs information on the credit card 40 (card information) using the user terminal 30, and the user terminal 30 sends the acquired card information to the card company server 10. Then, an inquiry is made as to whether or not this credit card 40 is allowed to be used. The card company server 10 determines whether or not the credit card 40 is allowed to be used in response to an inquiry from the user terminal 30, and transmits the determination result to the user terminal 30. At this time, if the determination result is permission to use the credit card 40, the card company server 10 issues permission information indicating permission to use the credit card 40, and together with the determination result, the card company server 10 issues permission information to the user terminal 30 (the device that sent the inquiry). ). Then, the user terminal 30 transmits the permission information received from the card company server 10 to the EC site server 20. When the EC site server 20 receives permission information from the user terminal 30, it inquires of the card company server 10 whether the received permission information is the permission information issued to this user (credit card 40), and The inquiry result is acquired from the company server 10. Note that if the permission information received from the EC site server 20 matches appropriately issued permission information, the card company server 10 transmits an inquiry result indicating that the permission information is appropriate (authentication was successful). If they do not match, send an inquiry result indicating that it is not appropriate (cannot be authenticated). If the inquiry result obtained from the card company server 10 indicates that authentication is possible, the EC site server 20 determines that the use of this credit card 40 is permitted, and completes the payment procedure and product purchase using the credit card 40. Carry out delivery procedures, etc.

FIG. 3 is a block diagram showing a configuration example of the card company server 10 and the EC site server 20. The card company server 10 includes a control section 11, a storage section 12, a communication section 13, an input section 14, a display section 15, a reading section 16, etc., and these sections are interconnected via a bus. The control unit 11 includes one or more processors such as a CPU (Central Processing Unit), an MPU (Micro-Processing Unit), or a GPU (Graphics Processing Unit). The control unit 11 executes various information processing, control processing, etc. that should be performed by the card company server 10 by appropriately executing the control program 12P stored in the storage unit 12.

The storage unit 12 includes a RAM (Random Access Memory), a flash memory, a hard disk, an SSD (Solid State Drive), and the like. The storage unit 12 stores in advance a control program 12P executed by the control unit 11 and various data necessary for executing the control program 12P. The storage unit 12 also temporarily stores data and the like generated when the control unit 11 executes the control program 12P. The storage unit 12 also stores a subscriber information DB 12a (database) and an EC site DB 12b, which will be described later. The contractor information DB 12a and the EC site DB 12b may be stored in an external storage device connected to the card company server 10, or may be stored in an external storage device with which the card company server 10 can communicate.

The communication unit 13 is an interface for connecting to the network N by wired communication or wireless communication, and transmits and receives information to and from an external device via the network N. The input unit 14 receives an operation input by an administrator who manages the card company server 10, and sends a control signal corresponding to the operation content to the control unit 11. The display section 15 is a liquid crystal display, an organic EL display, or the like, and displays various information according to instructions from the control section 11. The input section 14 and the display section 15 may be a touch panel configured as one unit.

The reading unit 16 reads information stored in a portable storage medium 1a including a CD (Compact Disc)-ROM, a DVD (Digital Versatile Disc)-ROM, a USB (Universal Serial Bus) memory, and the like. The control program 12P and various data stored in the storage unit 12 may be read by the control unit 11 from the portable storage medium 1a via the reading unit 16 and stored in the storage unit 12. Further, the control program 12P and various data stored in the storage unit 12 may be downloaded by the control unit 11 from an external device via the communication unit 13 and stored in the storage unit 12.

The EC site server 20 includes a control section 21, a storage section 22, a communication section 23, an input section 24, a display section 25, etc., and these sections are interconnected via a bus. These units 21 to 25 have the same configuration as each unit 11 to 15 of the card company server 10, so a detailed explanation will be omitted. The storage unit 22 of the EC site server 20 stores a customer information DB 22a, which will be described later, in addition to the control program 22P executed by the control unit 21. The customer information DB 22a may be stored in an external storage device connected to the EC site server 20, or may be stored in an external storage device with which the EC site server 20 can communicate. Further, the EC site server 20 may include a reading section similarly to the card company server 10.

FIG. 4 is a schematic diagram showing a configuration example of the DBs 12a to 12b and 22a stored in the card company server 10 and the EC site server 20. FIG. 4A shows the subscriber information DB 12a, FIG. 4B shows the EC site DB 12b, and FIG. 4C shows the customer information DB 22a. The contractor information DB 12a stores information regarding users (contractors) who have been issued credit cards 40 by credit card companies. The contractor information DB 12a shown in FIG. 4A includes a contractor ID column, a name column, a credit card information column, a UV image information column, an EC site information column, etc. It stores information, UV image information, EC site information, etc. The contractor ID column stores identification information assigned to each user (contractor) who has been issued the credit card 40, and the name column stores the name of the contractor of the credit card 40 or the user who is authorized to use it. do. The credit card information column stores information such as a card number, which is identification information assigned to each credit card 40, an expiration date set for the credit card 40, and the name of the subscriber printed on the credit card 40. The UV image information string stores information about objects printed on the credit card 40 using ultraviolet light emitting paint. The object information stored in the UV image information string may be the UV images of the front and back sides of the credit card 40, or the printing position and type (object image) of the objects printed on the front and back sides, respectively. You can. Note that the UV image is an image taken while being irradiated with ultraviolet rays. The EC site information column stores information on EC sites where the subscriber has used the credit card 40 (credit card payment). The EC site information is, for example, the URL (Uniform Resource Locator) of the EC site. The contractor ID stored in the contractor information DB 12a is issued and stored by the control unit 11 when new contractor information is registered. The name, credit card information, and UV image information stored in the subscriber information DB 12a are stored by the control unit 11 and controlled by the control unit 11 each time the control unit 11 acquires each piece of information regarding a new subscriber via the input unit 14, for example. Each time the unit 11 obtains an instruction to change each piece of information, the information is changed by the control unit 11. The EC site information stored in the subscriber information DB 12a is stored in the EC site information when the control unit 11 receives an inquiry from the EC site server 20 via the communication unit 13, for example, regarding the permission or disapproval of each subscriber's credit card 40. 11. The storage contents of the subscriber information DB 12a are not limited to the example shown in FIG. 4A, and various information regarding the subscriber and credit card can be stored.

The EC site DB 12b stores information regarding EC sites that have a contract with a card company so that the credit card 40 issued by the card company can be used (credit card payment). The EC site DB 12b shown in FIG. 4B includes a site ID column, a site name column, a site information column, etc., and stores the site name, site information, etc. of the EC site in association with the site ID. The site ID column stores identification information assigned to each EC site that has a contract with the card company of the card company server 10. The site name column stores the name given to the EC site, and the site information column stores, for example, the URL of the EC site. The site ID stored in the EC site DB 12b is issued and stored by the control unit 11 when information about a new EC site is registered. The site name and site information stored in the EC site DB 12b are stored by the control unit 11 each time the control unit 11 acquires each piece of information on a new EC site via the input unit 14 or the communication unit 13, for example. 11 obtains an instruction to change each piece of information, the information is changed by the control unit 11. The storage contents of the EC site DB 12b are not limited to the example shown in FIG. 4B, and various types of information regarding the EC site can be stored. For example, information regarding the operator of the EC site may be stored.

The customer information DB 22a stores information regarding users (customers) who have registered on the EC site (EC site server 20). The customer information DB 22a shown in FIG. 4C includes a customer ID column, a name column, an age column, a gender column, an address column, a purchase history column, etc. Memorize history, etc. The customer ID column stores identification information assigned to each customer who has registered as a user on the EC site, and the name column, age column, gender column, and address column store the customer's name, age, gender, and address, respectively. The purchase history column stores information regarding products or services purchased by the customer on the EC site operated by the EC site server 20, the purchase date and time, and the like. The customer ID stored in the customer information DB 22a is issued and stored by the control unit 21 when new customer information is registered. The name, age, gender, and address stored in the customer information DB 22a are stored by the control unit 21 each time the control unit 21 acquires each piece of information regarding a new customer via the communication unit 23, for example. The information is changed by the control unit 21 each time an information change instruction is obtained. The purchase history stored in the customer information DB 22a is when the EC site server 20 completes processing (for example, payment processing) related to the purchase of products or services via the EC site in response to a purchase request from the user terminal 30. is stored by the control unit 11. The storage contents of the customer information DB 22a are not limited to the example shown in FIG. 4C, and various types of information regarding the customer and the customer's purchase history can be stored.

FIG. 5 is a block diagram showing an example of the configuration of the user terminal 30. As shown in FIG. The user terminal 30 includes a control section 31, a storage section 32, a communication section 33, an input section 34, a display section 35, a camera 36, a visible light light 37, an ultraviolet (UV) light 38, a reading section 39, etc., and each of these sections are interconnected via a bus. In the user terminal 30, each of the sections 31 to 35, 39 of the above-mentioned sections 31 to 39 has the same configuration as each section 11 to 16 of the card company server 10, so a detailed explanation will be omitted. In addition to the control program 32P executed by the control unit 31, the storage unit 32 of the user terminal 30 includes an authentication application program (authentication application program) for the user terminal 30 to inquire of the card company server 10 whether or not the credit card 40 is allowed to be used. App) 32 APs are memorized.

The camera 36 (acquisition unit) is an imaging unit (photographing unit) having a lens, an image sensor, etc., and acquires image data of a subject image through the lens. The camera 36 performs photography according to instructions from the control unit 31 and sequentially sends the acquired image data (photographed images) to the control unit 31. The visible light light 37 includes, for example, an LED (Light Emitting Diode), and emits visible light according to instructions from the control unit 31. The UV light 38 (irradiation section) is a black light that irradiates ultraviolet rays, and irradiates ultraviolet rays according to instructions from the control section 31. When acquiring a visible light image, the control unit 31 acquires a captured image with the camera 36 while the visible light light 37 irradiates the subject with visible light. Further, when acquiring a UV image (ultraviolet image), the control unit 31 acquires a photographed image with the camera 36 while the UV light 38 is irradiating ultraviolet rays. Note that if the usage environment of the user terminal 30 is sufficiently bright, the visible light light 37 may not be provided in the user terminal 30, and even if the visible light light 37 is provided, the visible light light 37 may not be provided. A captured image (visible light image) may be acquired by the camera 36 without irradiating visible light. Any or all of the camera 36, the visible light light 37, and the UV light 38 may be built into the user terminal 30, or may be externally attached to the user terminal 30 via a cable or the like. Further, the UV light 38 may be configured by attaching a filter that transmits ultraviolet rays to the light irradiation portion of a light provided on a smartphone, tablet terminal, or the like.

Below, in the information processing system of this embodiment, a process performed by each device when a user uses the user terminal 30 to shop at an EC site will be described. 6 and 7 are flowcharts showing an example of an authentication processing procedure for the credit card 40, and FIG. 8 is a schematic diagram showing an example of a screen on the user terminal 30. In FIGS. 6 and 7, the left side shows the process performed by the card company server 10, the center shows the process performed by the user terminal 30, and the right side shows the process performed by the EC site server 20. The following processes are executed by the control unit 11 according to the control program 12P stored in the storage unit 12 of the card company server 10, and are executed by the control unit 31 according to the control program 32P stored in the storage unit 32 of the user terminal 30. The process is executed by the control unit 21 according to the control program 22P stored in the storage unit 22 of the EC site server 20. Note that a part of the following processing may be realized by a dedicated hardware circuit.

In the information processing system of this embodiment, the user of the user terminal 30 uses the user terminal 30 to access the EC site (EC site server 20) and shop at the EC site. The user terminal 30 accesses the EC site designated by the user via the input unit 34 (S11). The EC site server 20 transmits the web page according to the request from the user terminal 30 to the user terminal 30 (S12), and the user terminal 30 receives the web page from the EC site server 20, and the received web page. is displayed on the display unit 35 (S13). This allows the user of the user terminal 30 to view information about products or services sold on the EC site.

When the user of the user terminal 30 finds a product or service that he or she wishes to purchase, he/she performs the purchasing procedure, and at that time selects one of credit card payment, cash on delivery payment, convenience store payment, etc. as the payment method for the fee. The user terminal 30 determines whether or not it has received an instruction to make a credit card payment from the user via the input unit 34 (S14), and if it determines that it has not received an instruction to make a payment (S14: NO), The process returns to step S11. Note that when receiving an instruction to make a payment using a method other than credit card payment, the user terminal 30 requests the EC site server 20 to perform a payment procedure (purchase procedure) using the specified payment method. Omitted.

If it is determined that the instruction to perform credit card payment has been received (S14: YES), the user terminal 30 requests the EC site server 20 to perform a payment procedure (purchase procedure) by credit card payment (S15). When the EC site server 20 receives a request for a credit card payment procedure, it requests the user terminal 30 to execute the credit card 40 authentication process by the card company server 10 (S16). Specifically, the EC site server 20 transmits an authentication request screen as shown in FIG. 8A to the user terminal 30, and the user terminal 30 receives the authentication request screen sent by the EC site server 20. The authentication request screen is displayed on the display unit 35. The authentication request screen shown in FIG. 8A displays a message requesting authentication of the credit card 40. The authentication request screen also includes an input field for inputting permission information obtained as a result of the authentication process, and an OK button for instructing transmission of the input permission information to the EC site server 20. Note that the permission information is information that is issued and transmitted to the user terminal 30 when the card company server 10 determines that the credit card 40 is permitted (usable).

After confirming the authentication request screen, the user starts the authentication application 32AP using the user terminal 30 and requests the card company server 10 to authenticate the credit card 40. Note that the user terminal 30 may be configured to automatically launch the authentication application 32AP when receiving a credit card authentication request from the EC site server 20. The user terminal 30 automatically launches the authentication application 32AP when the user instructs the activation of the authentication application 32AP via the input unit 34 or when the EC site server 20 requests credit card authentication. (S17). When the user terminal 30 starts the authentication application 32AP, the user terminal 30 displays an authentication screen as shown in FIG. 8B on the display unit 35 (S18).

The authentication screen shown in FIG. 8B is a screen that accepts information about the credit card 40 that the user wishes to use for credit card payment in order to inquire of the card company server 10 whether or not the credit card 40 is allowed to be used. Specifically, the authentication screen has input fields for entering the card number, expiration date, and contracting party's name of the credit card 40. Note that instead of inputting the card number, expiration date, and name into the input fields, a captured image (visible light image) of the front surface of the credit card 40 may be input (attached). Therefore, the authentication screen includes a "credit card photography" button for acquiring a photographed image of the credit card 40. The authentication screen also includes a "UV photography" button for acquiring a UV image of the credit card 40. The authentication screen includes an authentication button for instructing an inquiry (execution of authentication) as to whether the credit card 40 is allowed to be used based on each piece of input information, and a cancel button for terminating the inquiry process.

The user terminal 30 receives the card number, expiration date, and contracting party's name (card information) of the credit card 40 (S19). Specifically, the user terminal 30 accepts the card number, expiration date, and contractor's name through the input fields on the authentication screen, or when the "credit card photo shoot" button on the authentication screen is operated. acquires a captured image (visible light image) of the front surface of the credit card 40 using the camera 36. Note that if the photographing environment is not bright enough, the user terminal 30 may acquire a photographed image of the credit card 40 with the camera 36 while the visible light light 37 is irradiating visible light. Further, the user terminal 30 uses the UV light 38 and the camera 36 to obtain a UV image (ultraviolet image) of the area (photographing area) of the credit card 40 specified on the authentication screen (S20). Specifically, when the "UV photography" button on the authentication screen is operated, the user terminal 30 photographs a predetermined area of the credit card 40 with the camera 36 while irradiating ultraviolet light with the UV light 38. . The user terminal 30 determines whether or not authentication of the credit card 40 has been instructed, depending on whether or not the authentication button on the authentication screen has been operated via the input unit 34 (S21). If it is determined that authentication has not been instructed (S21: NO), the user terminal 30 returns to the process of step S19.

If it is determined that authentication of the credit card 40 has been instructed (S21: YES), the user terminal 30 transmits the card information and UV image acquired via the authentication screen from the communication unit 33 (transmission unit) to the card company server 10 ( (predetermined device) (S22). Thereby, the user terminal 30 inquires of the card company server 10 as to whether or not the credit card 40 is allowed to be used, and requests permission to use the credit card 40 . Note that when a photographed image (visible light image) of the credit card 40 is acquired as the card information of the credit card 40, the user terminal 30 performs image recognition processing on the photographed image, and collects the card number, expiration date, and subscriber's name. The extracted card number, expiration date, and name of the contractor may be transmitted to the card company server 10 as card information. Further, the destination information of the card company server 10 as the destination is set, for example, in the authentication application 32AP.

The card company server 10 receives the card information and the UV image transmitted by the user terminal 30 in the communication unit 13 (acquisition unit), and when the card information and the UV image are received, the control unit 11 (determination unit) Based on the received information, authentication processing is performed to determine whether use of this credit card 40 is permitted (S23). Specifically, the card company server 10 compares the received card information and UV image with the stored contents of the subscriber information DB 12a, and if the received card information and UV image are stored in the subscriber information DB 12a, It is determined that the use of this credit card 40 is permitted (authentication has been successful). On the other hand, if the received card information or UV image is not stored in the subscriber information DB 12a, the card company server 10 determines that this credit card 40 cannot be used (cannot be authenticated). Note that when a photographed image (visible light image) of the credit card 40 is received from the user terminal 30 as the card information of the credit card 40, the card company server 10 performs image recognition processing on the received photographed image. , the card number, expiration date, and contracting party's name may be extracted, and authentication may be performed based on the extracted card number, expiration date, and contracting party's name.

The card company server 10 determines whether or not the authentication was successful (S24), and if it is determined that the authentication is not possible (S24: NO), it notifies the user terminal 30 that the authentication is not possible (the credit card 40 cannot be used) (S25). ). When the user terminal 30 is notified from the card company server 10 that the authentication is not possible, the user terminal 30 displays the message that the authentication is not possible (for example, a message indicating that the authentication is not possible) on the display unit 35 (S26), returns to the process of step S18, and returns to the process shown in FIG. The authentication screen shown in 8B is displayed again. If the user of the user terminal 30 confirms that authentication is not possible, the user of the user terminal 30 inputs the information of a different credit card 40 (card information and UV image) on the authentication screen again, and informs the card company server 10 whether or not the credit card 40 is allowed to be used. Please inquire again.

If the card company server 10 determines that the authentication was successful (S24: YES), it issues permission information indicating permission to use the credit card 40 (S27), and provides the authentication result indicating that the authentication was successful and the issued permission information. and is transmitted to the user terminal 30 (S28). Note that the card company server 10 stores the issued permission information in association with the credit card 40 information or the user (contractor) information. When the user terminal 30 receives the authentication result and permission information from the card company server 10, it displays the authentication result and permission information on the display unit 35 (S29) and notifies the user. When the user of the user terminal 30 is notified of permission to use the credit card 40 (authentication is possible), the user of the user terminal 30 enters the permission information notified along with the permission to use in the input field on the screen shown in FIG. 8A displayed on the display unit 35. Enter the information using the input unit 34 and operate the OK button. The user terminal 30 determines whether permission information has been accepted via the input field on the authentication result input screen (S30), and if it is determined that the permission information has not been accepted (S30: NO), it waits until it is accepted.

When the user terminal 30 determines that the permission information has been received (S30: YES), the user terminal 30 transmits the received permission information to the EC site server 20 (S31). When the EC site server 20 receives permission information from the user terminal 30, it transmits the received permission information to the card company server 10 (S32), and checks whether the permission information is appropriate or not. Contact 10. Note that the EC site server 20 transmits the permission information to the card company server 10 together with the contractor's (user) information or the credit card 40 information. When the card company server 10 receives the permission information and the credit card 40 information or the contractor (user) information from the EC site server 20, the card company server 10 stores the credit card 40 information or the contractor (user) information. The permission information stored in correspondence is read from the storage unit 12, and it is determined whether the read permission information matches the permission information received from the EC site server 20 (S33). If it is determined that they do not match (S33: NO), the card company server 10 informs the EC site server 20 that the permission information sent from the EC site server 20 is not appropriate information and cannot be authenticated (authentication is not possible). Notify (S34). When the EC site server 20 is notified that authentication is not possible from the card company server 10, it notifies the user terminal 30 that authentication is not possible (S35), and the user terminal 30 receives the notification that authentication is not possible from the EC site server 20. (For example, a message indicating that authentication is not possible) is displayed on the display unit 35 (S36). Note that when the EC site server 20 is notified that authentication is not possible from the card company server 10, the EC site server 20 may send an input screen requesting input of permission information to the user terminal 30 again. The authentication request screen may be sent to the user terminal 30 again.

If the card company server 10 determines that the permission information read from the storage unit 12 and the permission information received from the EC site server 20 match (S33: YES), the credit card 40 can be authenticated (credit card permission to use the card 40) is notified to the EC site server 20 (S37). When the EC site server 20 is notified by the card company server 10 that the authentication has been successful, the EC site server 20 performs the payment procedure requested by the user terminal 30 in step S15, and displays a payment completion screen notifying that the payment has been completed. is transmitted to the user terminal 30 (S38). The user terminal 30 receives the payment completion screen transmitted by the EC site server 20, displays the received payment completion screen on the display unit 35 (S39), and ends the process.

Through the above-described processing, when using the credit card 40 for shopping on an EC site, it is not only verified (authenticated) based on the card number, expiry date, and subscriber's name, but also verified based on the UV image of a predetermined area of the credit card 40. (authentication) to determine whether or not the credit card 40 is allowed to be used. Therefore, in this embodiment, use of the credit card 40 can be restricted to only users who have the credit card 40 in hand, and unauthorized use of the credit card 40 on the EC site can be prevented. Note that objects can be printed on appropriate locations on the outer surface of the credit card 40 using ultraviolet luminescent paint, and the printing position and type of objects printed on each credit card 40 can be managed by the card company server 10. The configuration of the card 40 is not complicated, and the card company server 10 only needs to perform verification based on UV images in addition to verification based on card information, so the processing related to authentication does not increase.

In the information processing system of this embodiment, card information (card number, expiration date, contractee name, etc.) input at the user terminal 30 is sent to the card company server 10 and subjected to authentication processing by the card company server 10. used. That is, in this embodiment, card information does not need to be sent from the user terminal 30 to the EC site server 20, and information that can identify the user (purchaser of a product or service) is sent to the EC site server 20. Bye. Therefore, since the card information of the credit card 40 is not transmitted to the EC site server 20, leakage of card information (personal information) from the EC site server 20 can be prevented. Furthermore, since the card information is not sent to the EC site server 20, it is possible to avoid loss of purchase opportunities caused by buyers who are reluctant to have their card information sent to the EC site server 20.

In this embodiment, the card company server 10 associates the credit card information and UV image information of the user (contractor) with the credit card information and UV image information of the user (contractor) as the usage history of the credit card 40 in the contractor information DB 12a (history storage unit). Information on EC sites (EC site information, store information) where the card 40 has been used is stored. Therefore, in the present embodiment, when there is an authentication request from the user terminal 30 based on card information (for example, card number) for using the credit card 40 at a certain EC site, the card company server 10 accepts the credit card 40 from the user terminal 30. Determine whether or not the card 40 will be used for the first time on this EC site, and if used for the first time, request the card information (card number, expiration date, contractee name, etc.) and UV image of the credit card 40 from the user terminal 30. It is also possible to have a configuration in which Specifically, when the user terminal 30 starts the authentication application 32AP, the user terminal 30 displays an authentication screen in which only the card number of the credit card 40 is input, for example, and displays the card number input via the authentication screen and the credit card 40. The user sends information on the EC site that the user wishes to use to the card company server 10 and inquires whether credit card usage is permitted (authentication). The control unit 11 (determination unit) of the card company server 10 determines whether or not the credit card 40 with the received card number is being used for the first time on this EC site in response to an inquiry from the user terminal 30. . When it is determined that this is the first time a credit card is being used on an EC site, the control unit 11 (request unit) of the card company server 10 collects the card information of the credit card 40 (in addition to the card number, the expiration date and the name of the subscriber). etc.) and the UV image from the user terminal 30. Then, the card company server 10 acquires card information and a UV image from the user terminal 30, and performs permission/denial for credit card use (authentication) based on the acquired card information and UV image. In such a configuration, when purchasing a product for the first time on each EC site, authentication is performed based on the UV image of the credit card 40, and from the next time onwards, the credit card 40 is authenticated only based on the card information of the credit card 40. It is convenient because it can be used.

The credit card 40 in this embodiment described above was a credit card with an object printed on its outer surface using ultraviolet light emitting paint. However, in the system of the present disclosure, a credit card configured to be able to acquire information by irradiating it with invisible light can be used. For example, the outer surface or internal structure of a credit card may be configured so that a predetermined shape (object) is included in an X-ray image taken by irradiating X-rays. In this case, it is possible to determine whether or not the credit card is allowed to be used based on an object extracted from an X-ray image taken by irradiating the credit card with X-rays. Further, a credit card may be configured so that a predetermined shape (object) is included in an infrared image taken by irradiating infrared rays. For example, a credit card may be used on which an object is printed using paint whose temperature changes when irradiated with infrared rays. In this case, it is possible to determine whether or not the credit card is allowed to be used based on an object extracted from an infrared image taken by irradiating the credit card with infrared rays.

(Embodiment 2)
When the card company server 10 receives credit card information (card information and UV image) from the user terminal 30 for credit card authentication, the credit card is printed with ultraviolet luminescent paint based on the received UV image. An information processing system having a configuration for recognizing (extracting) objects that have been previously used will be described. The information processing system of this embodiment can be realized by the same device as the information processing system of Embodiment 1, so a description of the configuration will be omitted.

FIG. 9 is a flowchart illustrating an example of an authentication processing procedure for the credit card 40 in the second embodiment. The process shown in FIG. 9 is the process shown in FIGS. 6 and 7 in which step S41 is added before step S23. Description of the same steps as in FIGS. 6 and 7 will be omitted. Further, in FIG. 9, illustrations of steps S11 to S14 in FIG. 6 and each step in FIG. 7 are omitted.

In the information processing system of this embodiment, when the card company server 10 receives the card information and UV image transmitted by the user terminal 30 in step S22, the control unit 11 (recognition unit) performs the following from the received UV image: Recognize (extract) objects printed with ultraviolet luminescent paint on the subject's credit card. For example, an image (template) of an object to be printed on the credit card 40 is stored in the storage unit 12 in association with the object type or object ID, and objects existing in the UV image are searched for by template matching technology, for example. do. When the card company server 10 is able to search for an object in the UV image, it specifies the type or object ID of the searched object. Then, the card company server 10 performs an authentication process to determine whether or not the credit card 40 is allowed to be used based on the card information received from the user terminal 30 and the specified object type (or object ID) (S23 ). Here, the card company server 10 compares the received card information and the specified object type (object ID) with the stored contents of the contractor information DB 12a, and if the card information is stored in the contractor information DB 12a, the credit card It is determined that the use of 40 is permitted (authentication was successful). In this embodiment, the UV image information stored in the subscriber information DB 12a can be the print position and type (object ID) of objects printed on the front and back sides of the credit card 40, respectively. After that, the card company server 10 performs the processing from step S24 onwards.

Through the processing described above, the same effects as in the first embodiment can be obtained in this embodiment as well. Further, in this embodiment, the card company server 10 identifies the types (object IDs) of the objects 45a to 45c printed on the subject's credit card 40 from the UV image taken using the user terminal 30, and It is determined (authenticated) whether or not the credit card 40 is allowed to be used based on the type of object (object ID). Therefore, the storage unit 12 of the card company server 10 only needs to store the printing positions and types (object IDs) of the objects 45a to 45c printed on the credit card 40 as information for collating UV images. , the amount of UV image information stored in the storage unit 12 (contractor information DB 12a) can be reduced.

(Embodiment 3)
An information processing system in which user information (customer information) is registered in the EC site server 20 will be described. The information processing system of this embodiment can be realized by the same device as the information processing system of Embodiment 1, so a description of the configuration will be omitted. In the information processing system of this embodiment, the configuration of the customer information DB 22a stored in the storage unit 22 of the EC site server 20 is slightly different from that of the first embodiment.

FIG. 10 is a schematic diagram showing an example of the configuration of the customer information DB 22a according to the third embodiment. The customer information DB 22a shown in FIG. 10, like the customer information DB 22a shown in FIG. 4C, includes a customer ID column, a name column, an age column, a gender column, an address column, and a purchase history column. Contains information strings, authentication propriety information strings, etc. The card company information column stores information regarding the card company that issued the customer's credit card. The card identification information string is information for identifying credit cards, and stores, for example, identification information issued by the EC site server 20 for each credit card. The authentication permission information string stores information indicating whether or not the use of the credit card 40 is permitted (authenticated or not) through authentication processing based on the card information of the credit card 40 and the UV image. If authenticated, "authenticated" is stored, and if not authenticated, "unauthenticated" is stored. The card company information stored in the customer information DB 22a is stored by the control unit 21, for example, when the control unit 21 acquires information on the card company of the credit card 40 via the communication unit 23. The card identification information stored in the customer information DB 22a is issued and stored by the control unit 21, for example, when the control unit 21 acquires information regarding a new customer via the communication unit 23. In the authentication information stored in the customer information DB 22a, "authenticated" is stored by the control unit 21 when the card company server 10 notifies that the customer's credit card 40 has been authenticated.

Below, in the information processing system of this embodiment, the process performed by each device when the user of the user terminal 30 registers his own information (customer information) in the EC site server 20 will be described. 11 and 12 are flowcharts showing an example of a user registration processing procedure by the EC site server 20, and FIG. 13 is a schematic diagram showing an example of a screen on the user terminal 30. In FIGS. 11 and 12, the left side shows the process performed by the card company server 10, the center shows the process performed by the user terminal 30, and the right side shows the process performed by the EC site server 20. Part of the following processing may be realized by a dedicated hardware circuit.

In the information processing system of this embodiment, the user terminal 30 accesses the EC site designated by the user via the input unit 34 (S51). The EC site server 20 transmits the web page according to the request from the user terminal 30 to the user terminal 30 (S52), and the user terminal 30 displays the web page received from the EC site server 20 on the display unit 35. (S53).

The EC site can simplify the purchasing procedure (payment procedure) by registering the user's customer information, so if the user of the user terminal 30 wants to register as a user on the EC site, the user can register via the web page. instruct the execution of The user terminal 30 determines whether an instruction to execute user registration has been received from the user via the input unit 34 (S54), and if it is determined that the instruction has not been received (S54: NO), the process proceeds to step S51. return.

If it is determined that the user registration execution instruction has been accepted (S54: YES), the user terminal 30 requests the EC site server 20 to perform a registration procedure (S55). When the EC site server 20 receives the request for the registration procedure, it transmits a registration screen as shown in FIG. 13A to the user terminal 30 (S56). The user terminal 30 receives the registration screen transmitted by the EC site server 20, and displays the received registration screen on the display unit 35 (S57).

The registration screen shown in FIG. 13A has input fields for inputting the name, age, gender, address, credit card company, etc. of the user of the user terminal 30 (customer of the EC site). Note that the input field for the card company may include a pull-down menu from which one of the card companies registered in advance can be selected. The registration screen also includes a registration button for instructing execution of user registration using each piece of input information, and a cancel button for terminating the user registration process. The user terminal 30 receives customer information such as the user's name, age, gender, address, and credit card company through input fields on the registration screen (S58). The user terminal 30 determines whether registration of the user's customer information has been instructed, depending on whether the registration button on the registration screen has been operated via the input unit 34 (S59). If it is determined that registration has not been instructed (S59: NO), the user terminal 30 continues the process of step S58.

If it is determined that registration of customer information has been instructed (S59: YES), the user terminal 30 transmits the customer information acquired via the registration screen to the EC site server 20 (S60). When the EC site server 20 receives the customer information transmitted by the user terminal 30, it issues a customer ID and stores the received customer information in the customer information DB 22a in association with the customer ID (S61). Then, the EC site server 20 issues card identification information corresponding to the received customer information (card company information) (S62). Note that the EC site server 20 stores the issued card identification information in the customer information DB 22a. Then, the EC site server 20 requests the user terminal 30 to perform authentication processing of the credit card 40 by the card company server 10 (S63). Here, the EC site server 20 transmits an authentication request screen as shown in FIG. 13B to the user terminal 30, and the user terminal 30 displays the authentication request screen received from the EC site server 20 on the display unit 35. . Note that when requesting the user terminal 30 to authenticate the credit card 40, the EC site server 20 transmits the card identification information issued in step S62 to the user terminal 30.

After confirming the authentication request screen, the user starts the authentication application 32AP using the user terminal 30 and requests the card company server 10 to authenticate the credit card 40, as in the first embodiment. Therefore, the user terminal 30 performs the same processing as steps S17 to S21 in FIG. 6 described in the first embodiment (S64 to S68). That is, the user terminal 30 starts the authentication application 32AP (S64) and displays an authentication screen as shown in FIG. 8B on the display unit 35 (S65). The user terminal 30 also accepts card information such as the card number, expiration date, and contracting party's name of the credit card 40 (S66), and acquires a UV image of a predetermined area (designated area) of the credit card 40 (S67). . Note that the user terminal 30 may obtain a captured image (visible light image) of the front surface of the credit card 40 using the camera 36 instead of the card information. The user terminal 30 determines whether or not authentication of the credit card 40 has been instructed, depending on whether or not the authentication button on the authentication screen has been operated via the input unit 34 (S68). If it is determined that authentication has not been instructed (S68: NO), the user terminal 30 returns to the process of step S66.

If it is determined that authentication of the credit card 40 has been instructed (S68: YES), the user terminal 30 displays the card information and UV image acquired through the authentication screen, the site information related to the EC site for which the user wants to register, and the EC site. The card identification information issued by the card company server 20 is transmitted to the card company server 10 (S69). The site information is information for identifying the EC site, and for example, destination information for accessing the EC site can be used. Further, when acquiring a photographed image (visible light image) of the credit card 40 as the card information of the credit card 40, the user terminal 30 performs image recognition processing on the photographed image, and the user terminal 30 performs image recognition processing on the photographed image, and information such as the card number, expiration date, and name of the subscriber. The extracted information may be sent to the card company server 10 as card information.

When the card company server 10 receives the card information, UV image, site information, and card identification information transmitted by the user terminal 30, the card company server 10 compares the received card information and UV image with the stored contents of the subscriber information DB 12a, and Authentication processing is performed to determine whether or not use of the credit card 40 is permitted (S70). The card company server 10 determines whether or not the authentication was successful (S71). If it is determined that the authentication is not possible (S71: NO), the card company server 10 notifies the user terminal 30 that the authentication is not possible (the credit card 40 cannot be used) (S72). ). When the user terminal 30 is notified that authentication is not possible from the card company server 10, it displays a message indicating that authentication is not possible (for example, a message indicating that authentication is not possible) (S73), returns to the process of step S65, and performs the authentication shown in FIG. 8B. Display the screen again.

If the card company server 10 determines that the authentication was successful (S71: YES), the card company server 10 adds the authentication result indicating that the authentication was successful and the card identification information received from the user terminal 30 to the site information received from the user terminal 30. Based on the information, the information is transmitted to the EC site server 20 (S74). When the EC site server 20 receives the authentication result and card identification information from the card company server 10, it stores "authenticated" in the customer information DB 22a as authentication permission information corresponding to the received card identification information (S75). . The EC site server 20 completes the registration process requested by the user terminal 30 in step 55, and transmits a registration completion screen to the user terminal 30 to notify that the registration process has been completed (S76). The user terminal 30 receives the registration completion screen transmitted by the EC site server 20, displays the received registration completion screen on the display unit 35 (S77), and ends the process.

Through the process described above, when registering the customer information of the EC site customer (user of the user terminal 30) in the EC site server 20, the card company server 10 registers the card information (card number, expiration date, and subscriber name). ) as well as a UV image of a predetermined area of the credit card 40 to determine whether or not the credit card 40 is allowed to be used. Therefore, in this embodiment, use of the credit card 40 is permitted and a usable credit card 40 can be registered only when a user who has the credit card 40 at hand registers as a user on the EC site. Note that, in this embodiment, the customer information registered in the EC site server 20 does not include card information such as the card number, expiration date, and contractor's name, and the UV image of the credit card 40. Therefore, various information on the credit card 40 can be prevented from leaking from the EC site server 20.

FIG. 14 is a flowchart showing an example of a payment processing procedure at an EC site. In FIG. 14, the left side shows the processing performed by the user terminal 30, and the right side shows the processing performed by the EC site server 20. Part of the following processing may be realized by a dedicated hardware circuit. The user terminal 30 accesses the EC site specified by the user via the input unit 34 (S81), and the EC site server 20 transmits the web page according to the request from the user terminal 30 to the user terminal 30. (S82), the user terminal 30 displays the web page received from the EC site server 20 (S83).

The user terminal 30 determines whether or not it has received an instruction to make a credit card payment from the user via the input unit 34 (S84), and if it determines that it has not received an instruction to make a payment (S84: NO), The process returns to step S81. Here, too, when receiving an instruction for payment using a payment method other than credit card payment, the user terminal 30 requests the EC site server 20 to perform payment procedures using the instructed method. If it is determined that the instruction to perform credit card payment has been received (S84: YES), the user terminal 30 requests the EC site server 20 to perform a payment procedure for credit card payment (S85). Specifically, the user terminal 30 transmits a payment procedure request including user identification information (for example, a customer ID assigned by the EC site server 20) to the EC site server 20.

When the EC site server 20 receives a request for credit card payment procedures, the EC site server 20 indicates that the user's (customer) credit card has been authenticated based on the user identification information (customer ID) received from the user terminal 30. It is determined whether or not (S86). Specifically, the EC site server 20 determines whether "authenticated" is stored in the customer information DB 22a as the authentication permission information corresponding to the customer ID received from the user terminal 30. The EC site server 20 determines that the credit card has been authenticated if "authenticated" is stored as the authentication information; if "authenticated" is not stored, the credit card is not authenticated. I judge that. If it is determined that the credit card has been authenticated (S86: YES), the EC site server 20 performs payment procedures and sends a payment completion screen to the user terminal 30 notifying that the payment has been completed (S87). . The user terminal 30 receives the payment completion screen transmitted by the EC site server 20, and displays the received payment completion screen (S88).

On the other hand, if it is determined that the credit card has not been authenticated (S86: NO), the EC site server 20 performs the process of step S63 in FIG. 11, and sends an authentication request screen as shown in FIG. 13B to the user terminal 30. and requests credit card authentication processing (S63). Thereafter, the user terminal 30, the EC site server 20, and the card company server 10 perform steps S64 to S77 shown in FIGS. 11 and 12, and the credit card 40 is authenticated by the card company server 10. Note that in FIG. 14, illustration of steps S65 to S77 in FIG. 12 is omitted.

Through the processing described above, the same effects as in the first embodiment can be obtained in this embodiment as well. Further, in this embodiment, by registering customer information in the EC site server 20, it is possible to shop at the EC site using the once authenticated credit card 40. Further, in this embodiment, although the user's customer information is registered in the EC site server 20, the card information of the user's credit card 40 and the UV images (objects 45a to 45c) are not registered. Therefore, it is possible to prevent the card information of the credit card 40, the UV image, or the information of the object printed on the credit card 40 from leaking from the EC site server 20. Furthermore, in the present embodiment, the authentication process of the credit card 40 using the UV image of the credit card 40 only needs to be performed once when registering customer information in the EC site server 20, so that the operational burden on the user does not increase.

In this embodiment, card identification information is issued to each credit card 40 by the EC site server 20, and each credit card 40 is identified using the card identification information. Therefore, in this case, transmission and reception of personal information such as card numbers can be minimized. In addition, each credit card 40 may be identified using the card number written on the credit card 40 instead of the card identification information.

In this embodiment, the card company server 10 stores information on EC sites where each subscriber has used the credit card 40 in the subscriber information DB 12a. Therefore, the card company server 10 can know which EC sites each subscriber (user) has registered as a user. Therefore, for example, if customer information is leaked from one of the EC sites (EC site server 20), there is a possibility that the customer information registered on the EC site has been leaked from the card company to each subscriber. It is possible to call attention to this, and it is also possible to prevent the use of credit cards 40 whose customer information may have been leaked. This embodiment can also be applied to the information processing system of Embodiment 2, and similar effects can be obtained even when applied to the information processing system of Embodiment 2.

(Embodiment 4)
An information processing system that performs authentication processing based on a UV image of a credit card when using a credit card at a physical store will be described. FIG. 15 is a schematic diagram showing a configuration example of an information processing system according to the fourth embodiment. The information processing system of this embodiment includes a credit card processing terminal 50 installed in a physical store instead of the EC site server 20 in the information processing system of Embodiment 1. Credit card processing terminal 50 is configured to be connectable to network N. One credit card processing terminal 50 may be provided in each physical store, or a plurality of credit card processing terminals 50 may be provided in each physical store. In this embodiment, the card company server 10, user terminal 30, and credit card 40 have the same configurations as in Embodiment 1, so detailed explanations will be omitted. Note that the card company server 10 of this embodiment does not need to store the EC site DB 12b in the storage unit 12, but may do so.

In the information processing system of this embodiment, when a user uses a credit card 40 for shopping at a physical store, the user terminal 30 is used to acquire information on the credit card 40 (card information and UV image), and the acquired information is The information is sent to the card company server 10 to inquire about permission to use this credit card 40 and obtain permission to use it. Note that the card company server 10 determines whether or not the use of the credit card 40 is permitted in response to an inquiry from the user terminal 30, and if it is determined that the use is permitted (usage is allowed), the card company server 10 waits for a predetermined period of time (for example, 1 hour to 1 hour) from the time of the determination. This credit card 40 is allowed to be used for several hours. Specifically, if an inquiry about whether or not to use this credit card 40 is received from any of the credit card processing terminals 50 within a predetermined time after determining that the use is permitted, the card company server 10 Permission to use the card 40 is output to the credit card processing terminal 50.

FIG. 16 is a block diagram showing a configuration example of the card company server 10 and the credit card processing terminal 50. The card company server 10 is the same as in the first embodiment except that the EC site DB 12b is not stored in the storage unit 12, so a description thereof will be omitted. The credit card processing terminal 50 includes a storage section 51, a card information reading section 52, a communication section 53, an input section 54, a display section 55, etc., and these sections are interconnected via a bus. The storage unit 51 includes, for example, a flash memory, and stores a terminal ID 51a that is identification information assigned to each credit card processing terminal 50. The card information reading section 52 reads information (card information) stored in the IC chip 44 provided in the credit card 40. Note that if the credit card 40 has a magnetic stripe on which card information is stored, the card information reading section 52 may read the card information from the magnetic stripe. The communication unit 53 is an interface for connecting to the network N by wired communication or wireless communication, and transmits the card information read by the card information reading unit 52 to a predetermined card company server 10, for example. The input unit 54 accepts operation input from the operator operating the credit card processing terminal 50, and the display unit 55 displays various information to be notified to the operator.

Below, in the information processing system of this embodiment, processing performed by each device when a user uses the credit card 40 for shopping at a physical store will be described. FIG. 17 is a flowchart illustrating an example of the credit card 40 authentication processing procedure. In FIG. 17, the left side shows the processing performed by the user terminal 30, and the right side shows the processing performed by the card company server 10. Part of the following processing may be realized by a dedicated hardware circuit.

In the information processing system of this embodiment, a user who wants to use the credit card 40 for shopping at a physical store starts the authentication application 32AP using the user terminal 30 before performing the purchasing procedure (payment procedure), A request is made to the card company server 10 for permission to use the card 40. When the user terminal 30 receives an instruction to start the authentication application 32AP from the user via the input unit 34, the user terminal 30 starts the authentication application 32AP (S91). When the user terminal 30 starts the authentication application 32AP, it displays an authentication screen as shown in FIG. 8B on the display unit 35 (S92). Then, the user terminal 30 accepts card information (card number, expiration date, and contractor name) through the input field on the authentication screen, or obtains a captured image of the front side of the credit card 40 using the camera 36. Accordingly, card information of the credit card 40 is accepted (S93). Further, the user terminal 30 obtains a UV image of a predetermined area of the credit card 40 using the UV light 38 and the camera 36 (S94). The user terminal 30 determines whether or not authentication of the credit card 40 has been instructed depending on whether or not the authentication button on the authentication screen has been operated (S95), and if it is determined that authentication has not been instructed ( S95: NO), the process returns to step S93.

If it is determined that authentication of the credit card 40 has been instructed (S95: YES), the user terminal 30 transmits the card information and UV image acquired via the authentication screen from the communication unit 33 to the card company server 10 (S96). ). When the card company server 10 receives the card information and the UV image from the user terminal 30, it performs an authentication process to determine whether or not the credit card 40 is allowed to be used based on the received information (S97). The card company server 10 determines whether or not the authentication was successful (S98), and if it is determined that the authentication is not possible (S98: NO), it notifies the user terminal 30 that the authentication is not possible (the credit card 40 cannot be used) (S99). ). When the user terminal 30 is notified from the card company server 10 that authentication is not possible, the user terminal 30 displays a message indicating that authentication is not possible (for example, a message indicating that authentication is not possible) on the display unit 35 (S100), returns to the process of step S92, and returns to the process shown in FIG. The authentication screen shown in 8B is displayed again.

If the card company server 10 determines that the authentication was successful (S98: YES), it issues permission information indicating permission to use the credit card 40 (S101), and provides the authentication result indicating that the authentication was successful and the issued permission information. and is transmitted to the user terminal 30 (S102). The card company server 10 stores the issued permission information in the storage unit 12 in association with the credit card 40 information or the user (contractor) information (S103). When the user terminal 30 receives the authentication result and permission information from the card company server 10, it displays the authentication result and permission information on the display unit 35 (S104) and notifies the user. When the user of the user terminal 30 is notified of permission to use the credit card 40, the user displays the permission information notified along with the permission to use on the user terminal 30, or memorizes (memorizes) the permission information and completes the purchase procedure ( payment procedures).

FIG. 18 is a flowchart showing an example of a payment processing procedure using the credit card 40. As shown in FIG. In FIG. 18, the left side shows the processing performed by the credit card processing terminal 50, and the right side shows the processing performed by the card company server 10. Part of the following processing may be realized by a dedicated hardware circuit. The user who has been granted permission to use the credit card 40 takes the desired product to the checkout counter of the physical store and performs the purchase procedure using the credit card 40. A clerk at the physical store reads the card information of the credit card 40 using the card information reading section 52 of the credit card processing terminal 50 (S111), and transmits the read card information to the card company server 10 (S112). Note that the card information read from the credit card 40 includes information on the card company server 10 corresponding to the credit card 40, and based on the information included in the card information, the credit card processing terminal 50 card information to the server 10.

When the card company server 10 receives the card information from the credit card processing terminal 50, it requests the credit card processing terminal 50 for permission information issued to the credit card 40 of the received card information (S113). . Note that in step S103 during the process shown in FIG. 17, when the card company server 10 issues permission information to the credit card 40, it associates the permission information with the information of the credit card 40 or the contractor. It is stored in the storage unit 12. Therefore, when the card information received from the credit card processing terminal 50 is stored in the storage unit 12, the card company server 10 processes the card information corresponding to the received card information within a predetermined time from the issuing date and time of the permission information. Permission information is requested from the credit card processing terminal 50.

When the credit card processing terminal 50 receives a request for permission information from the card company server 10, it displays a request for inputting the permission information (S114). For example, the credit card processing terminal 50 displays on the display unit 55 a message requesting input of permission information. Note that the credit card processing terminal 50 may be configured to include a notification light for notifying a request for inputting permission information instead of the display unit 55. In this case, the permission information is displayed by lighting or blinking the notification light. may also request input. The credit card processing terminal 50 determines whether permission information has been accepted via the input unit 54 (S115), and if it is determined that the permission information has not been accepted (S115: NO), it waits until it is accepted.

If it is determined that the permission information has been received (S115: YES), the credit card processing terminal 50 transmits the received permission information to the card company server 10 (S116). When receiving permission information from the credit card processing terminal 50, the card company server 10 determines whether the received permission information matches the permission information stored in the storage unit 12 in step S103 during the process shown in FIG. (S117). If it is determined that they do not match (S117: NO), the card company server 10 notifies the credit card processing terminal 50 that the permission information sent from the credit card processing terminal 50 is not appropriate information and cannot be authenticated (authentication is not possible). Notify (S118). When the credit card processing terminal 50 is notified that the authentication is not possible from the card company server 10, it displays a message indicating that the authentication is not possible (for example, a message indicating that the authentication is not possible) (S119), returns to the process of step S114, and updates the permission information. The input request is displayed again (S114).

If it is determined that the permission information matches (S117: YES), the card company server 10 performs the payment procedure and notifies the credit card processing terminal 50 that the payment has been completed (S120). That is, the control unit 11 (permission unit) of the card company server 10 permits the use of the credit card 40 that was inquired about from the credit card processing terminal 50 as to whether the use is permitted, and performs payment procedures using the credit card 40. When the credit card processing terminal 50 is notified from the card company server 10 that the payment has been completed, the credit card processing terminal 50 displays that the payment has been completed (S121) and ends the process. Note that the credit card processing terminal 50 may display a message indicating that the payment has been completed on the display unit 55 to notify the completion of the payment, and when equipped with a notification light for notifying the completion of the payment, Completion of payment may be notified by lighting or blinking a notification light.

With the above-described processing, even when using the credit card 40 for shopping at a physical store, authentication is not only performed using card information such as the card number, expiration date, and name of the subscriber, but also using a UV image of a predetermined area of the credit card 40. Authentication takes place. Therefore, use of the credit card 40 can be restricted to only users who have the credit card 40 in hand, and unauthorized use of the credit card 40 can be prevented.

In this embodiment, when the credit card 40 is authenticated by the card company server 10, that is, when permission to use the credit card 40 is obtained, only the card information of the credit card 40 can be authenticated within a predetermined time. This allows the credit card 40 to be used. Therefore, by performing authentication using the UV image of the credit card 40, unauthorized use of the credit card 40 can be prevented, and if within a predetermined period of time after authentication using the UV image of the credit card 40, authentication using the UV image of the credit card 40 can be performed. By eliminating the need for authentication, it is possible to save the effort of taking a UV image of the credit card 40, improving convenience. Further, in this embodiment, the UV image of the credit card 40 obtained using the user terminal 30 is transmitted only to the card company server 10, and cannot be obtained by the credit card processing terminal 50 in the store. Therefore, leakage of the UV image of the credit card 40 from the credit card processing terminal 50 can be avoided.

In this embodiment, within a predetermined time after permission to use the credit card 40 is obtained through authentication using the UV image of the credit card 40, the credit card 40 can be used not only at physical stores but also at e-commerce sites. Regarding the use of the card 40, authentication using the UV image of the credit card 40 can also be made unnecessary. In this case, users using the EC site can also save time and effort to take a UV image of the credit card 40, improving convenience.

This embodiment can also be applied to the information processing systems of Embodiments 2 and 3, and similar effects can be obtained even when applied to the information processing systems of Embodiments 2 and 3. Note that when applied to the information processing system of Embodiment 3, permission to use the credit card 40 is obtained by registering as a user on the EC site within a predetermined time after permission to use the credit card 40 is obtained through authentication using the UV image of the credit card 40. User registration is now possible using the credit card 40 obtained.

(Embodiment 5)
An information processing system that acquires (photographs) UV images and visible light images of the credit card 40 using a dedicated device (card authentication device) will be described. The information processing system of this embodiment includes a card authentication device 60 in addition to each device in the information processing system of Embodiment 1. In this embodiment, the card company server 10, the EC site server 20, the user terminal 30, and the credit card 40 have the same configuration as in the first embodiment, so detailed explanations will be omitted. Note that the user terminal 30 of this embodiment does not need to include the camera 36, the visible light light 37, and the UV light 38. The card authentication device 60 may be distributed to each subscriber together with the credit card 40 when the credit card 40 is issued, or may be provided at a physical store.

FIG. 19 is a schematic diagram showing an example of the appearance of the card authentication device 60, and FIG. 20 is a schematic diagram showing a configuration example of the card authentication device 60. The card authentication device 60 shown in FIG. 19 has an elliptical cylindrical housing, and has an irradiation window 64a for ultraviolet rays emitted from a UV light 64 on one end surface, and light (visible light or ultraviolet rays) incident on a camera 63. An entrance window 63a is provided for this purpose. Further, on the side surface of the housing of the card authentication device 60, there are a visible light photographing button 62a for instructing to take a visible light image (first photographing process), and a visible light photographing button 62a for instructing to take a UV image (second photographing process). A UV photography button 62b and a transmission button 62c for instructing transmission of the photographed image to an external device are provided.

The card authentication device 60 includes a storage section 61, an input section 62, a camera 63, a UV light 64, a communication section 65, a display section 66, etc., and these sections are interconnected via a bus. The storage unit 61 includes, for example, a flash memory, and stores a device ID 61a that is identification information assigned to each of the card authentication devices 60. The input unit 62 includes a visible light photography button 62a, a UV photography button 62b, and a transmission button 62c, and accepts operation input by the operator operating the card authentication device 60. The camera 63 and UV light 64 are similar to the camera 36 and UV light 38 provided in the user terminal 30 of the first embodiment. Moreover, like the user terminal 30 of Embodiment 1, the card authentication device 60 may be provided with a visible light. The communication unit 65 is an interface for connecting to the network N by wired communication or wireless communication, and transmits visible light images and UV images taken by the camera 63, for example, to a predetermined device. The display unit 66 displays various information to be notified to the operator. Note that the display unit 66 may be configured to include a notification light 66a for notifying the operating state of the card authentication device 60. For example, a notification light to notify that visible light image shooting has been completed, a notification light to notify that UV image shooting has been completed, and a notification light to notify that shooting image transmission has been completed. A notification light or the like may be provided on the display section 66.

The card authentication device 60 configured as described above may be used instead of the user terminal 30 when photographing visible light images and UV images of the credit card 40 in the information processing systems of the first to fourth embodiments. In this case, for example, the card authentication device 60 and the user terminal 30 are configured to be able to communicate via the network N or directly. Then, the card authentication device 60 transmits the visible light image and the UV image taken by the camera 63 to the user terminal 30, so that the user terminal 30 acquires the visible light image and the UV image of the credit card 40. Can be configured. In this case, there is no need for the user terminal 30 to take visible light images and UV images using the camera 36, and there is no need for the user terminal 30 to include the camera 36 and the UV light 38. Even in such a configuration, the same effects as in Embodiments 1 to 4 can be obtained.

In the following, the card authentication device 60 does not send visible light images and UV images taken by the camera 63 to the user terminal 30, but sends them to the card company server 10 to inquire about permission to use the credit card 40. The configuration to be performed will be explained. In the information processing system of this embodiment, when a user wants to authenticate a credit card 40, a visible light image and a UV image of the credit card 40 are photographed using a card authentication device 60, and the images are sent to the card company server 10. Inquiry is made as to whether or not the credit card 40 is allowed to be used. Note that the case where it is desired to authenticate the credit card 40 means, for example, when the user terminal 30 obtains the authentication request screen shown in FIG. There are cases in which the user wants to register for the credit card 40, or in the fourth embodiment, to obtain permission to use the credit card 40 from the card company server 10.

FIG. 21 is a schematic diagram showing a configuration example of the subscriber information DB 12a stored in the card company server 10 of the fifth embodiment. The subscriber information DB 12a of this embodiment includes a device ID column and an authentication permission information column in addition to the configuration of the subscriber information DB 12a shown in FIG. 4A. The device ID column stores identification information assigned to each of the card authentication devices 60 distributed when the credit card 40 is issued to the credit card 40 subscriber. The authentication permission information string stores information indicating whether the use of the credit card 40 is permitted (authenticated or not) through authentication processing based on the visible light image and the UV image of the credit card 40. If authenticated, "authenticated" is stored, and if not authenticated, "unauthenticated" is stored. Note that the authentication information string may store the authentication results in association with the date and time (authentication date and time) when it was determined whether each credit card 40 is allowed to be used (authentication allowed). The device ID stored in the subscriber information DB 12a is stored by the control unit 11 when new subscriber information is registered. Note that the device ID of the card authentication device 60 distributed to this contractor is stored. The authentication permission information stored in the subscriber information DB 12a is the authentication result stored by the control unit 11 when the control unit 11 performs authentication processing based on the visible light image and UV image received from the card authentication device 60. Ru. The storage contents of the contractor information DB 12a are not limited to the example shown in FIG. 21.

FIG. 22 is a flowchart showing an example of the authentication processing procedure for the credit card 40 in the fifth embodiment. In FIG. 22, the processing performed by the card authentication device 60 is shown on the left, and the processing performed by the card company server 10 is shown on the right. Part of the following processing may be realized by a dedicated hardware circuit. In the information processing system of this embodiment, the card authentication device 60 determines whether the visible light photographing button 62a of the input unit 62 has been operated (S131), and if it is determined that it has been operated (S131: YES). ), a visible light image is obtained by photographing using the camera 63 (S132). When determining that the visible light photography button 62a has not been operated (S131: NO), the card authentication device 60 skips the process of step S132. Note that the area to be photographed as a visible light image is the entire surface area of the credit card 40, but it is written in the instruction manual of the card authentication device 60, for example, and the user can take the visible light image according to the description in the instruction manual. Obtain optical images. The card authentication device 60 also has a configuration that determines whether the photographed visible light image includes the card number, expiration date, and subscriber's name, and requests re-photography if it is determined that the card number, expiration date, and contractor's name are not included. A configuration etc. may be provided.

Next, the card authentication device 60 determines whether the UV photography button 62b of the input unit 62 has been operated (S133), and if it is determined that it has been operated (S133: YES), the card authentication device 60 uses the UV light 64 and camera 63 to to obtain a UV image (S134). When determining that the UV photography button 62b has not been operated (S133: NO), the card authentication device 60 skips the process of step S134. The area to be photographed as a UV image is, for example, described in the instruction manual of the card authentication device 60, or notified via the EC site if the EC site is being viewed, and the user can read the information in the instruction manual or Obtain UV images according to the notification from the EC site.

The card authentication device 60 determines whether the send button 62c of the input unit 62 has been operated (S135), and if it is determined that it has been operated (S135: YES), the two images, the visible light image and the UV image, are It is determined whether the image is being photographed (S136). If it is determined that the send button 62c has not been operated (S135: NO), or if it is determined that two images, the visible light image and the UV image, have not been captured (S136: NO), the card authentication device 60 The process returns to step S131. If it is determined that two images have been taken (S136: YES), the card authentication device 60 sends the acquired visible light image and UV image and the device ID 61a stored in the storage unit 61 to the communication unit 65. from there to the card company server 10 (S137).

When the card company server 10 receives the visible light image, UV image, and device ID 61a from the card authentication device 60, the card company server 10 performs authentication to determine whether or not the credit card 40 is allowed to be used based on the received visible light image and UV image. Processing is performed (S138). Note that the card company server 10 performs image recognition processing on the received visible light image and extracts the card number, expiration date, and contracting party's name (card information) of the subject's credit card 40. The card company server 10 also performs, for example, template matching processing on the received UV image to identify the object (UV image information) of the credit card 40 that appears in the UV image. The card company server 10 then compares the card information extracted from the visible light image and the object identified from the UV image with the stored contents of the subscriber information DB 12a, and if the card information is stored in the subscriber information DB 12a, the credit card 40 is It is determined that use is permitted (authentication was successful).

The card company server 10 determines whether or not the authentication was successful (S139), and if it is determined that the authentication was successful (S139: YES), the card company server 10 stores the authentication permission information corresponding to the received device ID in the subscriber information DB 12a. "Completed" is stored (S140). Further, when the card company server 10 determines that authentication is not possible (S139: NO), it stores "authentication not possible" as the authentication permission information corresponding to the received device ID (S141). Through the above-described process, the card company server 10 determines whether or not the credit card 40 is allowed to be used based on the visible light image and the UV image transmitted from the card authentication device 60, and uses the determination result (authentication result) as contract information. Store it in the DB 12a. Note that the authentication result may be stored in association with the date and time of authentication.

In this embodiment, permission or disapproval (authentication result) of each subscriber's credit card 40 is registered in the subscriber information DB 12a stored in the card company server 10. Therefore, when the card company server 10 receives an inquiry from the EC site server 20 or the credit card processing terminal 50 regarding permission to use the credit card 40, the card company server 10 uses the credit card 40 based on the authentication result stored in the subscriber information DB 12a. Permission/denial (usage availability) can be determined. Further, if the authentication date and time are stored in the contractor information DB 12a together with the authentication result of the credit card 40, the card company server 10 will not be able to authenticate the credit card 40 within a predetermined time after the use of the credit card 40 is authenticated. It can be configured to permit use of the credit card 40 without performing authentication using a UV image. Further, in this embodiment, since the visible light image and the UV image of the credit card 40 are photographed using the card authentication device 60, the card authentication device 60 can be used without interrupting the browsing of the EC site using the user terminal 30. The credit card 40 can be authenticated using the . Furthermore, since the visible light image and UV image taken by the card authentication device 60 are transmitted only to the card company server 10, they are not leaked from the EC site server 20, user terminal 30, or credit card processing terminal 50.

This embodiment can also be applied to the information processing systems of Embodiments 2 to 4, and similar effects can be obtained even when applied to the information processing systems of Embodiments 2 to 4. Note that when applied to the information processing system of embodiments 2 to 4, when acquiring the card information (visible light image) and UV image of the credit card 40 and transmitting it to the card company server 10, the card of this embodiment is It can be configured to use an authentication device 60. Further, when applied to the information processing system of the fourth embodiment, the card authentication device 60 is provided in a physical store, and when the credit card 40 is used at the physical store, the card authentication device 60 is used to authenticate the credit card 40. The visible light image and the UV image may be acquired and transmitted to the card company server 10 for authentication.

The embodiments disclosed herein are illustrative in all respects and should not be considered restrictive. The scope of the present invention is indicated by the claims rather than the above-mentioned meaning, and it is intended that all changes within the meaning and range equivalent to the claims are included.

10 Card company server 11 Control section 12 Storage section 13 Communication section 20 EC site server 30 User terminal 31 Control section 32 Storage section 33 Communication section 36 Camera 37 Visible light light 38 UV light 40 Credit card 12a Contractor information DB
22a Customer information DB
32AP Authentication app 45a-45c Object

Claims (9)

Obtain card information regarding credit cards,
Obtaining an invisible light image taken by irradiating the invisible light on a credit card whose information can be obtained by irradiating the invisible light,
A process of requesting permission to use the credit card from a predetermined device based on the card information and the invisible light image,
When an instruction to obtain permission to use a credit card is obtained from a website that accepts a purchase application for a product, based on the card information, the invisible light image, and site information regarding the website, the Request permission to use a credit card from a given device
A program that causes a computer to perform a process. receiving an instruction to execute either a first photographing process for acquiring a visible light image or a second photographing process for acquiring a non-visible light image;
When receiving an instruction to execute the first photographing process, acquiring a visible light image of the credit card;
The program according to claim 1, which causes the computer to execute a process of extracting the card information from the acquired visible light image. obtaining a shooting area designation for the credit card;
The program according to claim 1 or 2, which causes the computer to execute a process of acquiring the invisible light image photographing the designated photographing area. Photography department and
an irradiation unit that irradiates invisible light;
Acquisition of a visible light image obtained by photographing the credit card in the photographing section without irradiating invisible light, and a non-visible light image obtained by photographing the credit card in the photographing section after irradiating non-visible light. Department and
a transmitting unit that transmits the acquired visible light image and non-visible light image to a predetermined device ;
When the transmission unit receives an instruction to obtain permission to use a credit card from a website that accepts a purchase application for a product, the transmission unit transmits the visible light image, the non-visible light image, and site information regarding the website to a predetermined device. send to
Information processing device. an acquisition unit that acquires card information regarding a credit card , an invisible light image taken by irradiating the credit card with invisible light , and site information regarding a website that accepts a purchase application for a product ;
a recognition unit that recognizes an object from which information can be obtained by irradiating the credit card with invisible light from the acquired invisible light image;
a determination unit that determines permission or disapproval of use of the credit card based on the acquired card information and the recognized object ;
a permission transmitting unit that, when determining permission to use the credit card, transmits permission information indicating permission to use the credit card to a predetermined device related to the website based on the site information;
An information processing device comprising: comprising a storage unit that stores the card information and object information corresponding to the credit card in association with each other;
The determination unit compares the acquired card information and the recognized object with the card information and object information stored in association with the storage unit, and determines whether or not the credit card is used based on the verification result. The information processing device according to claim 5 , wherein the information processing device determines permission or disapproval of the information processing device. If the determination unit obtains inquiry information about whether or not the credit card can be used within a predetermined time after determining whether or not the credit card is permitted to be used, the determination unit authorizes the use of the credit card and sends information indicating permission to use to the inquirer. The information processing device according to claim 5 or 6 , further comprising: a permission unit for transmitting data to the device. Claim 5 , further comprising: a transmitting unit that transmits permission information indicating permission to use the credit card to a device from which the card information and the invisible light image are transmitted, when the determining unit determines permission to use the credit card. The information processing device described in any one of 7 to 7 . Obtain card information regarding credit cards,
Obtaining an invisible light image taken by irradiating the invisible light on a credit card whose information can be obtained by irradiating the invisible light,
A process of requesting permission to use the credit card from a predetermined device based on the card information and the invisible light image,
When an instruction to obtain permission to use a credit card is obtained from a website that accepts a purchase application for a product, based on the card information, the invisible light image, and site information regarding the website, the Request permission to use a credit card from a given device
An information processing method in which processing is performed by a computer.

Images