KR20060087404A - Card settlement method using portable electronic device having fingerprint sensor - Google Patents

Abstract

In a card settlement system using a portable electronic device having a fingerprint sensor, a credit card and a portable electronic device (5) having a fingerprint sensor are issued to a person who has made application. To this electronic device (5), card information (12), a storage public key Kp1, and a transmission public key Kp2 are assigned. When registering the electronic device (5) to be usable, a card management device (3) is accessed to identify an individual and when a registration permission signal is received, master fingerprint data (11) can be registered by a fingerprint sensor (51). The fingerprint data entered at this registration is used to create individual encryption keys Ks3, Kp3. Upon card settlement, the fingerprint is checked for authentication. Commodity order information (13) and card information (12) are encrypted by the transmission public key Kp2 and electronically signed by the individual encryption key Ks3. Transaction data (14) having the electronic signature is transmitted to a card management apparatus (3) where the data is decrypted and card settlement is performed.

Description

Card payment method using portable electronic device with fingerprint sensor {CARD SETTLEMENT METHOD USING PORTABLE ELECTRONIC DEVICE HAVING FINGERPRINT SENSOR}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a portable electronic device with a fingerprint sensor used for card payment for purchase price of goods or the like ordered on a network. The present invention also relates to a card payment method for securely performing card payment for purchase price of goods ordered over a network using a portable electronic device with a fingerprint sensor.

When using a payment card such as a credit card or a debit card to pay for a product or service fee, it is necessary to confirm whether the card user is really the card holder. This identity verification is the only thing that confirms identification card such as driver's license or passport of card user at store. Here, some payment cards are printed with a picture of the face of the card holder. In this case, identity verification can be performed by matching the face photograph printed on the card for payment with the card user.

The identity verification at the time of the card settlement can be performed by a face photograph printed on an identification card or a payment card as described above when the clerk is facing the card user at the store. However, for example, in the case of payment of goods or service charges on the Internet, or when using a card payment terminal without a clerk (for example, using a card payment terminal built in a pump of a gas station) Indeed, it is very difficult to determine whether the card user is really the cardholder.

In the case of making a payment with a payment card on a network such as the Internet, in general, payment is almost completed only by inputting a card number, the name of the card holder and the expiration date. However, the present situation is that the problems associated with the following card settlement is not ceaseless.

1) So-called problem of pretense that third person knows other's card number in some way, and uses it and purchases product on the Internet

2) Even though the cardholder purchases the product on the Internet, Shichimite refuses to buy it.

In the related art, in order to solve such a problem, the following method has been adopted or proposed.

First, Visa International proposes a method called "3-D Secure" as a means for securely making payments on the Internet. In this method, a password set by each cardholder and a secret question (such as a pet's name or a mother's maiden name) identifying himself or herself are registered in the card company's server. A vendor who sells goods or provides services to a cardholder on the Internet asks the purchaser a question about registration data that is registered in advance on the server of the card company, and confirms whether or not the purchaser is really the cardholder.

However, even using this method, inputting a card number, password, and answer to a secret question into a "live" personal computer remains the same. For this reason, it is not possible to completely protect the "seeds" by a malicious third party who have known these data in some way. In addition, this method can be executed in the case of a card payment on the Internet with a personal computer, but can be applied when using a card payment terminal that is not intervened in humans, such as a card payment terminal installed in a pump of a gas station. Can not.

Next, in US Patent Nos. 6,105,008 and 6,282,522 (Visa International), in the so-called payment method using a smart IC card, the available amount is registered in advance in the IC card, and only the Internet can be used within the range of the amount. A method has been proposed that prevents shopping on the street. However, in this method, there is a problem that a user spends a lot of time, such as checking the remaining amount of money or adding an amount of money each time. In addition, if the card is lost or stolen, the risk of fraudulent use of the card by a third party cannot be excluded.

Here, using a fingerprint has been proposed as a secure payment method on the Internet. For example, in the method disclosed in US Patent Application Publication No. 2002/0018585, the user's own fingerprint data is used as a key for data encryption such as a credit card number. However, in this method, the user must register his fingerprint data with a server on the network, and the psychological resistance of the user is large. In addition, in the card payment terminal in the store, the fingerprint scanner attached to the terminal scans the fingerprint, and the data is transmitted over the network every time, so that the general consumer does not consider the image held by the fingerprint. There is.

Similarly, the method disclosed in US Patent Application Publication No. 2001/0000535 also assumes that the fingerprint data of the user himself or herself is registered in a server on the network.

Disclosure of the Invention

An object of the present invention is to propose a card payment method which can reliably prevent unauthorized use of a card by a third party by accurately and securely verifying identity at the time of card payment on a network. Specifically, by using fingerprint authentication as an identity verification means, only the authenticated person can make card payments without leaking his or her information, which puts fingerprint information on the network, and payment information by simple and highly secure means. It is possible to secure the confidentiality of the card, and furthermore, since the user does not need to know the card number or the password, he proposes a card payment method that can expect strong security.

In addition, an object of the present invention is to propose a card payment method that can clarify that the transaction is performed by the card owner alone when the card is settled on the network, and can solve problems such as denial of payment transactions by the card holder. .

Furthermore, an object of the present invention is to propose a portable electronic device with a fingerprint sensor suitable for use in a card payment method for securely performing card payment on a network.

In order to achieve the above object, the present invention provides a card payment method for connecting a portable electronic device with a fingerprint sensor to a card management system of a card company via a communication terminal and performing card payment such as product purchase price,

In the portable electronic device with the fingerprint sensor, the fingerprint sensor is read out by the fingerprint sensor and compared with the fingerprint data registered in advance to determine whether the user is the owner of the portable electronic device with the fingerprint sensor. Identity verification process that performs identity verification,

In the above-mentioned portable electronic device with a fingerprint sensor, when identity verification is performed, the product order information and the card information registered in advance are encrypted with a previously registered transmission public key to generate transmission data. A generation / signing process of transmission data for digitally signing the transmission data using a personal encryption key registered in advance;

A transmission step of transmitting the transmission data with the electronic signature to the card management system from the side of the portable electronic device with the fingerprint sensor;

The card management system, comprising: decrypting the electronically signed transmission data using a transmission secret key paired with the transmission public key, and performing a payment process;

It characterized in that it comprises a.

Here, it is preferable that the fingerprint data and the card information of the portable electronic device with the fingerprint sensor are registered in a state encrypted with a storage public key granted from the side of the card management system. In this case, in the step of decrypting the card settlement data in the card management system, the decryption may be performed using a storage secret key paired with the storage public key.

The card management system preferably stores the received card settlement data for a predetermined period of time.

Next, as necessary, the card management system preferably updates the transmission public key and the storage public key registered in the portable electronic device with the fingerprint sensor. In this case, the portable electronic device with the fingerprint sensor may perform a process of replacing the registered card information and the fingerprint data with the card information and the fingerprint data encrypted using the updated public key for storage. .

On the other hand, the present invention is a portable electronic device with a fingerprint sensor which is used to connect to a card management system of a card company via a communication terminal and perform card payment such as product purchase price,

A fingerprint sensor, a storage unit, an external interface for connecting to the communication terminal, a processor for driving control of each unit, and the storage unit includes a public key for transmission and storage provided from the side of the card management system. The public key, card information of the payment card granted to the owner of the portable electronic device with the fingerprint sensor, master fingerprint data, and personal encryption key are stored.

The card information and the master fingerprint data are stored in a state encrypted with the storage public key,

The processor,

Personal encryption key generation means for generating the personal encryption key upon reading of the master fingerprint data by the fingerprint sensor;

Identity verification means for verifying identity by matching a fingerprint read by the fingerprint sensor with the fingerprint data of the storage section;

The product order information and the card information are encrypted using the transmission public key to generate transmission data, and the digital signature is performed on the transmission data using the personal encryption key, and the electronic signature is transmitted. And a transmission data generation / transmission means for transmitting toward the card management system.

Here, the processor may be configured to have master fingerprint data registration means for reading out and registering the master fingerprint data by the fingerprint sensor when receiving a registration permission signal from the card management system. In this case, it is preferable that the personal encryption key generation means generates the personal encryption key by using the fingerprint data read at the time of reading the master fingerprint data.

Next, the present invention is a card management system for performing card payment, such as product purchase price, based on card payment data received from a portable electronic device with a fingerprint sensor via a communication terminal,

Encryption key generation means for generating a storage public key and a transmission public key which are assigned to the portable electronic device with the fingerprint sensor;

When the registration request signal is received from the portable electronic device with the fingerprint sensor, identification information for identifying the user is requested, and when the user is specified based on the received identification information, the registration permission signal is attached with the fingerprint sensor. Registration procedure processing means for transmitting toward a portable electronic device;

When receiving the card payment data encrypted from the portable electronic device with the fingerprint sensor, a storage secret key paired with the storage public key and a transmission secret key paired with the transmission public key are stored. Decrypting means for decrypting the card settlement data,

And payment processing means for performing payment processing based on the decoded card payment data.

On the other hand, the present invention is a card payment system that connects a portable electronic device with a fingerprint sensor to a card management system of a card company via a communication terminal, and performs card payment such as product purchase price,

The portable electronic device with a fingerprint sensor,

Identity verification means for verifying whether or not the user is the owner of the portable electronic device with the fingerprint sensor by reading the user's fingerprint by the fingerprint sensor and matching it with previously registered fingerprint data;

When identity verification is performed, the product order information and the card information registered in advance are encrypted with a transmission public key registered in advance to generate transmission data, and a personal encryption key registered in advance. A generation / signing means for generating transmission data for digitally signing the transmission data;

Transmitting means for transmitting the electronically signed transmission data to the card management system,

The card management system,

Receiving means for receiving the electronically signed transmission data;

Decryption means for decrypting the received electronically signed transmission data using a transmission secret key paired with the transmission public key, and payment for performing a payment process based on the decrypted transmission data. It is characterized by including a processing means.

Here, the fingerprint data and the card information of the portable electronic device with the fingerprint sensor are registered in a state encrypted with a storage public key granted from the card management system side, and the decryption of the card management system. The means preferably decrypts using the storage secret key paired with the storage public key.

The card management system preferably includes storage means for storing the received card payment data for a predetermined period of time.

Furthermore, it is preferable that the card management system includes encryption key updating means for updating the transmission public key and the storage public key registered in the portable electronic device with the fingerprint sensor. In this case, the portable electronic device with the fingerprint sensor uses data update means for converting the registered card information and the fingerprint data into the card information and the fingerprint data encrypted using the updated public key for storage. It is preferable to provide.

1 is a schematic configuration diagram showing a card payment system to which the present invention is applied.

FIG. 2 is a schematic block diagram of a portable electronic device with a fingerprint sensor of FIG.

3 is an explanatory diagram for showing the registration procedure in the card settlement system of FIG.

4 is an explanatory diagram for showing a card settlement procedure in the card settlement system of FIG.

Hereinafter, an embodiment of a card payment system to which the card payment method of the present invention is applied will be described with reference to the drawings.

(System configuration)

Fig. 1 is a schematic configuration diagram showing a card payment system of this example, and Fig. 2 is a schematic block diagram of a portable electronic device with a fingerprint sensor. The card settlement system 1 is a fingerprint sensor provided to the card management system 3 provided on the card company 2 side and the owner 4 of payment cards such as credit cards from the card management company 2. The portable terminal 5 has a communication terminal 8 such as a personal computer 6 or a card payment terminal 7 which can connect the portable electronic device 5 with the fingerprint sensor. Furthermore, it has a network which can be connected between the portable electronic device 5 with a fingerprint sensor, and the card management system 3, for example, the Internet.

The portable electronic device 5 with a fingerprint sensor is issued by the card company 2 to the card applicant together with the credit card. When the card applicant receives the portable electronic device 5 with the fingerprint sensor, he / she accesses the card management system 3 of the card company 2 via the communication terminal 8 and the Internet 9, and registers for the use of the credit card. We perform procedure. When the registration procedure is completed, it becomes possible to pay the price of the product purchased in the online shop site 10 on the Internet 9 using the portable electronic device 5 with a fingerprint sensor by card settlement. .

The portable electronic device 5 with a fingerprint sensor communicates with a fingerprint sensor 51, a processor 52 for extracting and collating fingerprint data, and a nonvolatile memory 53 for storing fingerprint data and other data. It has an external interface 54 for communicating with the terminal 8.

In the nonvolatile memory 53, a public key (hereinafter referred to as a storage public key) (Kp1) for encrypting and storing the card information and the encrypted card information are further encrypted and transmitted to the card management system 3. A public key (hereinafter referred to as a public key for transmission) (Kp2) is recorded. In addition, the card holder's own secret key Ks3 and public key Kp3 generated using fingerprint data are recorded. For example, such a secret key and a public key can be generated using noise of fingerprint data. Further, the master fingerprint data 11 of the card holder is registered.

On the other hand, the card management system 3 of the card company 2 includes a front server 31 which is a web server, a payment server 32, an archive server 33, a database 34 for storing card payment histories and the like. )). The front server 31 is for decoding the information received via the Internet 9 and connecting it to the payment server 32. The front server 31 has a pair of a transmission secret key Ks2 paired with a transmission public key Kp2 held by the portable electronic device 5 with a fingerprint sensor, and a storage public key Kp1. The storage secret key Ks1 is stored, and the received information is decrypted using these secret keys Ks1 and Ks2. In this example, all public keys, encryption keys, and digital signature methods are based on the specifications of PKI.X.509.

(Registration procedure)

Prior to the use of the card payment system 1 of this example, the issuance and registration procedure of the portable electronic device 5 with a fingerprint sensor is required. Referring to Fig. 3, this procedure will be described.

First, when an applicant for a credit card performs a card application procedure by mail or online to the card company 2 (arrow 101), the card company 2 carries out a portable electronic device with a fingerprint sensor (token; 5) and a credit card. Issue to applicant (arrow 102).

When the card company 2 issues the portable electronic device 5 with the fingerprint sensor, the card company 2 records the following information in the nonvolatile memory 53 of the portable electronic device 5 with the fingerprint sensor.

1) Memory public key (Kp1) for encrypting and storing card information

2) Sending public key (Kp2) for further encrypting and sending the encrypted card information

3) Card Information (12)

The applicant connects the portable electronic device 5 with the fingerprint sensor to the communication terminal 8 such as the personal computer 6 as soon as the applicant receives the portable electronic device 5 with the fingerprint sensor and the credit card from the card company 2. (Arrow 103). Then, the URL designated by the card company 2 is accessed via the communication terminal 8 and the Internet 9, and communication with the front server 31 of the card management system 3 is established (arrow 104). A request signal (activation request) is issued (arrow 105).

After this, inquiry of social insurance number and driver's license number which applicant filled in at the time of card application and secret question (name of pet, composition of mother) become on the Web (confirmation of identification information) Confirmation is made (arrow 106). In the question, if the front server 31 of the card company can confirm that the answer inputter is the card applicant, the front server 31 of the card company 2 is provided with respect to the portable electronic device 5 with the fingerprint sensor. A registration permission signal (activation permission signal) for allowing fingerprint data registration start is sent (arrow 107). As a result, the card applicant is formally registered as the card member 4 on the side of the card company 2.

On the screen of the communication terminal 8 having received the activation permission signal, a message " put a finger on the portable electronic device with a fingerprint sensor " is displayed. The card member 4 scans the finger by the fingerprint sensor according to the message. In order to register fingerprints for several fingers, the same instruction is repeated (block 108).

When the portable electronic device 5 with a fingerprint sensor confirms that required fingerprint data match, it registers the fingerprint data as the master fingerprint data 11 in the nonvolatile memory (arrow 109). At the same time, using the fingerprint data, the private secret key Ks3 and the private public key Kp3 of the card member 4 are generated. For example, the private secret key Ks3 and the private public key Kp3 of the card member 4 are generated using noise accompanying the fingerprint data at the time of acquiring fingerprint data. These keys are used to prepare the electronic certificate.

(Card settlement procedure)

Next, with reference to FIG. 4, the card payment procedure on the Internet in the card payment system 1 of this example is demonstrated.

When the card member 4 receives the purchase of a product or the provision of a service on the Internet 9, the portable electronic device 5 with the fingerprint sensor is connected to the communication terminal 8 (arrow 121), and the communication terminal 8 The online shopping site 10 is accessed via the arrow 122 (arrow 122). When the product is purchased through the communication terminal 8 (arrow 123), the product information and the order information are returned from the online shopping site 10 side (arrow 124).

At the time of payment of the purchase price of the order product, instead of inputting the card number for payment, the finger corresponding to the registered fingerprint is scanned by the fingerprint sensor 51 of the portable electronic device (token) 5 with a fingerprint sensor. do. When the master fingerprint data 11 stored in the nonvolatile memory 53 and the fingerprint data of the scanned finger coincide with each other, the portable electronic device 5 with the fingerprint sensor is performing the settlement operation by the card member 4. The card information 12 encrypted with the storage encryption key Kp1 recorded by the card company 2 and the information (merchandise order information) 13 regarding the product to be purchased are sent to the transmission encryption key Kp2. ). At the same time, an electronic signature is performed on the private public key Kp3 and the secret key Ks3 of the card member 4 (arrow 125). Then, the encrypted and digitally signed transmission data (electronically signed transaction data) 14 is transmitted to the front server 31 of the card company 2 via the Internet 9 (arrow 126). Here, the meaning of performing the electronic signature is to prevent denial of the card settlement act by the card member 4.

When the front server 31 of the card company 2 receives the electronically signed transaction data 14, it decrypts it with a secret key Ks2 paired with a transmission encryption key Kp2, and further stores a storage encryption key Kp1. ) And a secret key Ks1 paired with each other, and the card information 12 is decrypted (block 127). Then, a settlement request is made to the settlement server 32 (arrow 128). That is, the process is transferred to the conventional payment process. Further, for security reasons such as denial of payment by the card member 4, it is also possible to archive the sent electronically signed transaction data 14 for a long time (arrows 131 and 132).

Thus, in the card payment system 1 of this example, the card member who is the owner of the registered fingerprint is fingerprinted by performing the electronic signature with the private key Ks3 of the individual generated in the portable electronic device 5 with the fingerprint sensor. It is specified that payment is performed using the portable electronic device 5 with a sensor. Furthermore, by decrypting the encrypted data with the secret keys Ks1 and Ks2 of the front server 31 of the card company 2, the data itself is transmitted from the portable electronic device 5 with the fingerprint sensor issued by the card company. Is specified.

From these two points, it is possible to reliably specify the person who made the card payment, and the authenticity of the portable electronic device 5 with the fingerprint sensor used can be reliably determined. Therefore, a very stable network settlement method is realized in the card company 2.

Here, when the portable electronic device 5 with a fingerprint sensor is connected to the Internet 9 via a communication terminal 8 such as a personal computer 6, the payment server 32 of the card company 2 and Communicate online Therefore, whenever necessary, the card company 2 can change the storage public key Kp1 and the transmission public key Kp2 written in the portable electronic device 5 with the fingerprint sensor. This further increases the security of the encryption key used for encryption. In addition, when the encryption key is changed again, it is necessary to update the data recorded in the nonvolatile memory 53 by the data encrypted using the new encryption key.

Next, the above example is a payment procedure at the time of purchase of goods, etc. via the Internet. The card payment system 1 of this example can be used even in the case of purchase of goods and services by general card payment, even in the case of using a card without a human being, such as the card payment terminal 7 of a gas station, for example. . In this case, by connecting the electronic device 5 to the card payment terminal 7 of the pump of the gas station, the user can be specifically designated, and the electronic signature of the card payment can be performed, and with the fingerprint sensor The authenticity of the portable electronic device 5 can also be determined.

As described above, in the card settlement method using the portable electronic device with a fingerprint sensor of the present invention, fingerprint data of a card member registered in the electronic device is not output to the outside at all. The fingerprint data is only used to recognize whether the card member is the card member, and the key for encrypting the information necessary for payment such as the card number stored in the electronic device can be arbitrarily determined by the card issuing company. It is also possible to register a change at any time. Therefore, a card settlement method that is more secure, convenient, and respects the privacy of the card member is realized in both the card member and the card company.

That is, according to this invention, the following effect | action and effects are acquired.

1) Data relating to card information is not transmitted to the card company's server unless the card member's fingerprint matches the fingerprint. Further, the electronic signature is performed using the private key of the card member held in the portable electronic device with a fingerprint sensor.

Therefore, it is possible to confirm that the card company is necessarily a payment request from the card member itself, and to prevent posing by a third party. In addition, even if the card member has made a payment, he cannot say false (deny) that he is not doing it.

2) Since the card member does not need to know his or her card number, there is no worry that the card number is leaked to others due to the card member's artificial miss.

3) Data relating to card information output from a portable electronic device with a fingerprint sensor is always encrypted by a public key (paired with the secret key of the card company's server) that the card company previously recorded on the electronic device. Is output. At the same time, an electronic signature is performed with the private key of each card member. Therefore, if the data is stolen or corrected in any way, it is not to be exploited.

4) "raw card information" such as a card number is stored in a memory of a portable electronic device with a fingerprint sensor, encrypted with a public key previously recorded by the card company in the electronic device. In addition, it is not output unless it is encrypted again outside of the electronic device. Therefore, card information can be stored with high security.

Even if the portable electronic device with a fingerprint sensor is lost, the electronic device cannot be used unless it matches the fingerprint data of the card member. The stored card data is encrypted. Therefore, there is less risk of using a portable electronic device with a lost or stolen fingerprint sensor. In addition, in the case of attempting to extract data in an illegal manner, the safe operation can be performed by combining with a self-destructive function (so-called Tamper Resistant).

5) Like "raw card information", the registered fingerprint data of the card member is also stored only inside the portable electronic device with a fingerprint sensor, and is never output to the outside of the electronic device. Therefore, it is easy to accept in a card member from a viewpoint of personal security maintenance, and it is preferable.

6) The card company only adds a front server, which is an encryption key server of the PKI method, to the front of the existing payment server, and can use the card payment method according to the present invention.

7) When the portable electronic device with a fingerprint sensor is added with the interface function for connection to a personal computer, and the function which communicates with an existing card payment terminal by wireless (electromagnetic wave, infrared rays, etc.), the card payment method of this invention. It can broaden the scope of application. That is, in addition to the payment of the Internet, in the card payment terminal of the unmanned store which was extremely difficult to specify whether the card member is used in the past, the card of the present invention is merely added to the payment terminal side. Payment methods can be used, and existing problems such as payment on the Internet can be solved.

8) When the card company requires that the encryption key for encrypting the card information stored in the portable electronic device with the fingerprint sensor online is changed whenever necessary, high security between the electronic device and the payment server of the card company is required. Can hold.

Claims (11)

As a card payment method which connects a portable electronic device with a fingerprint sensor to a card management system of a card company via a communication terminal and performs card payment such as product purchase price, In the portable electronic device with a fingerprint sensor, the fingerprint sensor reads the user's fingerprint and checks the fingerprint data registered in advance to determine whether the user is the owner of the portable electronic device with the fingerprint sensor. Identity verification process that performs identity verification, In the portable electronic device with a fingerprint sensor, when identity verification is performed, the transaction information is generated by encrypting the product order information and the card information registered in advance with a transmission public key registered in advance. A process for generating and signing transaction data for digital signature using a personal encryption key registered in advance; A transmission step of transmitting the electronically signed transaction data from the side of the portable electronic device with a fingerprint sensor to the card management system; The card management system, comprising: decrypting the electronically signed transaction data by using a transmission secret key paired with the transmission public key, and performing a payment process; Card payment method using a portable electronic device with a fingerprint sensor comprising a. The fingerprint data and the card information of the portable electronic device with a fingerprint sensor are registered in a state encrypted by a storage public key granted from the side of the card management system. The step of decrypting the electronically signed transaction data in the card management system includes a decryption step using a storage secret key paired with the storage public key. How to pay for your card using your device. 3. The card payment method according to claim 1 or 2, wherein the card management system stores the received electronic signature transaction data for a predetermined period of time. 4. The card management system according to any one of claims 1, 2 and 3, wherein the card management system includes updating the transmission public key and the storage public key registered in the portable electronic device with the fingerprint sensor. and, The portable electronic device with a fingerprint sensor replaces the registered card information and the fingerprint data with the card information and the fingerprint data encrypted using the stored public key after updating. Card payment method using a portable electronic device. In a portable electronic device with a fingerprint sensor used to connect to a card management system of a card company via a communication terminal and to settle a card such as a product purchase price, A fingerprint sensor, a storage unit, an external interface for connecting to the communication terminal, a processor for driving control of each unit, and the storage unit includes a public key for transmission and storage provided from the side of the card management system. The public key, card information of the payment card granted to the owner of the portable electronic device with the fingerprint sensor, master fingerprint data, and personal encryption key are stored. The card information and the master fingerprint data are stored in a state encrypted with the storage public key, The processor, Personal encryption key generation means for generating the personal encryption key upon reading the master fingerprint data by the fingerprint sensor; Personal identification means for performing personal identification by matching the fingerprint read by the fingerprint sensor with the fingerprint data of the storage section; The product order information and the card information are encrypted using the transmission public key to generate transaction data, and the electronic signature is performed by using the personal encryption key. A portable electronic device with a fingerprint sensor for use in card settlement, comprising means for generating and transmitting transaction data to be transmitted to the card. A master fingerprint data registration means according to claim 5, wherein said processor reads and registers said master fingerprint data by said fingerprint sensor upon receiving a registration permission signal from said card management system, And said personal cryptographic key generating means generates said personal cryptographic key using fingerprint data read at the time of reading said master fingerprint data. As a card management system for performing card payment, such as product purchase price, based on transaction data received from a portable electronic device with a fingerprint sensor via a communication terminal, Encryption key generation means for generating a storage public key and a transmission public key which are assigned to the portable electronic device with the fingerprint sensor; When the registration request signal is received from the portable electronic device with the fingerprint sensor, identification information for identifying the user is requested, and when the user is specified based on the received identification information, the registration permission signal is attached with the fingerprint sensor. Registration procedure processing means for transmitting toward a portable electronic device; Upon receiving the encrypted and digitally signed transaction data from the portable electronic device with the fingerprint sensor, a storage secret key paired with the storage public key and a transmission secret paired with the transmission public key. Decrypting means for decrypting the transaction data using a key; And a payment processing means for performing payment processing on the basis of the decrypted transaction data. As a card payment system that connects a portable electronic device with a fingerprint sensor to a card management system of a card company via a communication terminal, and performs card payment such as product purchase price, The portable electronic device with a fingerprint sensor, Identity verification means for verifying whether or not the user is the owner of the portable electronic device with the fingerprint sensor by causing the fingerprint sensor to read the user's fingerprint and matching it with previously registered fingerprint data; When the identity verification is performed, the product order information and the card information registered in advance are encrypted with the transmission public key registered in advance to generate transaction data, and the private encryption key registered in advance. Generation and signature means for generating transaction data for digital signature; Transmitting means for transmitting the electronically signed transaction data to the card management system, The card management system, Receiving means for receiving the electronically signed transaction data; Decrypting means for decrypting the received electronically signed transaction data using a transmission secret key paired with the transmission public key; And a payment processing means for performing a payment process based on the decrypted transaction data. The fingerprint data and the card information of the portable electronic device with the fingerprint sensor are registered in a state encrypted with a storage public key granted from the card management system. And the decryption means of the card management system performs decryption using a storage secret key paired with the storage public key. The card payment system using a portable electronic device with a fingerprint sensor according to claim 8 or 9, wherein the card management system includes a storage means for storing and storing the received transaction data for a predetermined period. 11. The card management system according to any one of claims 8, 9, and 10, wherein the card management system encrypts the public key for transmission and the public key for storage stored in the portable electronic device with the fingerprint sensor. Equipped with key updating means, The portable electronic device with the fingerprint sensor includes data update means for converting the registered card information and the fingerprint data into the card information and the fingerprint data encrypted using the updated public key for storage. Card payment system using a portable electronic device with a fingerprint sensor.

Images