WO2001095185A1

WO2001095185A1 - Information processing system and terminal device for wide-area network, and user identification information encrypting and decrypting methods

Info

Publication number: WO2001095185A1
Application number: PCT/JP2001/004717
Authority: WO
Inventors: Kouei Nakashima
Original assignee: Wincess Yugen Kaisha
Priority date: 2000-06-05
Filing date: 2001-06-04
Publication date: 2001-12-13
Also published as: AU2001260711A1; JPWO2001095185A1

Abstract

An information processing system for providing a service to a user by utilizing a wide-area network, while preventing the information on the user from leaking reliably. An electronic settling system comprises an authentication server (4) and a dedicated WWW server (6) connected with the Internet (2) and a customer information conversion server (30) in a closed network (20) constructed in a financial institution or the like. A user terminal (10) can read information from an IC card (12) and is automatically connected with the WWW server (6) when the user connects the terminal with the WWW server (6) for Internet shopping, on the basis of the access information and the authentication information in the IC card (12). When the user purchases a commodity, the settlement ID in the IC card (12) is transmitted for the settlement to a customer information conversion server (30). The settlement ID specifies the user, and all the customer information including the account number are stored in a database (32).

Description

Technical Field Information processing system and terminal device for wide area network, and method of encrypting and decrypting user identification information

The present invention relates to a wide area network information processing system suitable for providing services to users using a wide area network such as the Internet, and a terminal device suitable for use in this system. The present invention also relates to a method for encrypting and decrypting identification information for payment suitable for encrypting identification information of a user used to identify a user in this system. Background art

2. Description of the Related Art Conventionally, so-called online shopping, which sells information such as a combination program and musical sound data and various articles using a wide area network such as the Internet, has been known.

By the way, in such an online shopping system, purchases are usually made separately from request reception means (generally, a WWW server that establishes a sales homepage) to provide information on products, etc., so that charges can be collected safely from users. Judgment as to whether the user who has indicated the will of the request is trustworthy and only if the user is trustworthy is permitted to sell to that user, and payment for collecting a fee from that user An information processing device for processing is installed.

In order to perform settlement processing using such an information processing device, not only fee information indicating the fees to be collected from the user and the contents of sales, but also the usage necessary for conducting user identification and credit checks, etc. Personal information and money required for payment Payment information such as financial institution account numbers and credit card numbers is required. For this reason, in the past, usually, the request receiving means for directly communicating with the user terminal obtains the user's personal settlement information from the user terminal via the wide area network, and obtains the information. The payment information that has been transferred is transferred to the information processing device together with the fee information.

However, if payment information of the user is acquired via a wide area network as in the past for such payment, such information will flow over the wide area network as it is. However, payment information may flow to third parties and be abused.

In view of these problems, in the past, payment information was transmitted by encrypting the payment information, or by transmitting only the payment information using a dedicated communication line such as a telephone line. It prevents leakage to third parties and misuse.

However, simply encrypting the payment information cannot easily prevent the leakage of the payment information because the key used for encryption can be easily decrypted. If payment information is transmitted using a dedicated communication line, the user terminal must have a connection circuit to the wide area network and a connection circuit to the dedicated communication line. This increases the cost of the terminal on the user side, increases the financial burden on the user, and makes it difficult for the user to use it.

In addition, in the conventional system described above, when a user indicates that he or she wants to purchase a desired product through online shopping or the like, a request receiving means such as a WWW server transmits an input format of settlement information to the user side terminal. The user had to input the payment information in accordance with the input form sent and sent it over the wide area network, which was not user-friendly. In addition, such leakage of the user's personal information occurs similarly in systems other than electronic payment systems using a wide area network.

For example, if health management data such as the health status of individual users and the medical treatment status at various medical institutions are compiled into a database, and this is made available to individuals and various medical institutions using a wide area network, Registration of management data-When searching, information that identifies an individual (name, phone number, etc.) also flows on the network, but when this information is passed to a third party, it is sent to the database. Unauthorized access becomes possible, and the personal health management data of the user is disclosed, which causes the problem that the health management data is tampered with. Disclosure of the invention

The present invention has been considered in view of these problems. In an information processing system that provides services to individual users using a wide area network, the present invention reliably prevents personal information from being leaked, and reduces the user's safety. The purpose is to make it available with care.

In the information processing system for a wide area network according to claim 1, which has been made to achieve the object, the request receiving means communicates with the user side terminal via the wide area network, and A process is performed to accept a request for a service that can be provided by the system from the terminal (for example, the above-mentioned settlement request for commercial transactions, a request for updating and searching for personal information, etc.). Then, upon actually receiving the service request from the user terminal, the request receiving means obtains, from the user terminal, encrypted identification information for identifying the user, and the user receives the encrypted identification information. It is transmitted to the information processing means together with the information indicating the requested service.

Then, the information processing means decodes the identification information and the decoded identification information Is checked against a customer information database in which customer information is registered in advance for each user, thereby determining whether the user is a registered customer (in other words, a customer who can enjoy the service). If the customer is a customer who can enjoy the service, the information processing for realizing the service requested by the user based on the customer information registered in the customer information database I do.

That is, according to the present invention, a customer information database in which customer information necessary for providing a service to a user is registered for each user is created in advance, and when the user actually enjoys the service, On the other hand, the identification information for identifying the user is encrypted and transmitted from the user terminal to the request receiving means.

Therefore, according to the present invention, customer information (for example, personal information such as a user's name, address, account number,...) Necessary for providing a service requested by the user is provided on a wide area network. Since there is no need to transmit the information and only the identification information that can identify the user in the system needs to be sent, it is possible to prevent the customer information of the user from being misused by third parties.

Further, the information processing means receives the identification information input from the request receiving means and the information indicating the content of the service requested by the user, and performs a service for the user registered as a customer in advance. However, since the communication path between the information processing means and the wide area network is blocked by the request receiving means, it is possible to reliably prevent unauthorized access to the information processing means from the outside, and to prevent unauthorized access to customer information. It can be prevented from leaking outside due to access.

In addition, the request receiving means simply inputs the identification information of the user and the information indicating the contents of the service requested by the user to the information processing means, and the customer information is transmitted from the information processing means to the request receiving means. Is never transmitted, This can also prevent customer information from leaking to the outside.

Therefore, according to the present invention, a service providing system that can be used by users with peace of mind can be constructed.

By the way, in the information processing system for a wide area network of the present invention, the encrypted identification information is transmitted from the user side terminal to the wide area network, and this is acquired by the request receiving means on the wide area network. By transferring the information to the information processing means, the information processing means identifies the user based on the identification information and performs information processing for the service requested by the user. However, it is conceivable that the system could get into the system by acquiring all the information sent from the user terminal over the wide area network and using it as it is. Therefore, in order to more reliably prevent such a situation, the system may be configured as described in claim 2. That is, in the system according to claim 2, when the request receiving unit acquires the identification information from the user terminal, the request reception unit transmits the identification information and a password corresponding to the identification information to the user terminal. Request. Then, the user terminal receiving the request requests the user to input a password corresponding to the identification information, and in response to the request, requests the password entered by the user and the identification information. The request is transmitted to the receiving means, and the request receiving means transfers the transmitted identification information and password to the information processing means. Then, the information processing means determines whether the user is a customer based on the identification information transmitted from the request receiving means and the password.

Therefore, according to the system described in claim 2, even if the third party who does not know the password obtains the identification information of the user, it cannot enter the information processing system for a wide area network of the present invention. Performance can be further improved.

Next, the information processing system for a wide area network described in claim 3 The invention (claims 1 and 2) is applied as a service to the user to a system that performs settlement processing required for commercial transactions on a network, and is obtained using a customer information database as information processing means. It is equipped with a payment means that performs payment processing to collect fees from users based on customer information (such as account numbers of financial institutions required for payment / credit card numbers, etc.).

Then, the request receiving means provides information for a commercial transaction (for example, a homepage for internet shopping) which can be realized by the system in accordance with a request from the user terminal, and a result of the information provision is provided. When a settlement request for commercial transactions is received from the user terminal, the fee information indicating the fee to be collected from the user is transferred to the settlement means together with the identification information obtained from the user terminal.

Therefore, according to the system described in claim 3, in order to realize commercial transactions using a wide area network, customer information (such as an account number of a financial institution, a credit card number, etc.) required for settlement is transmitted to the network. It is not necessary to send the information on the network and only the identification information that identifies the user needs to be sent, so the account number of the financial institution of the user ゃ credit card number is passed on to a third party, and the user is financially damaged. Can be prevented.

In addition, there are many sites that open homepages for users to conduct commercial transactions on the network, but the system described in claim 3 (a so-called electronic payment system) uses such existing sites. By making the function as a request receiving means, it can be easily realized.

In this case, by setting up the settlement means (information processing means) for performing the settlement processing in a financial institution or the like, the site having the function as the request receiving means and the settlement means (information processing means) can be separated. For example, an information provider who has established a request receiving means (site) cannot acquire customer information of users. As a result, it is possible to prevent the information provider from misusing the customer information of the user, and to build a business transaction system that can be used with peace of mind for the user.

By the way, in the system according to claim 3, the information processing means identifies the user by decoding the identification information transferred from the request receiving means, and the user stores the customer in the customer information database. If the user is a registered user, the payment process will be performed to collect the toll.However, in order to perform the payment process more reliably, it is necessary to be able to confirm whether the payment can be actually performed based on the customer information. desirable.

For this purpose, as described in claim 4, when the settlement means determines that the user is a pre-registered customer based on the customer information database, an external (for example, a financial institution or a credit bureau) Credit check database, and conducts a credit check of the user.As a result of the credit check, the settlement process is performed only when the user is determined to be credible, and when the user is determined to be unreliable, It is preferable to configure the request receiving means to stop the commercial transaction with the user.

Further, in the system according to claim 3 or 4, the settlement means is configured to directly connect to a management computer of a financial institution such as a bank or a credit card company and to collect a fee directly from the financial institution. Alternatively, as described in claim 5, by transmitting information indicating the user and the collected amount to an external fee collection system such as a debit card settlement center, an external charge can be obtained. Payment processing may be performed via a collection system.

On the other hand, the systems described in claims 3 to 5 can be constructed individually by various sales companies that sell products or provide various services.However, when each sales company constructs this system individually, Using a sales company A user who wants to manage the identification information etc. for each sales company, which is extremely troublesome to manage.

Therefore, when actually constructing the system (electronic settlement system) according to claims 3 to 5 to which the present invention is applied, as described in claim 6, the system is transmitted from various sales companies. It may be managed by a sales agency that conducts business transactions with users on behalf of the company. In this case, the request receiving means, when it is determined that the payment means can collect the fee from the user by the information processing means, transmits the result of the commercial transaction with the user to the corresponding sales It needs to be configured to notify the company.

As described above, if the request receiving means and the settlement means (information processing means) are all managed by the sales agent company and only the result of the established commercial transaction is notified to the sales agent, the user can be provided with the sales agent. Using one piece of identification information registered with the company, it becomes possible to purchase desired products or receive desired services from a plurality of sales companies, thereby improving user convenience.

In addition, a sales company can order goods or services using a wide area network simply by outsourcing sales operations to a sales agency. This eliminates the need for sales companies to make capital investments necessary for business transactions using the wide area network, and allows them to easily expand sales channels simply by paying commissions to sales agents.

On the other hand, in order for a user using a plurality of sales companies to be able to easily manage identification information, as described in claim 7, in the system according to claims 3 to 5, The receiving means is managed by a sales company that conducts commercial transactions with users, and the settlement means (information processing means) is managed by a settlement agency that performs settlement processing on behalf of the sales company. You may. In other words, in this case, it is necessary for the sales company that sells products and various services to manage the request receiving means, but the information processing means for identifying the user from the identification information is outsourced from the sales company. Since the payment agency receives the information, the user only needs to register one piece of identification information with the payment agency, and the identification information can be easily managed.

Therefore, also in the system according to claim 7, the convenience of the user can be improved. Further, in this case, the sales company does not need to manage the customer information of the user required for the settlement, so that the system can be easily operated, and the user can send the customer information to the sales company. Since it is not known, the settlement system can be used with confidence.

On the other hand, the information processing system for a wide area network described in claim 8 converts the present invention (claims 1 and 2) into a so-called database system that manages personal information of users (in other words, private information). As an information processing means, it has a personal information database in which personal information of the user is stored in association with the customer information obtained using the customer information database. If there is a request to register or search for personal information from a customer registered in the database, the system is equipped with a personal information management means that updates or searches for the personal information of the customer himself or herself registered in the personal information database in accordance with the request.

When the request receiving means receives a request for updating or searching for personal information registered in the personal information database from the user terminal, the request receiving means transmits the request for updating or searching for the personal information together with the identification information obtained from the user terminal. , Transfer to personal information management means.

In other words, the system according to claim 8 manages the user's personal information (private information) and updates the personal information according to the request from the user. Performs a search, but when a user updates or searches for personal information, only the identification information and a request for updating or searching are sent from the user terminal to the network. As a result, it is possible to prevent the user's private information from being passed to a third party and causing the user to be damaged.

Also, for example, when a user updates personal information, even if update data is transmitted from the user terminal, the update data is added to the system to identify the user. Since customer information that can identify the user (in this case, the user's address, telephone number, contact information, etc.) is not transmitted, it is assumed that a third party has illegally acquired the update data. However, it is not possible to identify who the update data belongs to, and it is possible to prevent users from being damaged by the leakage of the update data.

If a user makes a search request for personal information and the search result is sent directly to the user terminal via the network, the user is specified from the destination. In such a case, the search result may be transmitted using a dedicated communication line or a dedicated homepage protected by security.

Here, in the system according to claim 8, the personal information (private information) of the user registered in the personal information database includes, for example, all information on the user's assets, career, hobbies, and the like. In particular, if information indicating the health condition of each user is registered in the personal information database as personal information, as described in claim 9, the individual personal It will be a very effective system for users because they will be aware of the condition and pay attention to health management.

In this case, as the personal information indicating the health condition of the user, a measuring device (a so-called vital measuring device) provided at the user's terminal is used, and the user's current biological characteristics (pulse, blood pressure, body fat, Oxygen, carbon dioxide, blood flow, blood, hair Hair, nails, oral film, oral mucosa, saliva, etc.) are measured and registered in the personal information database every day. When a user becomes sick, the accumulated personal information can be used by a doctor. By submitting the information to, a more appropriate diagnosis can be obtained.

In this case, for example, the personal information management means as the information processing means determines a health condition for each user from the data stored in the personal information database, and writes the determination result to the personal information database. If the diagnostic process is executed periodically, the user can judge his / her own health condition from the result of the diagnosis. In this case, the diagnosis result may be directly delivered to the user by e-mail or the like.

Next, in the system according to claim 8 or claim 9, the personal information for each user in the personal information database can be searched or updated by an individual who is permitted in advance for each user. Is also good.

For this purpose, as described in claim 10, in the personal information management means, a person other than the user who can update or search the personal information registered in the personal information database is associated with the customer information. When a user registered in the customer information database receives a personal information update or search request from a customer registered in the customer information database through the request receiving means, a personal database is created. The information management means refers to the personal information user database, extracts personal information that can be updated or searched by the customer who has made a request for updating or searching for personal information, and updates or searches for the extracted personal information. A search process may be performed.

In other words, in this way, for example, if the personal information stored in the personal information database is information on the user's assets, this can be disclosed to lawyers and tax accountants with whom the user has contracted. The user is entrusted with the management of these assets so that they can check them as necessary. become.

In particular, as described in claim 9, when information indicating the health condition of a user is registered in the personal information database, the personal information is registered as described in claim 11. The doctor or pharmacist specified by the user should be registered in the personal information user database so that the doctor and pharmacist can search and update the information.

In this case, the physician checks the personal information (information indicating the health condition) of each user registered in the personal information database and gives appropriate advice to the user. It also allows doctors to write medical records in a personal information database, making it possible to use medical treatment history and the current state of health of users (patients) at the time of consultation, thereby increasing efficiency. A good and appropriate diagnosis can be made.

In addition, if a pharmacist accesses the personal information database so that the user (patient) can check or write down the medicine being taken at that time, double administration of the medicine by different pharmacists is prevented. be able to. In this case, the physician can monitor how the health condition of the user has changed due to the administration of the drug, and can provide more appropriate medical treatment.

On the other hand, in the information processing system for a wide area network according to the present invention (claims 1 to 11), the user terminal communicating with the request receiving means can be connected to the wide area network. Any terminal device may be used, but if any terminal device can access the request receiving means, the confidentiality of the above-mentioned customer information (or customer information and customer private information) cannot be ensured. It is also possible.

Therefore, in order to further improve the confidentiality of such customer information and the like, an authentication means is provided as described in claim 12, and the authentication means is a user terminal which has requested the service to the request receiving means. Authentication over a wide area network When the information is acquired and the authentication information is for a user who has been registered in advance, communication between the user terminal and the request receiving means may be permitted. That is, in this way, the terminal devices that can access the request receiving means can be limited to only the specific users registered in advance in the authentication means. In this case, only the specific user registered in the authentication means in advance can request the service from the request reception means, so that the confidentiality of the customer information and the like can be improved.

By the way, in the information processing system for a wide area network according to the present invention (claims 1 to 12), the only information to be transmitted together with the service request from the user terminal is the identification information of the user. Since there is no need to send information, users do not need to enter customer information every time they request a service as in the past. Therefore, according to the present invention, data input by the user can be reduced, and the operability of the user terminal can be improved.

However, in the wide area network information processing system of the present invention, in order for the user to enjoy the service, it is necessary to transmit identification information from the user terminal (claims 1 to 11). However, in some cases, it is necessary to transmit authentication information for connection to the request receiving means (claim 12). If the user inputs such identification information and authentication information each time a service is requested, the user is not required to enter the customer information despite the fact that the input of the customer information can be omitted. However, complicated operations are required.

Also, the identification information transmitted from the user terminal is encrypted for security, but if the user inputs the identification information, the identification information must be encrypted at the user terminal. For this purpose, a key for encryption must be stored in the user terminal. If the encryption key is stored in the user terminal in this way, a third party can use the key. This makes it possible to illegally access the system by illegally operating the user terminal, and there is a risk that the encryption key may be stolen by a third party. Therefore, in order to prevent such a problem and to further enhance the security of the system, the user side terminal may be configured as described in claim 13 or claim 14.

That is, the invention according to claim 13 relates to a terminal device used as a user terminal in the information processing system for a wide area network according to any one of claims 1 to 11. A storage medium in which the encrypted identification information is stored can be removably mounted, and further, there is provided information reading means for reading information from the mounted storage medium. Then, when there is a request for identification information from the request accepting means, the terminal device automatically reads out the requested information from the storage medium via the information reading device and sends out the information to the wide area network.

Therefore, according to the terminal device of claim 13, the terminal device is connected to the request receiving means by being used in the information processing system for a wide area network according to any one of claims 1 to 11. When sending a service request, the user does not need to input identification information himself / herself, thereby improving operability. In addition, if the storage medium storing the identification information is stored, the user can prevent unauthorized use by a third party, so that the security can be further improved.

The invention according to claim 14 relates to a terminal device used as a user terminal in the wide area network information processing system according to claim 12, and A storage medium storing user authentication information and identification information for connection can be detachably mounted, and an information reading means for reading each information from the mounted storage medium is provided. Then, the terminal device receives the authentication information from the authentication means or the request receiving means. When there is a request for information or identification information, the requested information is automatically read from the storage medium via the information reading device and transmitted to the wide area network. Therefore, according to the terminal device described in claim 14, by using the information processing system for a wide area network described in claim 12, the terminal device can be connected to the request receiving means, and the service can be provided. The user does not need to input authentication information or identification information when transmitting a request for the user, and operability can be improved. In addition, if the user saves a storage medium storing such information, it can be prevented from being illegally used by a third party, so that the security can be further improved.

When a user uses the system of the present invention, it is necessary to connect a user terminal (terminal device) to a wide area network. The terminal device according to claim 13 or claim 14, further comprising: a storage medium storing the identification information (or the identification information and the authentication information), further storing connection information to the wide area network; If it is configured to automatically connect to a wide area network based on the connection information read from the storage medium, the usability of the user can be further improved.

In addition, if the identification information, authentication information authentication, connection information, etc. are stored in the storage medium as described above, if the user keeps the storage medium, it is impossible to prevent unauthorized use by a third party. Yes, but if the storage medium reaches a third party due to loss, theft, etc., the third party will be able to enjoy unauthorized services using this storage medium.

Therefore, as described in claim 16, in the terminal device according to claims 13 to 15, a password is set in advance in the storage medium, and the terminal device itself is used as the information reading means. When the storage medium is inserted, the user is requested to enter a password, and the password is not set. If they match, it is preferable to prohibit the connection to the request receiving means.

Further, in this case, as described in claim 17, when the terminal device determines that the input password does not match the set password continuously for a predetermined number of times, the storage medium cannot be used. With such a configuration, unauthorized use by a third party can be more reliably prevented.

The operation of determining the password of the storage medium by such a terminal device may be configured to be realized by a program registered in the user terminal in advance, or by storing a password determination program in the storage medium. Alternatively, the terminal device may execute the program to realize the password determination operation.

Further, when the invention according to claim 16 or claim 17 is applied to the terminal device according to claim 14 used in the system according to claim 12, a password is set. The determination as to whether or not they match may be performed not by the terminal device but by the authentication means. That is, the password and the authentication information entered by the user are transmitted from the terminal device side to the authentication means via the wide area network, and the password is registered on the authentication means side together with the authentication information in advance. Alternatively, it may be determined whether or not they match, and the determination result may be transmitted to the user terminal. In the terminal device described in claim 16 or claim 17, the password used to determine whether a terminal device is illegally used by a third party is determined by the request receiving means in the system described in claim 2. Can also be used as a password transmitted from the user terminal to the request receiving means in response to the request.

On the other hand, in order to prevent unauthorized use of the storage medium as described above, fingerprint information of a user is stored in the storage medium in advance, and the storage medium is stored in the information reading means. When installed, the terminal device is The fingerprint of the user is detected through the fingerprint sensor and the fingerprint information stored in the storage medium is used to determine whether the fingerprint of the user matches the fingerprint information registered in the storage medium. However, when there is a mismatch, connection to the request receiving means may be prohibited.

In this case, the user needs to have the fingerprint sensor provided on the terminal device read the fingerprint. However, as described in claim 19, the remote control device for operation provided on the terminal device ( It is convenient to incorporate a fingerprint sensor into the remote control device, since fingerprint input can be easily performed at a position away from the terminal itself.

Note that the determination operation when identifying a user using fingerprint information in this manner may be configured to be realized by a program registered in the terminal device in advance, similarly to the above-described password determination operation. Alternatively, a program for fingerprint determination may be stored in a storage medium, and the terminal device may execute the program to implement the program.

Furthermore, even if a terminal device is provided with a voice recognition device and a microphone (hereinafter referred to as a microphone) for inputting voice to the terminal device to identify a user, it is possible to prevent unauthorized use of a storage medium. Can. In other words, when using the terminal device, a predetermined voice is input from the microphone, and the voice recognition device analyzes the voice signal input from the microphone, and obtains a characteristic such as a voiceprint obtained by the analysis. The user may be recognized from the parameters, and connection to the request receiving means may be permitted.

Next, the storage medium may be a read-only storage medium as long as it can store at least various kinds of information such as user authentication information and identification information. However, more preferably, the information is rewritten or additionally written. It should be a storage medium that can be embedded. That is, in this way, the stored information can be updated, and the usability of the storage medium itself can be improved. You. It is also desirable that the storage medium be in the same form as a cash card, credit card, etc., so that users can easily store it.

For this purpose, the storage medium may be constituted by a general magnetic card. In particular, the amount of information to be rewritten or the amount of information to be written by the above-described program writing is reduced. In many cases, the storage medium may be constituted by an IC card, and the terminal device may be provided with an IC card reader / writer as information reading means.

The terminal device itself is configured by incorporating information reading means, such as an IC card reader / writer, into a general-purpose personal computer having a function of connecting to a wide area network such as the Internet. This function may be realized by a program executed by a personal computer, or may be realized by a dedicated terminal device equipped with information reading means such as an IC card reader / writer. In addition, the function as a terminal device is incorporated into, for example, information devices such as personal computers and mobile phones, home appliances such as video game machines and televisions, and in-vehicle devices such as navigation devices for automobiles. By operating these information devices, home appliances or in-vehicle devices, the system can be used Unishi may be.

Next, according to the invention described in claim 21, in the information processing system for a wide area network according to the present invention (claims 1 to 12) described above, a request is received from a user terminal via a wide area network. The present invention relates to a method for encrypting identification information transmitted to a means.

In this encryption method, first, the identification information before encryption is divided into phrase data composed of characters, symbols, or character strings that constitute the identification information, and a registration created in advance for each phrase data. Encode using phrase replacement sheet After that, the encoded word data is converted into encrypted data of a predetermined data length using random numbers described in a random number sheet created in advance, and the converted encrypted data is arranged in order. Generates encrypted identification information.

That is, in the encryption method according to claim 21, the identification information is encrypted in two steps by using two keys, a registration word replacement sheet and a random number sheet, as the encryption key. As a result, in order to decrypt the encrypted identification information, it is necessary to decrypt in two steps using the two keys (registered word replacement sheet and random number sheet) used for encryption.

Therefore, according to the method of the present invention, in the system of the present invention described above (claims 1 to 12), a third party obtains identification information transmitted from the user terminal to the wide area network. However, it becomes difficult to decipher the identification information, and confidentiality of the identification information can be secured.

In the encryption method according to claim 22, at least one of the two keys (the registered word substitution sheet and the random number sheet) used for encrypting the identification information as described above is used every predetermined period. And the type information representing the type of the key is added to the encrypted identification information.

Therefore, according to the method of the present invention, in the system of the present invention described above (claims 1 to 12), a person who obtains a key (registered phrase replacement sheet and random number sheet) for decrypting identification information is Even if the identification information is obtained from a wide area network, the probability that the identification information can be decrypted using the key is extremely low, and the confidentiality of the identification information can be further improved.

On the other hand, the invention described in claim 23 is the information processing system for a wide area network according to the present invention (claims 1 to 12), wherein the information processing means decrypts the encrypted identification information to obtain the user information. The present invention relates to a decryption method suitable for identifying a password. Then, in this decryption method, first, the encrypted identification information is divided into encrypted data having a predetermined data length, and a random number used when the identification information is encrypted for each encrypted data. Using the random number described in the sheet, the data is converted into encoded phrase data, and the converted phrase data is then converted to the registered phrase replacement sheet used when the identification information was encrypted. The pre-encryption identification information is restored by converting the pre-encryption identification information into phrase data consisting of characters, symbols, or character strings, and arranging the converted phrase data in order.

Therefore, according to the method of the present invention, in the system of the present invention described above (claims 1 to 12), the identification information transmitted from the user terminal to the wide area network is described in claim 21 or claim 22. When the information processing means decrypts the encrypted identification information by using the method of the present invention, the information processing means can encrypt the identification information. You will be able to decode it reliably. BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a block diagram illustrating a schematic configuration of an electronic payment system according to an embodiment.

Fig. 2 is a flowchart showing the control process executed on the user terminal.

FIG. 3 is a flowchart showing a control process executed by the authentication server.

Fig. 4 is a flowchart showing the control processing executed by the system-specific WWW server.

Fig. 5 is a flowchart showing the control process executed by the customer information conversion server. Figures 6A, B, C, and D show the data structure of the registered phrase replacement sheet and random number sheet used for the encryption and decryption of the settlement ID, and the explanation of the encryption and decryption procedures using these. FIG.

FIGS. 7A and 7B are flowcharts showing the procedure for encrypting and decrypting the payment ID.

FIG. 8 is a block diagram showing a configuration of a mail order system (a) to which the electronic payment system of the embodiment is applied.

FIG. 9 is a block diagram showing the configuration of a mail order system (b) to which the electronic payment system of the embodiment is applied.

FIG. 10 is a block diagram illustrating a configuration example of a user terminal including a remote control device for operation.

FIG. 11 is a flowchart showing a process executed by the terminal body and the remote control device to identify the user in the user terminal of FIG. 10 y,

FIG. 12 is a block diagram illustrating a schematic configuration of the electronic payment system according to the second embodiment.

FIG. 13 is a flowchart showing processing executed by each server when performing settlement by a debit card in the electronic settlement system of the second embodiment.

FIG. 14 is a block diagram illustrating a schematic configuration of a health management system according to the third embodiment.

FIG. 15 is a flowchart showing a procedure for registering and browsing personal information executed by the user terminal, the dedicated WWW server, and the customer information conversion server of the third embodiment, and

FIG. 16 is a flowchart showing personal information management processing executed by the personal information management server of the third embodiment. BEST MODE FOR CARRYING OUT THE INVENTION

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[First embodiment]

FIG. 1 is a block diagram showing the configuration of the entire electronic payment system according to the first embodiment to which the present invention (specifically, claims 3 to 7) is applied.

As shown in FIG. 1, the electronic payment system of the present embodiment includes an authentication server 4 connected to the Internet 2 as a wide area network, and a WWW (World Wide Web) server (hereinafter, referred to as a dedicated WWW system). A dedicated WWW server) 6 and a customer information conversion server 30 in a closed network 20 built by banks, credit card companies, and the like.

The authentication server 4 obtains authentication information (hereinafter referred to as an authentication ID) from a user terminal 10 as a terminal device connected to the Internet 2 via an ISP (Internet Service Provider), and obtains the authentication ID. Based on the above, the user who is currently operating this user terminal 10 judges in advance whether or not he / she has been registered as a user of the system, and uses it only when the user is registered. The connection of the user terminal 10 to the dedicated WWW server 6 is permitted, and the connection destination of the user terminal 10 is guided to the dedicated WWW server 6, which corresponds to the authentication means of the present invention.

The dedicated WWW server 6 provides information for business transactions such as online shopping in response to a request from the user terminal 10 to which the connection has been permitted by the authentication server 4, and establishes a connection with the user terminal 10. And performs communication for commercial transactions, and corresponds to the request receiving means of the present invention.

In addition, the dedicated WWW server 6 provides the user with a fee such as a purchase price of the product from the user as a result of communication for business transaction with the user terminal 10. From terminal 10, encrypted identification for payment Information (hereinafter referred to as “payment ID”) is acquired, and the acquired payment I and the fee information indicating the type and amount of the goods or information that the user wants to purchase are closed network via the Internet 2 The customer information conversion server 30 in 20 is transmitted.

Then, based on the result of the transmission of the information, it is determined whether or not the payment was successful according to the result of the payment transmitted from the customer information conversion server 30. If the payment was successful, the delivery of the goods to the user ( If the product is information, send it), and if payment is not possible, stop selling the product to the user.

On the other hand, the closed network 20 to which the customer information conversion server 30 is connected is connected to the Internet 2 via the firewall 24 and the router 22, and the customer information conversion server 30 is a dedicated WWW server 6. When the charge information and the payment ID are transmitted from the Internet 2 via the Internet 2, the user is identified based on the payment ID and the payment processing for debiting the charge from the user's account is executed. That is, the customer information conversion server 30 functions as the information processing means of the present invention.

In addition, the customer information conversion server 30 provides the user with the encryption information (key) necessary to decrypt the encrypted payment ID transmitted from the dedicated WWW server 6 and the decrypted payment ID. Specifically, a customer / encryption information database 32 for acquiring customer information for settlement, such as the user's account number / credit card number, is connected. The customer information conversion server 30 decrypts the payment ID using the customer's encrypted information database 32 and acquires the customer information corresponding to the decrypted payment ID, thereby collecting the fee. Perform payment processing for

In addition, on the closed network 20, other than the firewall 24 and the customer information conversion server 30, an operation management terminal 26 for operating and managing the electronic settlement system of the present embodiment, and various information are printed. For printer 2 8 and Terminal devices for various information processing are connected. The customer information conversion server 30 is connected via a router 34 to a network in which a bank, a credit card company, or the like is building a customer management system 40. 0 performs a user credit check using the credit check database in the customer management system 40.

Next, the user terminal 10 includes input devices such as a keyboard and a mouse, and display devices for displaying information for product purchase and information for various operations provided from the dedicated WWW server 6. Is provided. As a result, by operating the input device in accordance with the screen displayed on the display device, the user can select a purchased item or instruct a purchase (payment) of the selected item.

Further, the user terminal 10 is provided with an IC card reader / writer as information reading means of the present invention. Then, the user terminal 10 is equipped with the IC card 12 storing the above-mentioned authentication ID and settlement ID, or the IC card 12 is mounted on the IC card reader / writer. When the user inputs a connection command to the Internet 2 in this state, it automatically connects to the Internet 2 via the ISP 8 and sends a connection request to the dedicated WWW server 6 to the authentication server 4. .

In addition to the authentication ID and the settlement ID described above, the IC card 12 also stores access information to the ISP 8 to which the user has subscribed (connection information described in claim 7). The terminal 10 reads the access information from the IC card 12 when connecting to the Internet 2, and connects to the ISP 8, and hence the Internet 2, based on this information.

In order to connect the user terminal 10 to the ISP 8, it is necessary to provide a communication means for connecting the user terminal 10 to the ISP 8, but this communication means is generally used. Public telephone network (analog line or digital Communication device (modem, terminal adapter, etc.) for connecting to an ISP using a mobile phone, or a wireless communication device for connecting to an ISP using a wireless phone such as a mobile phone or PHS. It may be a device, or a communication device (so-called cable modem) for connecting to an ISP using CATV. In recent years, ISPs that provide Internet services using communication satellites and ISPs that provide Internet services using dedicated communication lines have also been put into practical use. The user terminal 10 includes a ISP connection communication means, such as a satellite communication device for communicating with a communication satellite via a satellite communication antenna (parabolic antenna, flat antenna, etc.), or an ISP. A dedicated communication device may be provided for performing communication between and via a dedicated communication line. Also, by incorporating or externally attaching an IC card reader / writer to a portable communication device communication terminal such as a mobile phone, the user terminal 10 itself may be configured by a portable communication device such as a mobile phone. Good.

Next, in the electronic payment system according to the present embodiment configured as described above, a flow of a process when a user actually performs internet-shooting will be described.

First, in order for the user to use the electronic settlement system of the present embodiment, the Ic card 12 is attached to the user terminal 10 or the IC card 12 is attached to the user terminal 10. When a connection command to the Internet 2 is input in this state, the user terminal 10 reads the access information to the Internet 2 from the IC card 12 and, based on the read access information, sends the information to the ISP 8 for the Internet 2 Send a connection request to the server (see the dotted arrow (A) in Figure 1).

When the user terminal 10 is connected to the Internet 2 via the ISP 8 by transmitting this connection request, the arrow (B) shown in FIG. Thus, the user terminal 10 sends the authentication ID stored in the IC card 12 to the authentication server 4. Then, based on the authentication ID, the authentication server 4 determines whether the user is a person who has been registered in advance to use the system, and when the user is authenticated by this determination, the user side Terminal 10 is connected to dedicated WWW server 6 via authentication server 4.

When the user terminal 10 is connected to the dedicated WWW server 6 in this way, information for Internet shopping or the like is transmitted from the dedicated WWW server 6 to the user terminal 10 and the user Since the information is displayed on the display device of the terminal 10, the user can select and purchase a desired product by operating the user terminal 10 while watching the display screen. Become like

Also, in this state, the user presses a predetermined purchase decision key on the keyboard or clicks a purchase decision button on the display screen with a mouse to purchase a desired product. When the information indicating the purchase decision is transmitted to the dedicated WWW server 6, the information requesting the settlement ID is transmitted from the dedicated WWW server 6 to the user terminal 10.

Then, the user side terminal 10 reads out the settlement ID from the IC card 12 and transmits it to the dedicated WWW server 6. In addition, when the dedicated WWW server 6 receives the settlement ID, it adds the fee information indicating the type of the product decided to be purchased by the user and the purchase price to the customer, and the customer in the closed network 20 receives the payment ID. Since the information is transmitted to the information conversion server 30, the settlement ID is finally transmitted to the customer information conversion server 30, as shown by the arrow (C) in FIG.

Upon receiving the payment ID, the customer information conversion server 30 decrypts the payment ID using the encryption information in the customer / encryption information database 32. Thus, the user is identified, and the customer / encryption information database 32 is searched to extract the customer information of this user from the customer / encryption information database 32.

When the customer information conversion server 30 can identify the user from the received payment ID and extract the customer information, the customer information conversion server 30 uses the credit investigation database of the customer management system 40 to obtain the user information. A credit check is conducted, and if the user is determined to be able to purchase the product as a result of the credit check, the payment information and the customer information are transmitted to the customer management system 40, whereby the payment for withdrawing the purchase price from the user's account is made. The dedicated WWW server 6 transmits the settlement result to the dedicated WWW server 6, and transfers the settlement result to the user terminal 10.

If the customer information conversion server 30 cannot identify the user by decoding the received payment ID, cannot extract the customer information, or as a result of a credit check, the user purchases the product. If it is determined that the payment cannot be made, information indicating the payment is transmitted to the dedicated WWW server 6 as the payment result, and the dedicated WWW server 6 also transfers the payment result to the user terminal 10. I do.

Next, in order to realize such a data flow (in other words, the operation of the entire system), each of the processes is executed by the user terminal 10, the authentication server 4, the dedicated WWW server 6, and the customer information conversion server 30. The control process performed is described.

First, FIG. 2 is a flowchart showing a control process executed by the user terminal 10.

As shown in FIG. 2, the user terminal 10 determines whether or not the IC card 12 is attached to the IC card reader / writer at S 110 (S represents a step). Wait for IC card 1 and 2 to be installed, When the IC card 12 is inserted, it is determined whether or not a connection command to the Internet 2 is input from the user in S120, and the connection command is input from the user. Wait for. In S120, immediately after it is determined in S110 that the IC card 12 is first mounted, it is determined that a connection command has been input.

If it is determined in step S120 that the user has input a command to connect to the Internet 2, in step S130, the display device is preset to use the IC card 12. A password input screen is displayed, and a password reception process is executed to receive a password input from a user. Then, when the user inputs the password of the IC card 12 according to the display screen, in S140, the entered password is the same as the password registered (stored) in the IC card 12 in advance. It is determined whether or not the passwords match. If the passwords do not match, it is determined that the password has been input incorrectly, and the flow shifts to S150.

In S150, information (date and time, etc.) indicating that a password was erroneously input is written to the IC card 12 in order to be able to judge how many times the password was erroneously input consecutively. From the past information written in the IC card 12, the number of consecutive incorrect inputs is determined, and it is determined whether the number of consecutive incorrect inputs has reached a preset upper limit (for example, seven times). If the number of consecutive erroneous inputs reaches the upper limit value, then, the IC card 12 is written with use prohibition information so that the IC card 12 cannot be used. Then, after this processing is completed, the process returns to S110.

On the other hand, if it is determined in S140 that the password entered by the user and the password registered in the IC card 12 match, the process proceeds to S160 and the IC card 12 Read access information to Internet 2 By transmitting a connection request to the Internet 2 to the ISP 8 according to the read access information, the user terminal 10 is connected to the Internet 2 via the ISP 8.

In step S160, information (date and time, etc.) indicating that connection to the Internet 2 has been written to the IC card 12. As a result, it is possible to accurately determine the continuous number of erroneous inputs from the past information (use history) written in the IC card 12 in S150.

Next, following the processing of S160, when the user terminal 10 concerned is connected to the Internet 2, this time, at S170, the authentication ID is read from the IC card 12 and this is read. To the authentication server 4 on the Internet 2. Then, the authentication server 4 executes an authentication ID determination process for determining whether or not the user terminal 10 can use the system based on the transmitted authentication ID, and the determination result (authentication result) Is transmitted to the user terminal 10. In S 180, the authentication result is received, and the received authentication result is displayed on the display device.

Also, when the authentication result is received in S180, the user terminal 10 is authenticated by the authentication server 4 based on the received authentication result in S190. It is determined whether or not it has been performed. If the authentication server 4 has not been authenticated, connection to the dedicated WWW server 6 cannot be established, so the process shifts to S〗 10 again. Then, shift to S200.

In S200, it is determined whether or not it is necessary to update the authentication data such as the authentication ID and the password of the IC card 12 according to a command from the user or a command from the authentication server 4. If the authentication data needs to be updated, the information for releasing the authentication data write lock of the IC card 12 is acquired from the authentication server 4 in S210, and the information of the IC card 12 is obtained. The authentication data write lock is released, and in S2200, the authentication data in the IC card 12 is replaced with new authentication data input by the user or new authentication data transmitted from the authentication server 4. Performs an overnight update process for rewriting authentication data with authentication data. Further, after executing the authentication data update process, information for authentication data write lock is obtained from the authentication server 4 so that the authentication data in the IC card 12 cannot be rewritten without permission. Set authentication data write lock for IC card 1 and 2 using.

In other words, if the authentication ID and password stored in the IC card 12 can be easily rewritten, unauthorized use of the IC card 12 by a third party cannot be prevented. It can be updated under the monitoring of the authentication server 4 side, so that the authentication data cannot be updated unless the authentication server 4 permits. It is needless to say that a write lock is set for the settlement ID stored in the IC card 12 as well as these authentication data.

Next, in S200, when it is determined that the authentication data does not need to be updated, or when the processing for updating the authentication data in S210 to S230 is executed, The process proceeds to S240, where the user terminal 10 is connected to the dedicated WWW server 6. Note that this connection is automatically performed based on information transmitted from the authentication server 4.

After that, in S250, communication is performed with the dedicated WWW server 6 and another WWW server 7 accessible from the dedicated WWW server 6 (see FIG. 1) in accordance with a command from the user. Perform general internet access processing.

Also, when executing this access processing, the connection to the Internet 2 is cut off or the dedicated WWW server is executed by executing the following processing periodically. Execute processing for product purchase by internet shopping using bar 6.

That is, in S260, it is determined whether or not a command for disconnecting the connection with the Internet 2 (connection disconnection command) has been input by the user. At 20, the connection to the Internet 2 is interrupted, and then the process proceeds to S110.

If it is determined in S260 that the connection disconnection command has not been input, the flow shifts to S270, and the user inputs a purchase command for the desired product during the execution of the Internet access processing. Accordingly, it is determined whether or not a request for a settlement ID has been received from the dedicated WWW server 6. If there is no payment ID request, the process returns to step S250.If there is a payment ID request, the process returns to step S260, and a display for inputting a password for payment is displayed on the display device. Then, it executes a password acceptance process for settlement, which accepts a password input from a user.

Then, when the user inputs the payment password according to the display screen, the process proceeds to S290, where the payment ID is read from the IC card 12, and the read payment ID and the payment password are exchanged. Send to dedicated WWW server 6.

Then, the dedicated WWW server 6 sends the information together with the fee information to the customer information conversion server 30 to cause the customer information conversion server 30 to execute the payment processing, and obtains the payment processing result (payment result). Since it is obtained from the customer information conversion server 30 and transferred to the user terminal 10, in S 300, the settlement result is received and displayed on the display device. When the settlement result is displayed, a selection key for prompting the user to continue or disconnect from the Internet 2 is also displayed.

Then, in S 310, the settlement result is displayed, and the user It is determined whether continuation of connection to the Internet 2 has been commanded or disconnection has been commanded, and if continuation of connection has been commanded, the process returns to S250 again, and conversely, connection disconnection When the command is issued, the connection to the Internet 2 is cut off at S320, and then the process proceeds to S110.

Next, FIG. 3 is a flowchart showing a control process executed by the authentication server 4.

As shown in FIG. 3, the authentication server 4 determines whether or not the user terminal 10 has been connected via the Internet 2 at S 4〗 0 (S represents a step) (in other words, The connection request from the user terminal # 0), and waits for the connection request to be input from the user terminal 10. Then, when there is a connection request from the user terminal # 0, the information indicating that the connection request has been received is transmitted to the user terminal 10 in S420, and thereafter, the user terminal Execute the process of accepting the authentication ID, receiving the authentication ID sent by 10.

When the authentication ID is received in this manner, the process proceeds to S430, and determines whether or not this authentication ID is a user registered in the authentication server 4 in advance. The determination process is executed, and the result of the determination (authentication result) is transmitted to the user terminal 10 at S440. In the subsequent S450, it is determined whether or not the user has been successfully authenticated by the determination processing of S430. If the user is not successfully authenticated, the process returns to S410, and if the authentication is successful, the user is authenticated. Shift to S460.

In S460, it is determined whether or not it is necessary to update the authentication data in the IC card # 2 attached to the user terminal 10 authenticated this time. If the authentication data does not need to be updated, the connection information to the dedicated WWW server 6 is transmitted to the authenticated user terminal 10 in S500, and the user terminal is updated. Allow access to dedicated WWW server 6 from 10 Then, connect the user terminal 10 to the dedicated WWW server 6 and shift to S410 again.

If it is determined in S460 that the authentication data in the IC card 12 needs to be updated, the process proceeds to S470, where the authentication data of the IC card 12 is written. The information for unlocking is transmitted, and in S480, the user terminal 10 is updated with the authentication data, and the authentication data updated by the update processing is sent to the authentication server. The authentication data updating process of the authentication server 4 is executed by a procedure such as writing to the storage device in 4. Then, when the authentication data updating process is completed, in S490, information for relocking the writing of the authentication data is transmitted to the user side terminal 10, and then the process proceeds to S500.

Next, FIG. 4 is a flowchart showing a control process executed by the dedicated WWW server 6. In addition, the dedicated WWW server 6 performs a normal process of performing communication for the Internet terminal 10 with the user terminal 10 in accordance with a request from the user terminal 10 to which the connection is permitted by the authentication server 4. Although the process is executed, the ordinary process is a general process, and thus the description is omitted. In the following description, only the main process according to the present invention will be described.

This control process is a process executed separately from the normal process. As shown in FIG. 4, when the process is started, first, in S530, the user terminal 10 is executed in the normal process. As a result of communication with the user, whether or not the user has transmitted information indicating the purchase decision of the product via the user terminal 10, in other words, whether or not settlement is required for the purchase of the product. Is determined.

If payment is not required, the control process is temporarily terminated. Conversely, if payment is required, the process proceeds to S540, and the user terminal〗 0 that has transmitted the purchase decision is transmitted. Request settlement ID. Then, the user terminal 10 reads the payment ID from the IC card 12 and reads the payment ID. And the payment password entered by the user are transmitted to the dedicated WWW server 6, so that in S550 the following information is received, and in S560 the received data and Then, the settlement data comprising the settlement type information indicating the type of the product decided to be purchased by the user divided by the purchase price is transmitted to the customer information conversion server 30 in the closed network 20.

When the payment data including the received data and the fee information is transmitted to the customer information conversion server 30 in this manner, the customer information conversion server 30 executes a payment process based on the data, and transmits the payment result to the customer data conversion server 30. Since it is sent to the dedicated WWW server 6, the following S570 receives the settlement result, and in S575, the payment is normally completed on the customer information conversion server 30 side based on the received settlement result. It is determined whether or not it was completed.

Then, if the settlement is normally completed, in S580, a product delivery process for delivering the product purchased by the user to the user is executed. Conversely, the customer information conversion server 30 side If the settlement is not successful in step, the transaction is canceled by discarding the authentication information and fee information obtained from the user terminal 10 in step S585. Then, after executing the processing of 358 or 385, the flow shifts to S590, where the settlement result is also transmitted to the user terminal 10, and the processing is temporarily terminated.

Next, FIG. 5 is a flowchart showing a control process executed by the customer information conversion server 30.

As shown in FIG. 5, the customer information conversion server 30 first determines whether or not the payment data transmitted from the dedicated WWW server 6 has been received in S610, thereby obtaining the dedicated WWW server 6. Wait for payment data to be sent from.

Then, when the payment data is received, at S620, the payment ID and password are extracted from the payment data, and at S630, the customer is encrypted. The payment ID is decrypted using the encryption information stored in the information database 32. The procedure for decrypting the payment ID performed in S630 will be described later in detail together with the procedure for encrypting the payment ID.

Next, when the settlement ID is decrypted in S630, this time, in S640, the customer / encryption information database 32 is searched using the decrypted settlement ID and password. By doing so, customer information (account number, credit card number, etc.) that matches both the settlement ID and password is extracted. In other words, the customer / encryption information database 32 stores customer information of users who can use the system in association with the payment ID and password, and in S640, the database is stored in the database. By searching, customer information corresponding to the decrypted payment ID and password is extracted, and in S650, the customer information extracted in S640 and the customer management system 40 are extracted. A credit check of the user is performed using the credit check database on the side, and the process proceeds to S670. If the payment ID cannot be decrypted in S630, or if the customer information that matches the decrypted payment ID and password cannot be extracted in S640, the subsequent processing is executed. Move to S670 without doing this.

Then, in S670, based on the result of the processing in S630 to S650, it is determined whether the user has the ability to pay the purchase price (in other words, is it possible to settle the payment)? Is determined. If payment is possible, the customer information and fee information extracted in S640 are transmitted to the customer management system 40, thereby performing a payment process of debiting the purchase price from the user's account. The process proceeds to S90, and conversely, if it is determined in S670 that settlement is not possible, the process directly proceeds to S690. Then, in S690, the settlement result is transmitted to the dedicated WWW server 6, and the process is temporarily terminated.

Next, the procedure for encrypting the payment ID stored in the IC card 12 and The decryption procedure for decrypting the original payment ID from the payment ID encrypted by the customer information conversion server 30 will be described.

The IC card 12 is created using the operation management terminal 26 in the closed network 20 and distributed to system subscribers. For this reason, the encryption information stored in the customer / encryption information database 32 is used not only for decrypting the payment ID encrypted by the customer information conversion server 30 but also for the operation management terminal 26. It is also used to write the payment ID to the 1C card 12 by encrypting the payment ID using such as.

First, as a key for encryption used for encrypting and decrypting the settlement ID, in this embodiment, a registration word replacement sheet shown in FIG. 6A and a random number sheet shown in FIG. 6B are used. Various types of data sheets are used, and each of these data sheets is stored in the customer / encryption information database 32. As shown in Figure 6A, the registered phrase replacement sheet consists of 10 characters, such as hiragana and romaji, which are used to construct the payment ID, and a word representing the name of the prefecture where the user is located. X〗 Arranged in a table with 6 columns, the combination of the numbers from 0 to 9 assigned to each row and the numbers from 0 to 15 assigned to each column, characters or words in decimal notation It can be converted to a three-digit number.

In other words, for example, according to the registered word replacement sheet of the present embodiment shown in the figure, if the prefecture name forming the settlement ID is "Hokkaido", it will be "01", and the characters forming the settlement ID will be If is "te", it becomes "203".

The registered phrase replacement sheet is updated every predetermined period, for example, on a monthly or weekly basis. When encrypting the payment ID, the latest registered phrase replacement sheet is used. For this reason, each time the registered word replacement sheet used for encryption is updated in the customer / encryption information database 32, the registered word replacement sheet is additionally registered together with information indicating the period of use. Is done.

In other words, the customer / encryption information database 32 stores all the registered phrase replacement sheets used for encrypting the settlement ID. Then, when decrypting the encrypted payment ID, the customer information conversion server 30 derives the registration word replacement sheet used for encryption from the creation date of the payment ID, and reads the registration word replacement sheet. Use to decrypt the payment ID.

—On the other hand, as shown in Fig. 6B, the random number sheet is created by arranging three digits of random numbers from 0 to 15 in total of 16 in order. A plurality of random number sheets are created in advance, and an identification mark representing the type of the random number sheet is added to the head of the random number sheet so that the random number sheet used for encryption can be specified.

The random number sheet used for encrypting the settlement ID is changed every predetermined period, such as monthly or weekly, similarly to the registered phrase replacement sheet. For this reason, an identification code is added to the encrypted payment ID in order to identify the random number sheet used for encryption. When the customer information conversion server 30 decrypts the payment ID, it is added to the payment ID. The random number sheet used for encryption is determined from the identification code, and the settlement ID is decrypted using the random number sheet. Next, FIG. 7A shows the procedure in which the operation management terminal 26 actually encrypts the settlement ID using the two encryption keys (the registered phrase replacement sheet and the random number sheet) configured as described above. The description will be given along the flowchart shown.

As shown in FIG. 7A, when the operation management terminal 26 encrypts the payment ID, first, in S710, the payment ID input processing for capturing the payment ID to be encrypted is executed, and then, At S720, the registered phrase replacement sheet currently set for encryption is read from the customer / encryption information database via the customer information conversion server 30. Then, in S730, the character string constituting the payment ID before encryption is described in the registered phrase replacement sheet. It is divided into word data of prefecture names and characters, and each word data is converted to word data consisting of three-digit numbers using a registered word replacement sheet.

For example, if the payment ID is a character string “Wakayama Nakao j” that represents a user, the payment ID is divided into four word data, “Wakayama”, “na”, “ka”, and “o J”. As shown in FIG. 6C, each of these phrase data is converted into a three-digit numerical value “103”, Γ015J, Γ102, and 0000, respectively. Become.

Next, in S 730, when the settlement 1 D is converted into a plurality of phrase data consisting of a three-digit number, this time, in S 740, which follows, via the customer information conversion server 30 Reads the random number sheet currently set for encryption from the customer / encryption information database.

Then, in S750, the converted phrase data consisting of the three-digit number and the three-digit random number forming the random number sheet are sequentially associated with the settlement ID and the random number sheet from the top, and the random number and the phrase data are obtained. By performing an arithmetic process of subtracting the phrase data from the random number for each digit that constitutes, each phrase data is converted into ID data for registration using the random number.

In other words, for example, as shown in FIG. 6C, if the first phrase data of the payment ID is Γ103, and the first random number of the random number sheet is 232, these data are The ID data of データ 39 J is created by subtracting the word / phrase data from the random number sheet in the direction of decreasing the number of each digit of the digits. If the value of the random number is smaller than the value of the phrase data at the time of subtraction, the value of the phrase data is subtracted from the value obtained by adding 10 to the value of the random number.

Then, as described above, when each word data is converted into ID data for registration in the IC card 12 using a random number sheet, in S760, each ID data is converted into the original ID data. By arranging the words and phrases of the settlement ID in correspondence with each other and by prefixing the identification number of the random number sheet used for encryption, Complete the encrypted payment ID. When the payment ID is actually registered in the IC card 12, the date when the payment ID is encrypted is also registered, and this date information is also handled as a component of the payment ID.

On the other hand, when the customer information conversion server 30 decrypts the encrypted payment ID in this way, the payment ID is decrypted according to the procedure shown in FIG. 7B. That is, as shown in FIG. 7B, the customer information conversion server 30 performs processing (S630) for encrypting the payment ID acquired from the user terminal 10 via the dedicated WWW server 6. At the time of execution, first, in S810, the identification code added to the head of the acquired payment ID is read, and the random number sheet provided with the same identification code is sent to the customer / encryptor. Read from the chemical information database 32.

Then, in S820, the numerical values of each digit constituting the read random number sheet and the numerical values of each digit constituting the settlement ID are sequentially associated with each other from the top, and for each numerical value of each digit, the random number sheet is used. Execute the calculation process to decrease the payment ID. As a result, as shown in Fig. 6D, the numerical data of the first three digits that constitute the payment ID (that is, ID data) is converted to word data before encryption using a random number sheet. .

When the encrypted payment ID is converted into phrase data, the registered phrase replacement sheet used for encrypting the payment ID is specified in S830 from the date of creation of the payment ID acquired this time. Then, this is read from the customer / encryption information database 32.

Finally, in S840, the three-digit numerically empty word / phrase data is converted into a prefectural name or character before conversion using the registered word / phrase replacement sheet, and these are arranged in order from the top. By doing so, the payment ID before encryption is restored. As a result, as shown in Fig. 6C, even if the settlement I "Wakayama Nakao" is converted to the settlement ID "AS424139443859756J" as a result of encryption, As shown in FIG. 6D, the original payment ID before encryption is normally restored by the decryption processing in the customer information conversion server 30.

As described in detail above, in the electronic payment system of the present embodiment, the user inserts his / her own IC card に 2 into the user terminal 10 and inputs a password for using the IC card 12. Then, the user terminal 10 is automatically connected to the dedicated WWW server 6. For this reason, users can enjoy Internet shopping very easily. In addition, when actually purchasing a product through Internet shopping, it is only necessary to indicate the intention (purchase decision input) to that effect and enter the payment password according to the guidance on the display screen. . Therefore, according to the electronic settlement system of the present embodiment, the user does not need to input various kinds of information for settlement as in the related art, and the system is extremely convenient for the user.

On the other hand, in the present embodiment, the only terminal that can access the dedicated WWW server 6 is the user terminal 10 that has been authenticated by the authentication server 4. Therefore, the dedicated WWW server is not available to the server administrator. By preventing unauthorized access in (6), the security of the dedicated WWW server (6) can be secured.

The only payment information that flows on the Internet 2 when the user actually purchases the product is the encrypted payment identification information (settlement ID), and the purchase price is collected from the user. Customer information, such as the account number and credit card number, does not flow on the Internet 2, so leakage of customer information on the Internet 2 can be reliably prevented, and the reliability of the system is improved. it can.

In addition, the above-mentioned two keys (registration word replacement sheet and random number sheet) are used to encrypt the payment ID sent to the Internet 2, and these are updated regularly. Therefore, even if a third party obtains a payment ID on the Internet 2, it cannot be decrypted and misused. is there.

Therefore, according to the electronic settlement system of the present embodiment, a system that can execute business transactions extremely safely for both users and system administrators can be realized.

Next, an example of a mail order system that actually sells goods and various services using the electronic settlement system of the present embodiment will be described.

Figure 8 shows a mail-order sales system in which a sales agent company 70 is entrusted by various sales companies 72 that sell products or provide various services, and performs business transactions with users 74 on behalf of them. (A).

As shown in Fig. 8, in this mail-order sales system (a), since the sales agent company 70 conducts business transactions with the user 74, the dedicated WWW server 6 as a request receiving means and the information processing means The customer information conversion server 30 and the customer / encryption information database 32 are all managed by the sales agent 70.

Then, at the sales agent company 70, when the dedicated WWW server 6 receives the order data and the settlement ID from the user 74, the fee information and the settlement ID corresponding to the order data are transmitted to the customer information conversion server 30. The customer information conversion server 30 restores the customer information of the user 74 from the payment ID, and determines whether the customer information is registered in the customer / encryption information database 32 in advance. Then, it is determined whether or not a fee can be collected from the user 74, and the determination result is transmitted to the dedicated WWW server 6.

Then, based on the determination result from the customer information conversion server 30, the dedicated WWW server 6 checks whether or not the fee can be collected from the user 74, and if the fee can be collected from the user 74, The order data from the user 74 is sent to the sales company 72 (specifically, the order data receiving server of the sales company) corresponding to the order data via the Internet or a dedicated communication line. Notice.

As a result, the goods or services ordered by the user 74 are provided from the sales company 72 to the user 74 directly or via the shipping company 78 or the like.

If the customer information conversion server 30 determines that a fee can be collected from the user 74 based on the settlement ID etc. received from the dedicated WWW server 6, the customer information conversion server 30 Request payments to credit companies and banks).

Then, the financial institution 76 collects the settlement price from the account of the user 74 based on the customer information and the fee information transmitted together with the settlement request from the customer information conversion server 30, and the sales company 72 The transfer procedure to the account is performed, and the payment of the fee from the user 74 to the sales company 72 is automatically completed.

As described above, if the electronic payment system of the present embodiment is used, the sales agent company 70 is a mail-order sales system in which products and services are sold on behalf of a large number of sales companies 72 (a). Can be constructed.

Then, in this mail order system (a), the user registers his or her customer information and uses one settlement ID (one IC card 12 etc.) issued by the sales agency 70. In addition, the sales agent company 70 can purchase desired goods or services from a plurality of sales companies 72 to which the sales agent company 70 is entrusted, and it can be a very convenient mail-order system for users.

In addition, the sales company 72 can perform product sales or service orders simply by outsourcing sales operations to a sales agent company. In other words, although the sales company 72 is obliged to pay a commission to the sales agent company 70, the capital investment required for mail-order sales using the Internet is not required. Follow Thus, this mail order system (a) can be a mail order system that is extremely convenient for sales companies 72 to expand sales channels.

In the mail-order sales system (a) shown in Fig. 8, the sales company 72 outsources to the sales agent company 70, and as shown by the dotted arrow in Fig. 8, the sales agent company 70 It is also possible to collect the payment from the institution 76 or provide goods and services to the users 74. On the other hand, Fig. 9 shows a mail order system (b) in which the sales company 72 communicates with the user 74 for business transactions, and the settlement agency 80 performs settlement. .

As shown in FIG. 9, in this mail-order sales system (b), a WWW server 7 for mail-order sales having a function as a request receiving means is managed by a sales company 72, and a customer information conversion server as an information processing means is provided. 30 and the customer-encryption information database 32 is managed by the payment agency 80.

Then, in the sales company 72, when the WWW server 7 receives the order data and the settlement ID from the user 74, the customer information conversion server 30 of the settlement agent company 80 sends the charge corresponding to the order data to the customer information conversion server 30. By sending the information and the settlement ID, a request is made to determine whether or not a fee can be collected from the user (a settlement determination request).

Then, the customer information conversion server 3 0 of the clearing house 8 0 side restore the customer information of the user 7 4 from the settlement ID, the customer information is pre-registered in the customer-encrypted information database ₃ 2 By judging whether or not the user can collect the fee from the user 74, the judgment result (settlement judgment result) is transmitted to the WWW server 7 of the sales company 72.

Then, based on the determination result from the customer information conversion server 30, the WWW server 7 checks whether a fee can be collected from the user 74, and if a fee can be collected from the user 74, Delivery department of goods in sales company 7 2 Alternatively, the order data is transferred to the service providing department.

If the customer information conversion server 30 determines that a fee can be collected from the user 74 based on the payment ID and the like received from the WWW server 7, the customer information conversion server 30 And banks).

Then, the financial institution 76 collects the settlement price from the account of the user 74 based on the customer information and the fee information transmitted together with the settlement request from the customer information conversion server 30, and the sales company 72 The transfer to the account is performed, and the payment of the fee from the user 74 to the sales company 72 is automatically completed.

As described above, if the electronic payment system according to the present embodiment is used, the sales company 70 directly conducts a commercial transaction with the user, and only performs the processing for collecting the fee (settlement) generated as a result of the commercial transaction. It is also possible to construct a mail order system (b) performed by the agency company 80.

In this mail-order sales system (b), the user registers his / her customer information and uses one payment ID issued by the payment agent 80 to settle the payment agent 80 It is possible to purchase desired goods or services from a plurality of sales companies 72 who request payments to customers, and, like the mail-order sales system (b) shown in Fig. 8, very convenient mail-order sales for users. It can be a system.

Also, in this mail-order sales system (b), the sales company 72 does not need to manage the customer information of the users 74 necessary for settlement, so that the system can be operated easily and 7 4 sell customer information Since the company 72 is not known, the mail order system can be used with confidence.

Note that, in the mail order system (b) shown in FIG. 9, the customer information conversion server 30 of the settlement agency 80 does not necessarily need to make a settlement request directly to the financial institution 76. The third party, which is set up with the financial institution 76, transfers the undecipherable customer information to the sales company 72, and as shown by the dotted arrow in Fig. 9, the sales company 72 A settlement request may be made to this.

Although one embodiment of the present invention has been described above, the present invention is not limited to the above-described embodiment, and various embodiments can be adopted.

For example, in the above embodiment, the authentication server 4 and the dedicated WWW server 6 are described as being configured separately from each other and arranged at an arbitrary position on the Internet 2. In other words, the function as an authentication means) may be incorporated in the dedicated WWW server 6 as a request receiving means.

Also, for example, in the above embodiment, the dedicated WWW server 6 as the request receiving means and the closed network 20 on the financial institution side are described as being connected via the Internet 2. During this time, the connection may be made via a dedicated communication line such as a telephone line.

On the other hand, in the above embodiment, in order to prevent unauthorized use of the IC card 12, a password is registered in the IC card 12, and the IC card 12 is used while the IC card 12 is attached to the IC reader Z writer. When the user terminal 10 connects to the Internet 2, the user is required to enter a password and determine whether the password matches the one registered in the IC card 12. As explained above, it is not necessary to use a password to prevent unauthorized use of the IC card 12; It may be used. In the above embodiment, the user operates the user-side terminal 10 by using the keyboard and the mouse. Remote control device configured to transmit a command signal for operation may be used.

Therefore, next, a description will be given of the user terminal 10 which can be operated using the remote control device and uses the fingerprint information of the user instead of the password in order to prevent unauthorized use of the IC card # 2. I do.

As shown in FIG. 10, the user side terminal 10 includes a terminal body 50 and a remote control device 52. The terminal body 50 includes an IC card reader / writer 50a for reading various information from the IC card 12 and writing information as needed, a communication device 50b for Internet connection, and In addition to a control unit 50c consisting of a CPU, RO, RAM, etc. for executing control processing, a remote control reception for receiving a transmission signal transmitted by modulating light or radio waves from the remote control device 52 Section 50d is provided. Among them, the IC card reader Z writer 50a, the communication device 50b, and the control unit 50c are also provided in the user terminal 10 of the above embodiment.

On the other hand, the remote control device 52 has an operation unit 52 a for the user to input various commands, and modulates light or a radio wave (carrier wave) with a command signal input through the operation unit, and modulates the light. A remote control transmitter 52b for transmitting the subsequent signal to the remote controller receiver 50d of the terminal body 50 is provided, and a fingerprint sensor 52c for capturing a user's fingerprint is provided. . The fingerprint sensor 52 c is for capturing a user's fingerprint as two-dimensional image information, and uses a conventionally known optical, pressure-sensitive, or heat-sensitive fingerprint sensor. be able to. In the control unit 50c of the user terminal 10 configured as described above, immediately after the IC card 12 is mounted on the IC card reader / writer 50a, or the IC card reader Z writer 5 0 When the user operates the remote control device 52 and inputs a connection command to the Internet 2 while the IC card 12 is attached to the terminal a, the terminal body 50 is connected via the communication device 50b. When connecting to the Internet 2 via the Internet, the card user identification process shown in Fig. 11 is executed, and the remote control device 52 sends the fingerprint image according to the command input by the user in conjunction with this process. The processing is executed.

Hereinafter, the card user identification processing and the fingerprint image transmission processing will be described. When the user terminal 10 shown in Fig. 10 is used, in addition to the access information, the authentication ID, and the settlement ID described above, the user's fingerprint information (the fingerprint image of the user is processed by image processing). Then, the IC card 12 in which the characteristic parameters of the generated fingerprint are stored in advance is used.

As shown in Fig. 1 では, in the card user identification process executed by the control unit 50c of the terminal main unit 50, first, in order to capture a fingerprint image of the user, a diagram provided on the terminal main unit 50 is used. A fingerprint input request screen for prompting the user to input a fingerprint is displayed on a display device that does not perform the operation (S910).

Then, the user places a finger whose fingerprint has been registered in advance on the fingerprint sensor 52 c of the remote control device 52, and operates the operation unit 52 a with another finger to issue a fingerprint reading command. In the remote controller 52, the remote controller transmitter 52b reads the fingerprint image of the user from the fingerprint sensor 52c (S915) and transmits the captured image data for transmission. The fingerprint image transmission processing is executed in such a procedure that the fingerprint image is transmitted by converting the signal into a serial data and modulating the transmission signal (light or carrier wave) (S920).

For this reason, the control unit 50c of the terminal body 50 is connected to the display device as described above. After the fingerprint input request screen is displayed, in S930, a reception process for receiving a fingerprint image transmitted from the remote control device 52 to the remote control reception unit 50d is performed. When is received, in S940, the received fingerprint image is subjected to image processing to extract a feature parameter of the user's fingerprint. Then, in S950, fingerprint information (feature parameters) registered in advance is read from the IC card 12, and in S960, the fingerprint information and the characteristics of the fingerprint extracted in S940 are read. Calculate the degree of coincidence with the parameter.

When the degree of coincidence of the fingerprint information is calculated in this manner, the process proceeds to the subsequent step S970, and it is determined whether or not the degree of coincidence is larger than a predetermined determination value. If the degree is greater than the determination value, the user who is currently operating the remote control device 52 determines that the user is the owner of the IC card 12 and permits the connection to the Internet 2 (S98) Conversely, if the degree of coincidence is equal to or less than the judgment value, the user currently operating the remote control device 52 is judged not to be the owner of the IC card 12 and the unauthorized use is prevented. Therefore, the connection to the Internet 2 is prohibited (S990).

As described above, the user terminal 10 shown in FIG. 10 determines whether or not the user has registered a fingerprint in the IC card 12 using the fingerprint information. Therefore, as in the case of using a password to identify the user, not only can the unauthorized use of the 1C card 12 be prevented, but also the unauthorized use can be more reliably prevented. In addition, since the user can input various commands to the user terminal 10 using the remote control device 52, the user inputs commands using the keyboard / mouse connected to the user terminal 10. The operability can be improved as compared with the case of performing the operation.

[Second embodiment]

By the way, in the electronic payment system of the above embodiment (first embodiment), The information conversion server 30 is directly connected to the customer management system 40 of a financial institution such as a bank or a credit card company, and the customer information conversion server 30 makes a payment request directly to the financial institution, thereby increasing the charge. However, for example, an external fee collection system may be used to collect fees.

In other words, for example, in recent years, a debit card system has been put into practical use that allows the purchase of products directly using a bank cash card. When a payment request is received from a financial institution, a debit card payment center is used, which debits the purchase price from the account of the financial institution corresponding to the card and transfers it to the store's account. Therefore, the customer conversion server and the debit card settlement center may be connected by a dedicated line, and charges may be collected through the debit card settlement center. In this case, it is preferable that the user can select whether to use a credit card or a debit card (cash card) when paying the fee.

Therefore, next, as a second embodiment of the present invention, an electronic payment system will be described in which a fee can be collected via a debit card settlement center when a user designates a debit card for payment of a fee. .

FIG. 12 is a block diagram showing the overall configuration of this system. FIG. 13 is a diagram showing a server for configuring a payment system executed when a user uses a debit card at each server constituting the system. This is a flowchart showing the processing procedure.

As shown in FIG. 12, the electronic payment system according to the second embodiment includes a dedicated WWW server 6 and a customer information conversion server in a closed network 20 connected to the Internet 2 via a router or a firewall (not shown). 30, Customer ・ Encryption information database 32 is established, and external debit It comprises a customer information transmission table storage server 60 for transmitting and receiving payment data to and from the credit card settlement center 90 via a dedicated line.

On the other hand, the user terminal 10 is the same as that shown in Fig. 1, but the IC card 12 that can use the debit card payment has the above-mentioned access information, authentication ID, and payment ID in addition to the above. In addition, a debit card payment ID is also stored, and the user terminal 10 reads the debit card payment ID from the IC card 12 when the user wishes to make a payment using the debit card, and It is sent to the closed network 20 side.

That is, in this electronic payment system, when the user decides a desired shopping by communication between the user terminal 10 and the dedicated WWW server 6, the user terminal 10 is debited from the user. It accepts the password for card payment and sends it to the dedicated WWW server 6 (see (1) in Fig. 12). Then, the dedicated WWW server 6 requests the debit card settlement ID from the user terminal 10 (see (1) shown in Fig. 12), and the user terminal 10 According to the request, it reads out the debit card settlement ID from the IC card 12 and sends it to the dedicated WWW server 6 (see ③ shown in Fig. 12).

The communication between the user terminal 10 and the dedicated WWW server 6 ((1), (2), and (3) shown in Fig. 12) is performed via the Internet 2. As in the above-described embodiment, all encrypted data is used.

The above-mentioned debit card settlement ID is set for performing settlement by a debit card, but it is not always necessary to use a debit card settlement ID for this settlement. The payment ID may be used as it is.

Next, the dedicated WWW server 6 executes the debit acquisition from the user terminal 10. The passphrase number and ID for credit card payment are transferred to the customer information conversion server 30 (see (1) in Fig. 12). Then, the customer information conversion server 30 searches the customer / encryption information database 32 using these passwords and IDs, so that the customer / encryption information database 32 is required for debit card settlement. Extract encrypted customer information (encrypted name, account number, password, etc.) (see (1) in Figure 12).

Then, the customer information conversion server 30 decrypts the extracted customer information and returns it to unencrypted customer information. The customer information conversion server 30 converts the customer information and shopping information indicating a fee to be collected from the user into customer information. Transfer to the transmission table storage server 60 (see (1) in Figure 12).

Then, upon receiving the customer information and the shopping information for the debit card settlement from the customer information conversion server 30, the customer information transmission table storage server 60 temporarily stores them in the transmission table, and thereafter, It is sent to the debit card settlement center 90 (see ① shown in Fig. 12).

It should be noted that the customer information transmission table storage server 60 is provided so that the customer information conversion server 30 and the debit card settlement center 90 cannot perform direct data communication (specifically, the customer, the encryption information This is installed in the database 32 (to prevent leakage to the debit card settlement center 90, etc.), but this server 60 can be omitted.

Next, when the customer information and the shopping information are transmitted to the debit card settlement center 90, the debit card settlement center 90 deducts the fee to be collected from the user from the user's bank account and closes. Payment processing is performed by transferring the payment to the account of the company that manages the network 20, and the payment result is transmitted to the customer information transmission table storage server 60 (see (1) in Fig. 12). For this reason, the customer information transmission table storage server 60 transfers the settlement result to the customer information conversion server 30 (see (1) shown in FIG. 12), and the customer information conversion server 30 stores the settlement result. The settlement result is displayed on the user terminal 10 by transmitting it to the user terminal 10 via the dedicated WWW server 6. The notification of the settlement result may be performed by e-mail.

Next, as described above, in order to perform the settlement using the debit card, it is executed in the user terminal 10, the dedicated WWW server 6, the customer information conversion server 30, and the customer information transmission table storage server 60. This process will be described with reference to FIG.

As shown in Fig. 13, when the IC card 12 is inserted into the IC card reader / writer, the user side terminal 10 starts processing on the terminal side. Display password input screen and execute password acceptance process to accept password input from user. Then, when the user inputs a password, it is determined in S1002 whether the input password matches a password registered (stored) in the IC card 12 in advance, If the passwords do not match, it is determined that the password has been erroneously input, the flow shifts to S103, and the same erroneous input count determination processing as in S150 is performed. Move to 10 On the other hand, if it is determined in S1002 that the password entered by the user matches the password registered in the IC card 12, the process proceeds to S1004 and the IC card 1 2 reads the access information to the dedicated WWW server 6 on the Internet 2 and, according to the read access information, directs the user terminal 10 to the dedicated WWW server on the Internet 2 via an unlisted ISP. Connect to 6.

In this embodiment, the authentication server 4 is installed as in the system shown in FIG. Since personal authentication of the IC card 12 is completed, the user terminal 10 is directly connected to the dedicated WWW server 6, but the authentication is performed as in the system shown in Fig. 1. The server 4 may be provided, and after performing personal authentication by the authentication server 4, the user terminal 10 may be connected to the dedicated WWW server 6.

In this way, when the user terminal # 0 is connected to the dedicated WWW server 6, the process moves to S1500 and executes the same internet access processing as in S250 described above. Also, at the time of executing this access processing, it is determined whether or not a request for a settlement method has been received from the dedicated WWW server 6 by periodically executing the processing of S 1660.

In other words, when the dedicated WWW server 6 is accessed from the user terminal 10 as described above, various pages (home pages) are sent to the user terminal 10 according to the request from the user terminal 10. Is executed as a WWW server (S1210). During this process, a product purchase command is input from the user terminal 10 and payment for payment is collected. It is determined whether or not payment is required (S1220). If payment is required, a payment method selection screen is sent to the user terminal 10 so that the payment can be made with a credit card. The settlement method request processing is executed to allow the user to select whether to perform the settlement using a debit card or a debit card (S1230).

For this reason, the user terminal 10 determines in S 1060 whether or not a request for a payment method has been made from the dedicated WWW server 6. Move to 107 0, display the payment method selection screen sent from the dedicated WWW server 6 on the display device, accept the user inputting the payment method on the display screen, and use The payment method selected by the user is transmitted to the dedicated WWW server 6, and payment method acceptance and transmission processing are executed. Thus, the settlement method is sent from the user terminal 10 to the dedicated WWW server 6. Then, the dedicated WWW server 6 determines whether the payment method selected by the user is by a debit card or another card such as a credit card (S1240) ). Then, when the user is requesting the payment by the debit card, the dedicated WWW server 6 requests the user terminal 10 for the password for confirming the payment by the debit card. (S125), after that, the data such as the reciting number transmitted from the user terminal 10 is received, transmitted to the customer information conversion server 30, and transmitted from the customer information conversion server 30. A so-called relay process is executed in which the transmitted data is received and transmitted to the terminal 10 on the user side (S1260).

In the processing of the dedicated WWW server 6, the settlement method selected by the user is determined not to be a debit card but to another card (such as a credit card) in S124. In this case, the payment processing corresponding to the card is performed in the same way as the payment processing in the system shown in Fig. 1, and the user terminal 10 and the customer information conversion server 30 are also used for this dedicated WWW. Performs payment processing corresponding to the processing on the server 6 side. In other words, if the user has not requested the payment using the debit card, the process for directly collecting the fee from the financial institution is performed by the same payment procedure as the system shown in Fig. 1.

Next, the user terminal 10 accepts the payment method from the user at S 1700 and sends it to the dedicated WWW server 6, which requests a password for confirming the payment from the dedicated WWW server 6. Then, in S 1800, in accordance with this request, a screen for inputting a password is displayed on the display device, and the user is prompted to input a password for confirming the payment using a debit card. Then, when the user inputs the password for confirming the payment, the password is encrypted and transmitted to the dedicated WWW server 6. Then, the dedicated WWW server 6 transmits the personal identification number to the customer information conversion server 30 by the above-described relay processing. Thus, when the password for confirming the payment transmitted from the user terminal 10 is input to the customer information conversion server 30 via the dedicated WWW server 6, the customer information conversion server 30 debits the data. Execute the process for credit card settlement.

In this process, first, in S13010, the password for payment confirmation input from the dedicated WWW server 6 is decrypted, and the user to be paid is sent to the electronic payment system in advance. A so-called authentication process is performed to determine whether or not the user is a registered user. In S 1320, it is determined whether or not the user has been authenticated from the personal identification number as a result of the process of S 1310. to decide.

Then, if the user cannot be authenticated in S1320, the process proceeds to S1370, and the settlement result (in this case, information indicating that settlement is impossible) is transmitted via the dedicated WWW server 30. The data is transmitted to the user terminal 10, and if the user is successfully authenticated in S 1320, the process proceeds to S 1330, where the user terminal 10 is debited. Request ID for credit card payment. This request is made via the dedicated WWW server 30.

For this reason, the user terminal 10 sends the payment confirmation password at S 1800, and then debits from the customer information conversion server 30 at S 1900. The request for the card payment ID is accepted, and in accordance with the request, the debit card payment ID is extracted from the IC card 12, encrypted, and transmitted to the dedicated WWW server 6. If the customer information conversion server 30 sends a settlement result indicating that settlement is impossible via the dedicated WWW server 6, the user-side terminal 10 does not execute the processing of S1090. The flow shifts to S110, and the settlement result (settlement impossible) is displayed on the display device. As described above, if the system uses a normal payment ID at the time of debit card payment, the processing of S1330 requests the payment ID, and Processing, the payment ID from the IC card 1 2 It is read, encrypted and transmitted.

Next, the debit card payment ID transmitted from the user terminal 10 to the dedicated www server is transferred to the customer information conversion server 30.

For this reason, the customer information conversion server 30 receives and decodes the debit card settlement ID at S1340, and uses the decoded settlement ID to perform debit card settlement. Client information (encrypted name, account number, password, etc.) is extracted from the customer / encryption information database 32. Then, in S 1 350, the extracted customer information is decrypted and returned to unencrypted customer information, and the customer information and shopping information are transmitted to the customer information transmission table storage server 60. I do.

Then, the customer information transmission table storage server 60 receives the customer information and tribute information transmitted from the customer information conversion server 30 and temporarily stores them in the transmission table (S14). 1 0), followed by connecting to the payment card of the debit card payment center 90 via a dedicated line in S 144, and then storing it in the transmission table in S 144 The settlement request including the customer information and the purchase information is transmitted to the settlement computer of the debit card settlement center 90.

When the settlement request is transmitted to the debit card settlement center 90 in this way, the debit card settlement center 90 executes the above-described settlement processing, and the settlement result is transmitted to the debit card settlement center 90. Since it is transmitted from 0 to the customer information transmission table storage server 60, the customer information transmission table storage server 60 receives the settlement result at S144, and sends it to the customer information conversion server. Send to 30.

For this reason, the customer information conversion server 30 transmits the customer information and the tribute information to the customer information transmission table storage server 60 in S1350, and thereafter, in S1360, Wait for the payment result to be sent from server 60. That is, when the settlement result is received at S1360, the process proceeds to S1300, and the settlement result is transmitted to the user terminal 10 via the dedicated WWW server 6. .

After transmitting the debit card payment ID to the dedicated WWW server 6 at S1090, the user terminal 10 setstle the payment result from the dedicated WWW server 6 at S110. Waiting for the payment to be sent, and receiving the payment result, displays it on the display device.

As described above, when the settlement result is notified to the user by e-mail, in the processing of S144 in the customer information transmission table storage server 60, Instead of transmitting the settlement result to the customer information conversion server 30, the settlement result is transmitted by e-mail to the e-mail address of the user registered in advance, or the customer information conversion server 3 In the processing of S 1370 in 0, instead of transmitting the settlement result to the user terminal 10, the settlement result is transmitted by e-mail to the mail address of the user registered in advance What should I do?

As described above, in the electronic payment system according to the present embodiment, similar to the system shown in FIG. 1, in addition to the payment using a credit card, the payment using a debit card using an external debit card payment center is performed. It can be performed. For this reason, the range of payment methods that can be selected by the user can be expanded, and a sales system that is easy for the user to use can be constructed.

The communication between the user terminal 10 and the dedicated WWW server 6 ((1), (2), and (3) shown in Fig. 12) is performed via the Internet 2, and these communications use encrypted data. In addition, since the customer information (name, account number, password number, etc.) required for settlement does not flow on the Internet 2, the reliability of the system can be ensured in the same manner as the system shown in FIG. In the flowchart of FIG. 13, the customer information conversion server is S 1 At 310, a password for reconciliation confirmation was obtained from the user terminal, and after the user was authenticated using this password, the process for debit card payment was executed. Authentication using this password is not necessarily required.

Further, in the settlement system of the second embodiment, in order to make a payment using a debit card, the customer and the encryption information database 32 installed in the closed network 20 which is the center of the system are debited. The customer information for card settlement is stored, and at the time of debit card settlement, the customer information conversion server 30 reads out the customer information of the user from the customer / encryption information database 32 and contributes to the customer information. Although the information has been described as being transmitted to the debit card settlement center 90 via the customer information transmission table storage server 60, for example, the customer information for debit card settlement that can be used in the system is described. Is registered in the database of the debit card settlement center 90 (or the database for the system is debited). It is installed at the card settlement center 90), and at the time of settlement with a debit card, the customer information conversion server 30 uses the debit card settlement password and ID acquired from the terminal 10 on the user side for debit card settlement. It may be transmitted directly to the credit card settlement center 90 (or via the customer information transmission table storage server 60). In other words, even in this case, the debit card settlement center 90 can acquire the customer information based on the personal identification number and the ID and collect the usage fee from the user's bank account.

[Third embodiment]

Next, in the first embodiment and the second embodiment described above, the electronic settlement system which collects a fee from a user using a wide area network such as the Internet has been described. Processing system According to this, even if a third party obtains information flowing through a wide area network, it is difficult to obtain personal information from the user, and a system with extremely high security can be constructed. By using the system of the present invention, it is also possible to provide various services for managing personal information of users.

For example, in the above embodiment, the main body of the user terminal 10 (in addition to the dedicated terminal, information devices such as personal computers and mobile phones, home appliances such as video game machines and televisions, and in-vehicle devices such as navigation devices for automobiles) Etc.) or a remote control device for remote operation of this, incorporating a vital measurement device for human body (a measuring device for pulse, blood pressure, body fat, oxygen, carbon dioxide, etc.) and measuring with the measuring device The value is converted to data, and transmitted along with the identification information to the system-specific WWW server in an encrypted (for example, 128-bit SSL) format.The server stores the data in the user's health management database, and further stores the data. By regularly checking the health status of each user based on the data obtained, and sending the check results by e-mail, It is possible to provide a service to perform a health check of use person. In other words, if a health management system that provides such a service is realized as a general Internet service, there is a risk that personal information may be leaked, so that users cannot receive the service with peace of mind. If the authentication method and the transmission method of the personal information are used, the security of the system can be ensured, so that the user can use the system with a sense of security. This also leads to prevention, so that services that are easy for users to use and have high added value can be realized. In addition, if the personal data of the user stored in the health management database is provided to the hospital at the time of the user's visit with the consent of the user, the accuracy of the doctor's consultation will be improved. You can also.

In this health management system, it is desirable that the user's personal data stored in the health management database can be freely checked by operating the terminal in addition to sending it by e-mail.

In addition, in the above-mentioned health management system, the health management database is connected to the hospital network of a regional hospital or a medical computer at a private clinic via a communication line, and the health management database is used by each of these medical institutions. If possible, each medical institution can share personal data of users as a common patient data, and each medical institution can provide medical treatment such as receipt data in a health management database. If the history is written and the medical history can be shared by each medical institution, it will also be useful for preventing double administration of drugs and avoiding dangers by swallowing drugs.

In addition, if the IC card used in the above embodiment can be used as a consultation ticket common to a plurality of medical institutions, the user can receive medical examinations at a plurality of medical institutions with one card. User convenience can be improved. In addition, the medical institution can improve the accuracy of diagnosis by sharing personal information for each patient, and can perform highly reliable medical treatment using a highly secure database. It will always be useful.

Therefore, next, as a third embodiment of the present invention, a personal information database for accumulating the personal health state of the user and the medical history at the medical institution as personal information for health management is constructed. In addition, a health management system that allows a doctor at a medical institution authorized by a user to freely access the personal information database and update or search for personal information will be described.

In the following description, Fig. 14 shows the overall health management system. Fig. 15 is a block diagram showing the configuration. Fig. 15 shows the user terminal and the dedicated WWW server 6 and the customer information conversion server 30 that make up this system. FIG. 16 is a flowchart showing a procedure for registering and browsing personal information executed when the personal information is managed. This is a flowchart showing personal information management processing.

As shown in FIG. 14, the health management system according to the present embodiment is installed in a close network 20 connected to the Internet 2 via a firewall (not shown) or a firewall in substantially the same manner as the above embodiments. It has a dedicated WWW server 6, a customer information conversion server 30, a customer information conversion server 30, and a customer / encryption information database 32 that function.

In the closed network 20, the personal information database 64 described above, a personal information management server 62 for managing the database, and personal information stored in the personal information database 64 can be used. There is provided a doctor information database 66 in which information representing doctors is registered, and a doctor viewing dedicated WWW server 68 used for disclosing personal information to doctors. In this embodiment, in addition to the customer information conversion server 30, the personal information management server 62 functions as the personal information management means (in other words, the information processing means) of the present invention. Further, the doctor information database 66 corresponds to the personal information user database of the present invention (claim 11).

— On the user terminal 10, the user's personal health condition (eg, pulse, blood pressure, body fat, oxygen, carbon dioxide, blood flow, blood, hair, nails, oral membrane, oral mucosa, saliva, etc.) At least one of the above) is provided with a vital measuring device 10a, and the data measured by the vital measuring device 10a is stored in the Internet card stored in the IC card 12. Key for connecting to 2 Access information, an authentication ID as authentication information (if an authentication server is installed on the Internet 2), and a connection encryption ID as encrypted identification information). Sent to dedicated WWW server 6.

That is, in this health management system, when a user who is a registrant of personal information measures the current health condition using the vital measurement device 10a, the user terminal # 0 connects to the measurement data. When the user sends a request to view personal information to the user terminal 10, the user terminal 10 becomes the dedicated terminal. A browsing request is transmitted to the WWW server 6 in which the browsing conditions are given a connection encryption ID.

Also, when a doctor at a medical institution that is permitted to view or update personal information inputs a request to view or update personal information to the user terminal 10, the user terminal 10 A request signal is transmitted to the dedicated WWW server 6 in which information representing the individual user of the personal information requested to be browsed or updated is added with a connection encryption ID.

Then, the dedicated WWW server 6 transfers the information transmitted from the user terminal 10 to the customer information conversion server 30, and the customer information conversion server 30 decrypts the connection encryption ID. By determining whether or not the user is registered as a customer in the encrypted information database 32, the user who has transmitted the request this time determines whether or not the user is a customer of the system. , A customer, a customer; customer information stored in the encrypted information database 32 (in this embodiment, information indicating whether a registrant or a physician of personal information; The information indicating the transmission method and transmission destination of the information, the information indicating the hospital to which the doctor belongs, and the contents of the browsing and updating requested by the user are transferred to the personal information management server 62. In addition, from the user terminal 10 When the data of the vital information measuring device 10a is included in the data, the data is also transferred to the personal information management server 62.

When the user who is the registrant of the personal information transmits the measurement data, the personal information management server 62 updates the personal information in the personal information database 64 corresponding to the user. However, when a user who is a registrant of personal information requests browsing of personal information, the personal information for browsing corresponding to the request is extracted from the personal information database 64 and converted to customer information. Based on the customer information obtained from the server 30, the transmission method and the destination of the viewing personal information are specified, and the extracted viewing personal information is transmitted to the user.

For example, if a user wishes to obtain personal information via the dedicated WWW server 6, the user publishes the personal information anonymously on the website provided by the dedicated WWW server 6, and the user sends the information by e-mail. If you wish to obtain personal information for browsing, the personal information for browsing is sent to the e-mail address attached to the customer information, and the user does not use the Internet 2 Communication means (for example, facsimile, telephone If you want to obtain personal information for browsing in, send the personal information for browsing to the user using the desired communication method.

Also, when a doctor who is permitted to view and update personal information transmits a request for personal information, the personal information management server 62 stores personal information of the individual corresponding to the request from the personal information database 64. The information is extracted and transferred to the doctor-viewing-only WWW server 68 together with the doctor's customer information. Then, the doctor-viewing dedicated WWW server 68 connects to the in-hospital network belonging to or operated by the doctor who requested the personal information, and opens a doctor-only homepage that can be viewed only on a computer owned by the doctor. Provide specific personal information to Hereinafter, the processing executed by the user terminal 10 and each server 6.3 0.62 in the closed network 20 to manage the personal information in this manner will be described with reference to FIGS. 15 and 16. Will be explained.

As shown in Fig. 15, when the IC card 12 is inserted in the IC card reader / writer, the user terminal 10 starts processing on the terminal side and displays a password input screen on the display device. Then, a password input process is executed to receive a password input from the user (S210). When the user inputs a password, it is determined whether or not the input password matches a password registered in the IC card 12 in advance (S220), and the password is verified. If not, it is determined that the password has been erroneously input, and the same erroneous input continuation number determination processing as in S150 described above is executed (S230), and the process returns to S210.

On the other hand, if it is determined that the password entered by the user and the password registered in the IC card 12 match, the access information from the IC card 12 to the dedicated WWW server 6 on the Internet 2 According to the read access information, the user terminal 10 is connected to the dedicated WWW server 6 on the Internet 2 via an ISP (not shown) (S204).

In the case of a system in which the authentication server 4 is provided on the Internet 2, the user terminal 10 transmits the authentication ID to the authentication server 4 and performs personal authentication after the authentication server 4 performs personal authentication. The process of S2100 transition is executed.

When the user terminal 10 is connected to the dedicated WWW server 6 in this way, the user terminal 10 executes the same Internet access processing as that in S250 described above (S250). At the time of execution of the Internet access processing, the user operates the vital measuring device 10a or operates the keyboard and mouse. When a request for updating or browsing personal information is input, a connection request to the personal information management server is transmitted to the dedicated WWW server 6 (S2600).

On the other hand, when the dedicated WWW server 6 is accessed from the user terminal 10 as described above, according to the request from the user terminal 10, various pages ( (WWW server) is provided (S2210). During this process, a connection request from the user terminal 10 to the personal information management server was sent. It is determined whether or not the connection has been made (S2120). When the connection request is transmitted, the connection-side cryptographic ID is requested from the user terminal 10 which has transmitted the connection request (S2120). 3 0) ₀

For this reason, the user terminal 10 waits for a request for the connection encryption ID from the dedicated WWW server 6, and when the connection encryption ID is requested, the content of the request from the user to the connection encryption ID. It generates a request signal to which the data has been added (and also to the data if there is measurement data from the vital measuring device 1 O a), and sends this to the dedicated WWW server 6 (S 2700).

Then, the dedicated WWW server 6 receives this request signal and transfers it to the customer information conversion server 30 (S2140). For this reason, the customer information conversion server 30 receives the transferred request signal (connection encryption ID + request) (S2210) and decrypts the received connection encryption ID. Then, the customer information corresponding to the connection encryption ID is extracted from the customer / encryption information database 32 (S2220), and thereafter, it is determined whether the customer information corresponding to the connection encryption ID has been extracted. In other words, the user who has sent the request this time determines whether or not the customer is a registered customer (specifically, a registrant of personal information or a physician authorized to view) (S22) 30) If the user is not a registered user, the processing result indicating that fact is sent to the dedicated WWW server 6. Is transmitted to the user-side terminal 10 via (S2260).

When the customer information conversion server 30 determines that the user who has transmitted the request this time is a registrant of the personal information or a physician permitted to view the information, the information indicating the request from the user and the customer / encryption The customer information acquired from the information database 32 is transmitted to the personal information management server 62 (S224). Then, in accordance with the information, the personal information management server 62 updates the personal information in the personal information database 64 or obtains personal information for browsing from the personal information database 64 according to the personal information management processing ( (See Fig. 16) and sends the processing result to the customer information conversion server 30. Therefore, the customer information conversion server 30 checks that the processing result is transmitted from the personal information management server. When the processing result is received while waiting (S2250), the received processing result is transmitted to the dedicated WWW server 6 (S2250). When the processing result is transferred from the customer information conversion server 30 to the dedicated WWW server 6 in this way, the dedicated WWW server 6 sends the processing result to the user terminal 1 in S2260. The data is converted to data that can be displayed as 0 and transmitted to the user terminal 10. For this reason, after transmitting the request signal to which the connection cryptographic ID has been assigned (S 270), the user side terminal 10 waits for the processing result to be transmitted from the dedicated WWW server 6, and When the processing result is transmitted from the WWW server 6, it is received and displayed on a predetermined display device (S2800).

As a result, the user received the update or browsing of the personal information requested to the dedicated WWW server 6 this time by the customer information conversion server 30 and the personal information management server 62 executed the processing according to the request. Can be checked.

The processing result transmitted to the user terminal 10 in this series of processing is based on whether or not a request from the user has been received. Only the information indicating whether or not the processing was completed according to the above, and the personal information for browsing, etc., was processed by the personal information management server 62 in the method specified by the user in advance by the user. Sent directly to the terminal 10 or the user's information terminal (facsimile machine, telephone, personal computer, etc.).

Next, the personal information management processing executed by the personal information management server 62 in accordance with the request signal (customer information + request) received from the customer information conversion server 30 will be described.

As shown in FIG. 16, the personal information management server 62 first determines in S2310 whether or not the customer information from the customer information conversion server 30 has been received. Then, when the customer information is received, the process proceeds to S230, and the customer who has transmitted the request this time registers the personal information representing his / her own health condition in the personal information database 64 from the customer information. To determine whether the user is a registered user or a physician who is permitted to view from the user who registered personal information (in other words, a physician registered in the physician information database 66). .

Then, if the customer who sent the request this time is a user who has registered personal information, the process proceeds to S2330, and the request from the user is sent to the personal information (ie, the vital measurement device 1). It is determined whether it is update (registration) of the measurement data measured in 0a) or browsing of personal information. If it is registration of personal information, in S2340, the customer information conversion server 3 The measurement data attached to the customer information received from 0 is written as new data in the personal information database 64, and the registration result (written content) is transmitted to the user in S2350. The data is converted to data and transferred to a data transmission server (not shown). As a result, the registration result is transmitted from the data transmission server in the method specified by the user in advance. The transmission of the registration result from the data transmission server is performed by e-mail or facsimile, etc., and is not transmitted directly to the user terminal 10. Therefore, the personal information management server 62 performs the registration processing separately. The result of the processing indicating that is completed is transmitted to the customer information conversion server 30 (S2360).

On the other hand, if it is determined in S230 that the request received from the user this time is a request for browsing personal information, the process proceeds to S230 and the user receives the request. The personal information database 64 is searched according to the request of the user, and the personal information for browsing requested by the user is extracted, and in S2380, the extracted personal information is transmitted to the user. The data is transmitted to a data transmission server (not shown). As a result, the personal information that the user wants to view is transmitted from the data transmission server in a method specified by the user in advance.

As described above, the transmission of personal information from the data transmission server is performed by e-mail or facsimile, and is not directly transmitted to the user terminal 10. Therefore, the personal information management server 62 Separately, a processing result indicating that the transmission processing of the personal information has been completed is transmitted to the customer information conversion server 30 (S2360).

Next, when it is determined in S2320 that the request received from the customer information conversion server 30 this time is a request from a doctor registered in the doctor information database 66, S2339 At 0, the doctor searches the doctor information database 66 to specify the personal information that the doctor is permitted to view, and then at S2400, the specified browsable personal information is converted to the personal information. Extract from database 64.

Then, in S2410, the browsable personal information extracted from the personal information database 64 is transferred to the doctor browsing-only WWW server 68 so that the doctor browsing-only WWW server 68 is transmitted to the doctor browsing-only WWW server 68. Establish a doctor-only website that can only be viewed on a computer owned by the doctor, In subsequent S2360, a processing result indicating that fact is transmitted to customer information conversion server 30, and the processing is temporarily terminated.

Next, if it is determined in S2310 that the customer information has not been received from the customer information conversion server 30, the process proceeds to S2420 and a doctor-only WWW server is provided. From 6.8, it is necessary to update the user's personal information registered in the personal information database 64, for example, by adding a medical history, adding a drug administration history, etc. on the website that was opened to the doctor. Determine if there is.

In other words, the doctor-only WWW server 68 of this embodiment allows the doctor to publish the personal information to the doctor in a form in which the doctor can write the medical history (in other words, the medical record information) and the medication history as the patient's personal information. Therefore, in S240, it is determined whether or not the personal information (medical treatment history, medication history, etc.) has been written by the doctor on the homepage opened to the doctor by the doctor-only WWW server 68. That is to judge.

Then, if it is determined in S224 that personal information does not need to be updated, the process is terminated as it is. Conversely, if it is determined that personal information needs to be updated, S224 Move to 30. In S2430, personal information to be updated is acquired from the doctor-viewing dedicated WWW server 68, and in S2440, the personal information in the personal information database 64 is acquired in accordance with the acquired personal information. Rewrite the information and end the process.

As described above, in the health management system of the present embodiment, the user terminal 10 is provided with the vital measurement device 1 Oa, and the user's health condition (pulse, blood pressure, etc.) measured by the vital measurement device〗 Oa is measured. , Body fat, oxygen, carbon dioxide, blood flow, blood, hair, nails, oral membrane, oral mucosa, saliva, etc.) The history of the data is managed as personal information by the personal information management server 62. If necessary, the personal information can be confirmed by the user or the doctor.

In addition, doctors can add medical history and drug medication history as personal information of patients, so they can obtain all information necessary for treatment and diagnosis of patients using a doctor-only WWW server. Optimal treatment and diagnosis can be performed.

In addition, if the health management system of the present embodiment is used, the patient can periodically check the patient's health condition and write advice for maintaining the health to the medical history etc. to the doctor. By requesting, you can maintain your health without going to the hospital.

In particular, if the patient user permits doctors at multiple medical institutions to view personal information, multiple medical institutions can share the patient's personal health status, medical history, medication history, etc. This will enable medical institutions to perform more advanced medical examinations and treatments for patients. It also helps prevent double administration of drugs and avoids dangers caused by swallowing drugs. In the health management system according to the present embodiment, although such advanced medical treatment can be realized via the Internet, personal information indicating the health condition of the user is transmitted to the outside similarly to the above-described embodiments. There is no leakage, and even if some of the personal information leaks to the outside, the user cannot be identified from the personal information. Can be used with confidence.

In the present embodiment, it has been described that the user's personal information stored in the personal information database 64 can be viewed only by the individual user and the doctor. In addition to the dedicated WWW server 68, a pharmacist browsing dedicated WWW server is installed, and pharmacists who have registered personal information in the personal information database 64 receive permission from pharmacists. When there is a request to browse the medication history to the user, the personal information management server

62 extracts only the medication history from the personal information that the pharmacist is permitted to view from the personal information database 64, and discloses this to the pharmacist via the pharmacist viewing dedicated WWW server. Is also good. In this way, double administration of the drug and the like can be more reliably prevented.

In addition, if the IC card 12 used in this embodiment can be used as a consultation ticket common to a plurality of medical institutions, the user can receive medical examinations and treatments at a plurality of medical institutions with one card. Therefore, user convenience can be improved. In this case, if the user terminal 10 is installed in the examination room of the medical institution, the doctor can use the patient's personal IC card 12 which is a consultation ticket to transfer the patient's personal information. Since it can be obtained, the doctor-only WWW server 68 provided in the close network 20 can be dispensed with.

[Application example]

As described above, the electronic payment system and the health management system have been described as the embodiments of the present invention. However, the present invention is more convenient for users by expanding or changing the system described in each of the above embodiments. A secure system can be built.

Hereinafter, an example of the system will be described as an application example of the present invention.

'Application 1… Prescription system

As described above, in the health management system of the third embodiment, in order to prevent double administration of a drug and to avoid danger by stopping a drug, the IC card used at home is shared by medical institutions. A special terminal (STB 'personal computer · TV) is installed in the consultation room at the hospital where the prescription is used outside the hospital, and automatic authentication is performed by inserting the patient's IC card, and it is stored in the database dedicated to the patient. Connected, doctors check medical history data In addition, in addition to the dedicated WWW server 68 for viewing doctors, a dedicated WWW server connected to dispensing pharmacy terminals in various places is installed in the closed network 20 so that doctors can Using a personal information viewing terminal to transfer a prescription from a doctor-viewing WWW server 68 to a prescription-only WWW server, the prescription-only WWW server transfers to a specific out-of-hospital pharmacy designated by the patient. It is recommended that prescriptions (electronic prescriptions) be sent automatically.

In other words, in this way, the out-of-hospital pharmacy that has received the electronic prescription can start preparing the drug immediately after receiving it, and can quickly deliver the drug to patients who visit thereafter. In this case, a user terminal 10 is installed at the pharmacy window, and a patient visiting the window inserts an IC card that also serves as a consultation ticket into the user terminal 10. If personal authentication is used, the prepared medicine can be surely delivered to the patient.

As a result, medical institutions can avoid erroneous prescriptions of drugs and treatments. In addition, they have shortened the distance between hospitals (doctors) and pharmacists who have become far away from out-of-hospital prescriptions, expanding their communications and prescribing them. All risks can be mitigated by ensuring drug scrutiny and reducing perception gaps, allowing patients to spend less time waiting at hospitals with smoother consultations, Patients can receive prescription medicines immediately after visiting, and patients can withstand the pain and wait for the medicine to be dispensed, despite the traditional symptoms of fever, vomiting and abdominal pain. Eliminating waiting time can reduce mental and physical burdens ■ Application Example 2-Two-way communication between home and hospital

Also, in the health management system of the third embodiment, the patient inserts the IC card 12 into the user terminal 10 installed at home, and the user terminal 1 Connect to the dedicated WWW server 6 and receive personal authentication at the customer information conversion server 30 and then access the dedicated medical institution WWW server installed at the medical institution for information on symptoms, treatment, and drugs. Questions and answers may be made interactive with the physician.

In this way, prescribing medications can be interrupted, and instructions for visiting the hospital can be transmitted from the doctor to the patient. In other words, in this case, the patient can receive appropriate instructions faster than visiting the next day by reporting to the physician any cases where initial treatment is important or any medical condition that requires follow-up. This is very useful.

In addition, doctors will be able to provide the most effective treatment at home for patients who cannot be monitored, thereby providing treatment that is as close as possible to the doctor's treatment policy. This makes it possible to obtain clear answers when there is a problem with the handling and treatment of drugs, and to enjoy efficient medical services in cooperation with doctors without hospitalization. In this case, it would be very convenient for the patient if he / she could make an appointment for the next and subsequent visits.

• Application 3… Care system

In the health management system of the third embodiment, the user inserts the IC card 12 into the user terminal 10 installed at home, connects the user terminal 10 to the dedicated WWW server 6, After receiving personal authentication at the customer information conversion server 30, it may be possible to access the dedicated WWW server installed at the nursing care service center so that personal information of the user can be transmitted.

In this case, in particular, as shown by the dotted line in FIG. 14, the user terminal

A voice input device 10 b incorporating a voice recognition device and a microphone is connected to 10, and the user inputs a predetermined voice from the voice input device 10 b, so that the user terminal 1 0 startup (power on) and dedicated WWW If you can use voice to enter operations such as changing the content menu provided by the server 6 and entering text, you can easily and without disability even for physically challenged and elderly people. Service will be available.

In this case, as described in Application Example 2 above, if two-way communication with a hospital or a nursing care center is enabled, communication between the user and the helper can be performed easily and efficiently. It can be useful for sudden changes in the body and care management on a regular basis, and the health management server can play a major role in long-term treatment and care. This is also ideal because hospitals and nursing service centers can provide guidance on meal menus, lifestyle, and cycles at any time according to the physical condition of the user. It can help maintain a healthy state of national life.

On the other hand, in such a nursing care system, by adding an emergency contact system, an elderly person alone or a family member who needs care when a single person is away from home can automatically trigger an emergency lifesaving request when the health condition changes suddenly. It is very useful to be able to do this. In this case, in particular, by linking with the personal information database for health management of the third embodiment described above, the doctor can analyze data such as vitals immediately before treatment, and quickly and accurately analyze the data. Being able to respond will lead to an increased survival rate.

It should be noted that such a nursing care system can greatly contribute to reducing health risks in human life by introducing it not only to the elderly and those requiring care, but also to ordinary households.

• Application example 4: Needs response system

Next, in the health management system of the third embodiment, the personal information database 64 stores the personal information of the user using the vital measurement device 10a. Although fixed data and medical history at medical institutions are stored, for example, the personal information database 64 stores the user's favorite meal menu, allergic reaction data, house layout, and power drawn into the home. Personal life data of a user, such as a situation, a purchase history of a car or a house, a request history of materials such as a catalog, and the like, may be stored.

In this way, by installing the user terminal 10 at all stores and facilities such as restaurants, pharmacies, furniture, home appliances, and financial institutions, the user can use his or her own IC card 12 when visiting the store. Using personal authentication, the necessary personal life data is extracted from the personal information database 64 and analyzed at the store or facility side, so that the most suitable products can be provided to users. It becomes possible.

In other words, for example, in a restaurant, services such as adjusting the cooking method to the user's preference to the seasoning, the size of the ingredients, the desired firmness, or not using food that the user should not eat in the ingredients. Pharmacies can provide services such as not selling drugs that users should not take.

Also, in furniture and home appliance stores, whether or not the total size of power consumption will not be exceeded by fitting furniture size and design according to the layout of the user's home and adding new home appliances If it exceeds, it can provide services such as giving advice to increase the amount of power supply and applying to the power company.Financial institutions, etc. provide users who are willing to purchase cars and houses By proposing loans and insurance by adding financial planning services, it is possible to provide services that offer products that are more advantageous to users.

By building a system that responds to these needs, store and facility operators can provide users with higher quality services than ever before. This makes it possible to dramatically increase the repeat rate of users. In addition, because more efficient marketing is possible, sales can be increased at a much lower cost than before.

On the other hand, users can enjoy high-quality services more efficiently than ever before and become more convenient, and because they can scrutinize service options more closely to their needs, they spend less time and money on living. Waste can be reduced.

• Application Example 5: Net Identification · Identity Security

On the other hand, according to the present invention, the identification information of the user (the settlement ID and the connection ID in each of the above embodiments) is distinguished from the customer information such as the user's address, name, account number, On a wide area network such as the Internet, by encrypting and transmitting only system-specific identification information (ID), highly secure personal authentication can be achieved. It is also possible to provide an ID service on the Internet.

That is, at present, there are countless WWW servers on the Internet, but by using the customer information conversion server in each of the above embodiments as a personal certificate authority, users of the system of the present invention (in other words, Registrant) can use the system of the present invention to authenticate his / her identity, no matter where he or she visits the WWW server in the world. Users will be able to develop, provide, or use higher value content.

In particular, the service provider can supply products with peace of mind if the user's identity is proved, and also has a number of options, such as credit selling to individuals, which is more advantageous in collecting fees. be able to. In addition, users will be able to obtain IDs, In addition to being able to receive more efficient and secure services over the network, it also has many payment options.

Proof of identity can protect the human rights of users on the network, and both service providers and users can respond to sudden demand for funds on the network. As a result, the network-related market, including the real world, will rapidly expand and contribute to economic development. In addition, it is possible to reduce fraud on networks such as the Internet and promote the development of safe and useful networks.

When a personal certificate authority is constructed using the present invention in this way, by adding insurance to the user's personal authentication, the identity of the user on the network can be guaranteed. become.

• Application example 6: Remote operation

On the other hand, when the user accesses the system of the present invention from outside using a mobile terminal, the user information conversion server 30 performs personal authentication, and then accesses a dedicated terminal at home, in the office, or at a facility. If it is made possible, users will be able to remotely operate various devices at home, in the office, and at facilities using the mobile terminal as a key station.

In other words, in this case, in order to realize a comfortable living environment when returning home, the user must, for example, turn on and off the air conditioner, operate the certificate and the water supply on the go. And it can be done safely. Users can also prepare food and prepare meals on the go, for example, by controlling kitchen utensils.

Further, if the system of the present invention is constructed for such remote operation, a user can control various devices such as a factory line while staying at home, which makes it possible to save time and effort when going to work. Cost, and wasteful heat consumption In addition, it can reduce the probability of encountering an accident or accident with commuting, and is also useful for environmental conservation.

• Application example 7: Content distribution and billing

By the way, if a communication environment such as the Internet is established, a variety of products and services can be sold. In particular, products that are resold by downloading data, etc. The problem is that demand is not accompanied by market development. However, using the system of the present invention can reduce the risk of such rights infringement.

In other words, if the system of the present invention is used, the individual user can be specified using the identification information (ID) sent from the user terminal to the Internet and the customer / encryption information database. Therefore, if you use the system of the present invention to sell products (data) with copyright or usage rights problems, you can prevent unauthorized duplication and resale of data, and you can settle immediately when downloading data. As a result, the rate of fee collection will increase dramatically. In addition, by using the needs response system of Application Example 4 described above, it becomes possible to distribute user-preferred content to each user individually, thereby expanding the market. .

In this case, by adding a download-only storage medium with a copyright protection system to the user terminal, the security against copyright and usage rights can be further improved. In this case, by allowing the user to freely remove and replace the storage medium, the downloaded product can be used on other devices using the storage medium. The convenience for the user can be improved.

• Application example 8: User terminal

As described in Application Example 3, if the user terminal is equipped with a voice input device including a voice recognition device and a microphone phone, the user can input the voice input device. The user terminal can be operated by voice using the input device, but if this voice input device (in other words, a voice recognition system) is used, authentication of the user at the user terminal, Alternatively, user authentication at the customer information conversion server can be performed using voice data.

In other words, the speech recognition device identifies the vocabulary for the operation input by the user by extracting characteristic parameters of the sound input from the microphone and collating it with the voice data of the user registered in advance. If voiceprint data of the user is generated from the feature parameters extracted by the voice recognition device and is used as data for personal authentication, personal authentication can be performed by voice.

When authenticating a user at the customer information conversion server using voiceprint data, the voiceprint data may be encrypted at the user terminal and transmitted over the network. In this case, the encrypted voiceprint data can be used as the identification information (ID described above) of the present invention or can be used as a password to be added to the identification information. In addition, the user terminal should be equipped with a medium slot so that removable storage media such as compact flash, SD card, and memory stick can be used. In other words, this allows the user to store the data acquired on the network in a storage medium and use it freely. In this case, it is preferable to equip a PC card slot of PCMCIA as a medium slot so as to support all kinds of storage media.

If the user terminal is a TV set-top box, and it is configured to take in output signals from a digital video camera or digital camera, convert it to TV video and audio signals, and output it, In addition to image and video data downloaded from the Internet, etc. Moving images and still images shot by these cameras can be played back on home TVs, expanding the use of user terminals.

If the set-top box is equipped with the above-mentioned medium slot, various images reproduced on a television at home can be taken into a desired storage medium, and the image data is attached to an e-mail. Sending the information at a later time makes it easier to do anything, and the value of the user terminal can be further expanded.

In addition, by integrating the user terminal with a cable TV tuner or cable modem, it is possible to eliminate the clutter of home wiring and equipment, and the first and second implementation of cable TV content charging. By using the example of an electronic payment system, it is possible to quickly solve the problem of billing, which has been an issue in CATV systems.

• Application example 9: Education system

Next, according to the present invention, it is possible to realize an information processing system having extremely high security without leaking customer information, and furthermore, it is possible to set information to be provided for each user. It is also possible to implement an educational system for each user, such as distributing educational intellectual text and responding to questions received from users. In other words, the learning history of each user is stored in the personal information database as the personal information of the user, and the educational guidance suitable for the user is provided in accordance with the analysis of the learning history. According to the present invention, after the user is authenticated by the customer information conversion server, the home page to which the user terminal is connected next can be arbitrarily switched. The page can be set as the optimal page for the user analyzed from the learning history of the user (so-called custom connect), and the content connection service from the beginner class to the advanced class can be set for each user. Can be realized automatically by the method. In addition, when the user's level rises, it is not necessary to change the user's IC card ゃ terminal, data such as password and I to change the first access page. A self-contained educational system can be realized.

• Application example 10: Portal site franchise development

Further, in the present invention, since the user information conversion server can specify the individual user and then set the connection destination of the user terminal arbitrarily (custom connection), the portal site (so-called Internet relo- tion) can be used. Can be freely operated on the server side for each user.

If this function is used, portal sites will be set up for each region such as municipalities, portal operators will be recruited for each municipalities, and the present invention will be shared widely in Japan. It will contribute to the information technology in Japan.

If a franchise system is introduced in the development of the regional portal site in order to introduce them more efficiently, policies can be built more efficiently and for each region, and information can be provided without restricting regional information. This will be very convenient for users, and will greatly contribute to the promotion of computerization.

In the above description, the electronic payment system is described in the first and second embodiments, the health management system is described in the third embodiment, and various systems using these are described as independent systems in the applied example. However, according to the present invention, a large-scale information processing system integrating the above-described systems can be easily constructed by using one or a customer information conversion server distributed for each region. Industrial applicability As described above in detail, according to the present invention, in an information processing system that provides services to individual users using a wide area network, it is possible to reliably prevent personal information from being leaked, The effect is that users can use it with peace of mind.

Claims

The scope of the claims

1. A request receiving unit that receives a request for a service that can be provided by the system from a user terminal connected via a wide area network, and a request receiving unit that receives a service request from the user terminal. Information processing means for performing information processing for providing a service to a user who has requested the service;

An information processing system for a wide area network provided with

Upon receiving a service request from the user-side terminal, the request receiving unit acquires, from the user-side terminal, identification information encrypted for identifying a user, and transmits the identification information to the user. Is transmitted to the information processing means together with information representing the service requested by the user,

The information processing means includes a customer information database storing customer information set in advance for each user, and upon receiving user identification information from the request receiving means, decodes the identification information to obtain the customer information database. By comparing with the customer information, it is determined whether the user who has requested the service is a customer registered in advance or not, and if the user is a customer, the customer information registered in the customer information database is added. An information processing system for a wide area network, which performs information processing for realizing the service requested by a user based on the information processing system.

2. The request accepting unit, when acquiring the identification information from the user terminal, requests the user terminal to transmit a password corresponding to the identification information together with the identification information, Transferring the identification information and password transmitted from the user terminal to the information processing means in response to the request;

The user terminal receives the identification information and the password from the request receiving unit. Upon receiving the request for sending a password, the user is requested to input a password corresponding to the identification information, and the password input by the user in response to the request and the encrypted identification information are transmitted. The request is transmitted to the request receiving unit, and the information processing unit compares the identification information and the password transferred from the request receiving unit with the customer information database to determine whether the user is a customer. The information processing system for a wide area network according to claim 1, wherein the information is determined.

3. As the information processing means,

A settlement means for performing a settlement process for collecting a fee from a user based on customer information obtained using the customer information database;

The request receiving means provides information for a commercial transaction that can be realized by the system in accordance with a request from the user terminal, and as a result of the information provision, Receiving the settlement request of the user, the fee information indicating the fee to be collected from the user is transferred to the settlement means together with the identification information acquired from the user side terminal. 2. The information processing system for a wide area network described in 2.

4. When the settlement means determines that the user is a pre-registered customer based on the customer information database, the settlement means connects to an external credit check database to perform a credit check of the user, and performs the credit check. As a result, only when it is determined that the user can be trusted, the user performs the settlement processing based on the customer information. 4. The information processing system for a wide area network according to claim 3, wherein said commercial transaction is stopped.

5. The settlement means transmits the information indicating the user and the collected amount to an external charge collection system that collects a charge from the user's account, thereby performing the settlement processing with the external charge collection system. Characterized by doing via The information processing system for a wide area network according to claim 3 or 4,

6. The information processing system for the wide area network is managed by a sales agency that conducts commercial transactions with users on behalf of various sales companies that perform product sales or various services. ,

The request receiving means notifies the corresponding sales company of the result of the commercial transaction with the user when the settlement means determines that the fee can be collected from the user. An information processing system for a wide area network according to any one of claims 3 to 5.

7. The request receiving means is managed by a sales company that conducts business transactions with users,

The wide area network according to any one of claims 3 to 5, wherein the settlement unit is managed by a settlement agency that performs settlement processing by being commissioned from the sales company. Information processing system.

8. As the information processing means,

A personal information database in which personal information of a user is stored in association with customer information obtained by using the customer information database; and the customer himself / herself registered in the customer information database via the request receiving means. Personal information management means for updating or searching for personal information of the customer himself / herself registered in the personal information database according to the request for registration or search of personal information from

The request receiving unit, upon receiving an update or search request for the personal information from the user side terminal, sends the update or search request for the personal information together with the identification information obtained from the user side terminal, The information processing system for a wide area network according to any one of claims 1 to 7, wherein the information is transferred to personal information management means.

9. The personal information registered in the personal information database is 9. The information processing system for a wide area network according to claim 8, wherein the information indicates a health condition.

10. The personal information management means

A personal information user database in which a person other than the user who can update or search for personal information registered in the personal information database is stored in association with the customer information in addition to the personal information database; When there is a request for updating or searching for personal information of another person from a customer registered in the customer information database via the request receiving means, the personal information user database is referred to to update or search for the personal information. 9. The wide area network information processing system according to claim 8, wherein the requesting customer extracts personal information that can be updated or searched, and performs an update or search process on the extracted personal information.

11. The personal information registered in the personal information database is information representing a health condition of an individual customer, and a registrant in the personal information user database is a doctor or a pharmacist. The information processing system for a wide area network described in 10 above.

1 2. When the authentication information is obtained from the user terminal that has requested the connection to the request receiving means via the wide area network, and the authentication information belongs to a user who has been registered in advance. The wide area network information processing according to any one of claims 1 to 11, further comprising: authentication means for permitting communication between the user terminal and the request reception means. system.

13. A terminal device used as the user terminal in the wide area network information processing system according to any one of claims 1 to 11.

An information reading unit for detachably mounting a storage medium storing the encrypted user identification information, and reading information from the mounted storage medium; With means,

When the identification information is requested from the request receiving means, the information is read from the storage medium via the information reading device and transmitted to the request receiving means via the wide area network. Terminal device to do.

14. A terminal device used as the user side terminal in the information processing system for a wide area network according to claim 12,

A storage medium storing the authentication information and the encrypted identification information, wherein the storage medium can be detachably attached, and information is read from the attached storage medium; and the authentication means or the request receiving means is provided. When the authentication information or identification information is requested from the storage device, the information is read from the storage medium via the information reading device, and transmitted to the authentication means or the request receiving means via the wide area network. A terminal device characterized by the above-mentioned.

15. The storage medium stores connection information to the wide area network in addition to the information, and the terminal device determines the user terminal based on the connection information read from the storage medium. 16. The terminal device according to claim 13, wherein the terminal device is connected to the wide area network.

16. A password is set in the storage medium in advance, and when the storage medium is attached to the information reading means, the user is requested to input a password, and the password is set. The terminal device according to any one of claims 13 to 15, wherein connection to the request receiving means is prohibited when the terminal device does not match the request.

17. The terminal device according to claim 16, wherein the storage medium is disabled when it is determined that the input password does not match the set password continuously for a predetermined number of times.

18. The user's fingerprint information is stored in advance in the storage medium, and the terminal device, when the storage medium is mounted on the information reading means, A fingerprint of the user is detected through a fingerprint sensor provided in the terminal device, and the fingerprint of the user is registered in the storage medium based on the detection result and the fingerprint information stored in the storage medium. The terminal device according to any one of claims 13 to 17, wherein it is determined whether or not the terminal device matches the request, and when the terminal device does not match, connection to the request receiving unit is prohibited.

19. The terminal device according to claim 18, further comprising a remote control device for operation, wherein the fingerprint sensor is incorporated in the remote control device.

20. The storage medium according to any one of claims 13 to 19, wherein the storage medium comprises an IC card, and the terminal device includes an IC card reader / writer as the information reading means. Terminal device.

21. In the information processing system for a wide area network according to any one of claims 1 to 12, the information is transmitted from the user side terminal to the request receiving means via the wide area network. A method of encrypting identification information, in which the identification information before encryption is divided into phrase data consisting of characters, symbols, or character strings constituting the identification information, and a registered phrase created in advance for each phrase data While encoding using the replacement sheet,

The encoded phrase data is converted into encrypted data of a predetermined data length using random numbers described in a random number sheet created in advance for each phrase data, and the converted encrypted data is sequentially arranged. A method for encrypting payment identification information, comprising generating encrypted identification information.

22. At least one of the registered word replacement sheet and the random number sheet is updated every predetermined period, and the encrypted identification information includes a registered word replacement sheet or a random number sheet updated every predetermined period. 22. The method for encrypting settlement identification information according to claim 21, wherein type information indicating a type of the password is added.

23. In the information processing system for a wide area network according to any one of claims 1 to 12, the information processing means may identify the user by decrypting the encrypted identification information. A decryption method used, wherein the encrypted identification information is divided into encrypted data of a predetermined data length, and for each encrypted data, a random number used when encrypting the identification information. Using random numbers described in the sheet, the data is converted into encoded phrase data,

The converted phrase data is further processed by using the registered phrase replacement sheet used when encrypting the identification information, and using the words, symbols, or character strings constituting the identification information before encryption. A decryption method characterized by restoring identification information before encryption by converting the data into data and arranging the converted phrase data in order.