JP4911595B2 - Identification device, identification system and identification method - Google Patents

Description

  The present invention relates to an identity verification apparatus, an identity verification system, and an identity verification method that can be used for auxiliary identity verification of a logged-in user who has been authenticated by a transaction processing system such as Internet banking. .

  In a transaction processing system via the Internet, such as Internet banking, it is common to authenticate a person using an authentication means such as a password, log in to the transaction processing system, and accept a transaction. On top of that, for certain transactions that require special attention against unauthorized use (for Internet banking, such as transfer and increase of usage limit), the transaction is performed using an auxiliary identity verification method that is different from the password. It has been done to increase safety.

  As such an auxiliary identity verification means, for example, it is possible to perform identity verification using a personal identification number used in a cash card. However, since the input information may be stolen by spyware or the like on the Internet, this method cannot ensure sufficient safety.

  In order to avoid damage caused by spyware, it is preferable to use a variable confirmation key for each transaction. For this reason, in Internet banking, a card in which a plurality of confirmation numbers are written is mailed to the principal, and the confirmation number is used for identity confirmation. When accepting a predetermined transaction, it is possible to make the confirmation number variable by randomly requesting one of the confirmation numbers written on the card, which is effective as a countermeasure against spyware.

  Similarly, as a method for issuing a variable confirmation key, there is a method in which an issue machine that issues a one-time password is issued to a user for each transaction and the identity is confirmed by the one-time password. In addition, access to a dedicated institution that issues a confirmation key, a one-time ID (confirmation key) is issued for each transaction on the premise of authentication using an authentication key different from that at the time of transaction, and this is used as a confirmation key at the time of transaction. An invention is disclosed (see Patent Document 1).

JP 2003-323408 A

  In the method of mailing the above card, since it is premised that the postal item surely reaches the person, there remains a problem in terms of safety of delivery. In addition, when the user loses the card, it takes a certain number of days to reissue and mail it, and there is a problem that it is impossible to deal with urgent transactions.

  In the method of issuing a one-time password issuing machine, there is a problem that a user cannot perform a transaction unless he / she carries the issuing machine. In addition, if the issuing machine is broken or lost, it must be reissued, and the same problem as when the card is lost occurs.

  In the method according to the invention described in Patent Document 1, the user must store two authentication keys for transaction and one-time ID issuance. In addition, in order to receive a one-time ID, there is a problem that a burden of performing a special operation is imposed on the user.

  The present invention has been made in order to cope with such a problem, and in a transaction processing system such as Internet banking, a method that takes into account the convenience of the user, a user's auxiliary variable that can be changed for each transaction. An object of the present invention is to provide a personal identification device, a personal identification system, and a personal identification method that can issue a confirmation key used for personal identification.

  In the present invention, a confirmation key for identity verification in a predetermined transaction request via the Internet is generated from transaction history information using predetermined logic. When a user performs a transaction at a transaction terminal such as an ATM, the user obtains the generated confirmation key. Since the user receives a new confirmation key each time an ATM or the like is used, the user can safely acquire a variable confirmation key without performing a special operation for acquiring the confirmation key.

  1st invention which solves the subject concerning this application processes the transaction request from the 1st transaction terminal connected by the exclusive line, and the transaction request from the 2nd transaction terminal which received access via the internet. A transaction processing system capable of performing identity verification for auxiliary transaction with respect to a predetermined transaction request from a user who has logged in with user authentication by accessing from the second transaction terminal, Transaction history storage means for storing transaction history information including transactions executed in accordance with a transaction request received from the first transaction terminal for each user, and a transaction request made by the user from the first transaction terminal or When a request for issuing a confirmation key made from the first transaction terminal is received and a process corresponding to the transaction request or the issue request is normally received, the transaction history storage means stores the request. Confirmation key generating means for generating a confirmation key based on predetermined logic from the history information concerning the user, and a confirmation key for transmitting the confirmation key generated by the confirmation key generation means to the first transaction terminal Upon receiving a predetermined transaction request made from the second transaction terminal by a user who has logged in to the transaction processing system after authenticating the user, a confirmation key input request is transmitted to the second terminal. Upon receipt of the confirmation key input by the user from the confirmation key requesting means and the second transaction terminal, the confirmation key is obtained based on the logic from the history information relating to the user stored in the transaction history storage means. And a confirmation key collating means for collating whether or not the confirmation key received from the second transaction terminal coincides with the confirmation key collating means. If the match, the transaction processing system is a personal identification device, characterized in that stops the reception of the predetermined transaction request.

  In 1st invention, when performing the predetermined transaction via the internet, the confirmation key input by the user is received, and the personal identification is executed by collating with the confirmation key generated again from the history information. In the present invention, a terminal device dedicated to transactions connected to a dedicated line such as ATM in bank transactions is used as the first transaction terminal. A terminal device that can be connected to the Internet, such as a personal computer or a mobile phone, is used as the second transaction terminal. In addition, the personal authentication method used for login from the second transaction terminal is not particularly limited.

  Further, according to the first invention, when the confirmation key matches in the confirmation key collating means and the processing corresponding to the predetermined transaction request is completed, the confirmation key is stored in association with the user as a used confirmation key. A used confirmation key storage means and a confirmation key input by the user from the second transaction terminal, the used confirmation key stored in the used confirmation key storage means is used for the user. A used confirmation key collating unit that reads and collates with the confirmation key received from the second transaction terminal, and when the confirmation key matches in the used confirmation key collating unit, the transaction processing The system may be characterized in that acceptance of the predetermined transaction request is stopped.

  If comprised in this way, since the produced | generated confirmation key can be used only for one transaction, the security of a transaction can be improved by giving a one-time property to a confirmation key.

  A second invention that solves the problem relating to the present application is to process a transaction request from a first transaction terminal connected by a dedicated line and a transaction request from a second transaction terminal that has received access via the Internet. A transaction processing system capable of performing identity verification for auxiliary transaction with respect to a predetermined transaction request from a user who has logged in with user authentication by accessing from the second transaction terminal, Transaction history storage means for storing transaction history information including transactions executed in accordance with a transaction request received from the first transaction terminal for each user, and a transaction request made by the user from the first transaction terminal or When a request for issuing a confirmation key made from the first transaction terminal is received and a process corresponding to the transaction request or the issue request is normally received, the transaction history storage means stores the request. Confirmation key generating means for generating a confirmation key based on a predetermined logic from the history information concerning the user, and a confirmation key storage for storing the confirmation key generated by the confirmation key generation means in association with the user Means, a confirmation key transmitting means for transmitting the confirmation key generated by the confirmation key generating means to the first transaction terminal, and a user who has logged in to the transaction processing system upon authenticating the second transaction. When receiving a predetermined transaction request made from a terminal, receiving a confirmation key requesting means for transmitting a confirmation key input request to the second terminal, and a confirmation key input by the user from the second transaction terminal A confirmation key collation for reading the confirmation key for the user stored in the confirmation key storage means and collating with the confirmation key received from the second transaction terminal Comprise a stage, and the confirmation key is a mismatch in the confirmation key verification means, the transaction processing system is a personal identification device, characterized in that stops the reception of the predetermined transaction request.

  In the second invention, the confirmation key generated from the history information is stored in the account master or the like, and the identity confirmation is executed by collating with the confirmation key input by the user at the time of a predetermined transaction. The first transaction terminal uses a transaction-dedicated terminal device connected to a dedicated line such as ATM, and the second transaction terminal has a terminal device that can be connected to the Internet, such as a personal computer or a mobile phone. It is the same as that of the 1st invention that it is used and the personal authentication method used for the login from the 2nd transaction terminal is not specifically limited.

  According to a second aspect of the present invention, there is provided a confirmation key deletion that deletes the confirmation key stored in the confirmation key storage means when the confirmation key matches in the confirmation key collating means and the processing corresponding to the predetermined transaction request is completed. And when the confirmation key collating means confirms that the confirmation key for the user is not stored in the confirmation key storage means, the transaction processing system accepts the predetermined transaction request. It can also be characterized by canceling.

  If comprised in this way, since the produced | generated confirmation key can be used only for one transaction, the security of a transaction can be improved by giving a one-time property to a confirmation key.

  Furthermore, the first invention and the second invention are used to indicate that the confirmation key is used when the confirmation key matches in the confirmation key collating means and the processing corresponding to the predetermined transaction request is completed. A used flag storage means for storing a completed flag in association with the user; and upon receipt of the confirmation key input by the user from the second transaction terminal, the user is placed in the used confirmation key storage means. A used flag checking means for checking whether a used flag is stored, and when the used flag checking means confirms that the used flag is stored, the transaction processing system The reception of the predetermined transaction request may be stopped.

  If comprised in this way, since the produced | generated confirmation key can be used only for one transaction, the security of a transaction can be improved by giving a one-time property to a confirmation key.

  The present invention can also be configured as a personal identification system including the personal identification device according to the present invention and the first transaction terminal.

  That is, the identity verification system corresponding to the first invention includes a first transaction terminal connected by a dedicated line, a transaction request from the first transaction terminal, and a second transaction that receives access via the Internet. Auxiliary principal for a predetermined transaction request from a user who has logged in with access from the second transaction terminal and received authentication, provided in a transaction processing system capable of processing transaction requests from the terminal An identity verification system comprising an identity verification device for confirming, wherein the identity verification device stores transaction history information including transactions executed in accordance with a transaction request received from the first transaction terminal for each user. Receiving a transaction request made by the user from the first transaction terminal or a confirmation key issuance request made from the first transaction terminal, and When the process according to the request or the issue request is normally accepted, a confirmation key generating means for generating a confirmation key based on a predetermined logic from history information concerning the user stored in the transaction history storage means, Confirmation key transmission means for transmitting the confirmation key generated by the confirmation key generation means to the first transaction terminal, and a user who has logged in to the transaction processing system after authenticating the user has performed from the second transaction terminal. Upon receipt of a predetermined transaction request, confirmation key request means for transmitting a confirmation key input request to the second terminal, and upon receipt of the confirmation key input by the user from the second transaction terminal, the transaction history A confirmation key is generated based on the logic from the history information concerning the user stored in the storage means, and whether it matches the confirmation key received from the second transaction terminal Confirmation key collating means for matching, the first transaction terminal includes a confirmation key receiving means for receiving the confirmation key transmitted by the confirmation key transmitting means, and a confirmation key received by the confirmation key receiving means. Confirmation key output means for executing at least one of outputting to a form or display of the data or writing the confirmation key to a storage medium used by the user. If the keys do not match, the transaction processing system stops accepting the predetermined transaction request.

  The identity verification system corresponding to the second invention includes a first transaction terminal connected by a dedicated line, a transaction request from the first transaction terminal, and a second transaction terminal that receives access via the Internet. A supplementary identity verification for a predetermined transaction request from a user who has been logged in with access from the second transaction terminal, provided with a transaction processing system capable of processing a transaction request of An identity verification system comprising an identity verification device to perform, wherein the identity verification device stores transaction history information including transactions executed in accordance with a transaction request received from the first transaction terminal for each user. Receiving a transaction request made by the user from the first transaction terminal or a request for issuing a confirmation key made by the first transaction terminal; A confirmation key generating means for generating a confirmation key based on a predetermined logic from the history information for the user stored in the transaction history storage means when the process according to the issue request is normally accepted; and the confirmation key Confirmation key storage means for storing the confirmation key generated by the generation means in association with the user; confirmation key transmission means for transmitting the confirmation key generated by the confirmation key generation means to the first transaction terminal; Confirmation key requesting means for transmitting a confirmation key input request to the second terminal when a user who has logged in to the transaction processing system receives a predetermined transaction request from the second transaction terminal. And receiving the confirmation key entered by the user from the second transaction terminal, reading the confirmation key for the user stored in the confirmation key storage means, And a confirmation key collating means for collating whether the confirmation key received from the second transaction terminal is the same, and the first transaction terminal receives the confirmation key transmitted by the confirmation key transmitting means. Confirmation key receiving means and confirmation key output for executing at least one of outputting the confirmation key received by the confirmation key receiving means to a form or display, or writing the confirmation key to a storage medium used by the user And the transaction processing system stops accepting the predetermined transaction request when the confirmation key does not match in the confirmation key collating means.

  In addition, the identity verification device included in the identity verification system according to the present invention may correspond to each configuration of the identity verification device described above.

  This invention can also be specified as the identity verification method performed by the identity verification apparatus concerning this invention, a 1st transaction terminal, and a 2nd transaction terminal.

  That is, the identity verification method corresponding to the first invention includes a first transaction terminal connected by a dedicated line, a second transaction terminal connectable to the Internet, a transaction request from the first transaction terminal, and Accessed from the second transaction terminal provided in the transaction processing system capable of processing a transaction request from the second transaction terminal that received access via the Internet, and logged in after authentication. An identity verification method executed by an identity verification device that performs auxiliary identity verification for a predetermined transaction request from a user, wherein the identity verification device includes a transaction request received from the first transaction terminal. A transaction history storage unit that stores transaction history information including executed transactions for each user is provided, and the identity verification device is operated by the user from the first transaction terminal. When the transaction request or the issuance request for the confirmation key made from the first transaction terminal is received and the processing according to the transaction request or the issuance request is normally accepted, the transaction history storage unit stores the A confirmation key generation step for generating a confirmation key based on a predetermined logic from history information concerning the user, and the identity verification device sends the confirmation key generated in the confirmation key generation step to the first transaction terminal. A confirmation key transmitting step for transmitting, a confirmation key receiving step for the first transaction terminal to receive the confirmation key transmitted in the confirmation key transmitting step, and a first transaction terminal for the confirmation key receiving step. Execute at least one of outputting the received confirmation key to a form or display, or writing the confirmation key to a storage medium used by the user. When the authentication key output step and the identity verification device receive a predetermined transaction request made from the second transaction terminal by a user who has logged in to the transaction processing system and has been authenticated, the second terminal A confirmation key request step for transmitting an input request for a confirmation key; and a confirmation that the second transaction terminal receives the input request transmitted in the confirmation key request step and the user inputs in response to the input request A confirmation key receiving step for receiving a key; a second confirmation key transmitting step in which the second transaction terminal transmits the confirmation key received in the confirmation key receiving step to the identity verification device; and the identity verification device, When the confirmation key transmitted in the second confirmation key transmission step is received, the history information concerning the user stored in the transaction history storage unit is transferred to the logic. And a confirmation key collating step for generating a confirmation key on the basis of the confirmation key collating with the confirmation key transmitted in the second confirmation key transmitting step. In the identity verification method, the transaction processing system stops accepting the predetermined transaction request when there is a mismatch.

  The identity verification method corresponding to the second invention includes a first transaction terminal connected by a dedicated line, a second transaction terminal connectable to the Internet, a transaction request from the first transaction terminal, and the Internet. A user who has been logged in after receiving authentication from the second transaction terminal provided in the transaction processing system capable of processing a transaction request from the second transaction terminal that has received access via The identity verification method is executed by the identity verification device that performs auxiliary identity verification for a predetermined transaction request from the identity verification device, which is executed in accordance with the transaction request received from the first transaction terminal. A transaction history storage unit that stores transaction history information including transactions for each user is provided, and the identity verification device performs a transaction performed by the user from the first transaction terminal. The user stored in the transaction history storage unit when receiving the request or issuing the confirmation key issuing request made from the first transaction terminal and receiving the processing according to the transaction request or the issuing request normally A confirmation key generating step for generating a confirmation key from the history information on the basis of a predetermined logic, and a confirmation in which the identity verification device stores the confirmation key generated in the confirmation key generation step in association with the user. A key storage step, a confirmation key transmission step in which the identity verification device transmits the confirmation key generated in the confirmation key generation step to the first transaction terminal, and the first transaction terminal includes the confirmation key. A confirmation key receiving step for receiving the confirmation key transmitted in the transmission step; and a confirmation key form received by the first transaction terminal in the confirmation key receiving step. A confirmation key output step of executing at least one of output to a display or writing of the confirmation key to a storage medium used by the user, and the identity verification device receives authentication of the transaction processing system. When the logged-in user receives a predetermined transaction request made from the second transaction terminal, a confirmation key request step of transmitting a confirmation key input request to the second terminal, and the second transaction terminal Receiving the input request transmitted in the confirmation key request step and receiving a confirmation key input by the user in response to the input request; and the second transaction terminal accepting the confirmation key A second confirmation key transmission step of transmitting the confirmation key received in the step to the identity verification device; and the identity verification device includes the second confirmation key transmission step. Upon receipt of the confirmation key transmitted in the step, the confirmation key for the user stored in the confirmation key storage step is read out, and it is verified whether it matches the confirmation key transmitted in the second confirmation key transmission step. A verification key verification step, wherein the transaction processing system stops accepting the predetermined transaction request when the verification key does not match in the verification key verification step. It is.

  In addition, the identity verification device used in the identity verification method according to the present invention may correspond to each configuration of the identity verification device mentioned above.

  According to the present invention, a user of a transaction processing system such as Internet banking uses a dedicated terminal such as an ATM as a confirmation key used for auxiliary identification when executing a transaction requiring high security. Since it can be received every time, a variable confirmation key can be obtained safely without performing a special operation for obtaining the confirmation key. By revoking the confirmation key once used for the transaction, it becomes possible to increase the security of the transaction by providing the confirmation key with a one-time property.

  The best mode for carrying out the present invention will be described below in detail with reference to the drawings. In the following description, an example in which the identity verification apparatus according to the present invention is used in an Internet banking system will be described. However, application to the Internet banking system is an example of an embodiment of the present invention, and the present invention is an embodiment of the present invention. It is not limited to.

  FIG. 1 and FIG. 2 are diagrams showing first and second examples of the overall configuration of the personal authentication system according to the present invention, respectively. 3-5 is a figure which shows the 1st-3rd example of the account master in the personal authentication system concerning this invention, respectively. FIG. 6 is a diagram showing an example of history information in the personal authentication system according to the present invention. FIG. 7 is a diagram showing an example of a user master of the net banking server in the personal authentication system according to the present invention. FIG. 8 is a flowchart showing a flow of issuing a security key in the personal authentication system according to the present invention. FIG. 9 is a flowchart showing a flow of auxiliary identity verification using a security key in the identity authentication system according to the present invention.

  The configuration of the personal authentication system according to the present invention will be described with reference to FIG. In FIG. 1, a host computer 10 which is a transaction processing system of a bank is connected to an ATM 40 which is a transaction dedicated terminal by a dedicated line. The host computer 10 is provided with an account file 20 for each deposit account, and the account file 20 stores an account master 21 that is basic information of the deposit account and a transaction history 22 performed in the deposit account. ing. Further, when a user conducts a transaction via the Internet, the user operates the PC 50 to connect to the Internet and access the net banking server 30. The net banking server 30 is connected to the host computer 10, authenticates the user with reference to the user master 31, and issues a transaction instruction to the host computer 10 in accordance with the request received from the PC 50.

  When a user who has a deposit account at a bank performs transactions such as deposits and withdrawals and transfers using a cash card or the like at the ATM 40, the host computer 10 that has executed these processes has a transaction history 22 in the account file 20 of the user. The history information of the executed transaction is written in In addition, the transaction history 22 of the account file 20 was performed using a deposit account, including transactions performed from the PC 50 via the net banking server 30 and transactions performed by other means such as fax. All transactions are recorded as shown in the example of FIG.

  In the present invention, when the user performs a transaction such as deposit / withdrawal using the ATM 40, the security key calculation logic 11 is read out by the host computer 10 to assist in the transaction via the net banking server 30. A security key used for identity verification is generated. The security key is performed by arithmetic processing based on a predetermined logic using history information recorded in the transaction history 22 of the account file 20.

  The logic for generating the security key is not particularly limited. For example, the usage date and time, the usage amount, and the transaction recorded in the history information, for example, immediately before (or several times before or several times can be averaged) By calculating using the type, the machine number used, etc., a variable security key can be issued each time a transaction is made by the ATM 40. The history information used for generating the security key is not limited to the transaction history by ATM, but may be a transaction history made by Internet banking.

  The security key may be generated by a random number, but the design required for the currently used host computer or ATM by applying predetermined logic using the data recorded in the transaction history. In addition to being able to suppress changes, it is possible to reduce the burden of system processing for generating random numbers, and to save system resources used for storing random numbers when random numbers are generated. For security key calculation, it is preferable from the viewpoint of safety to use information that is not displayed at the time of ATM transaction, such as the use date and time including the second and the ATM machine number used.

  The security key issued for each transaction is transmitted to the ATM 40 and received by the user. The method by which the user receives the security key is not particularly limited, but it is a data writable IC that is printed on the transaction slip, bankbook details and cash card surface, and displayed on the ATM 40 display. When a cash card is used, a method of storing it as electronic data in an IC chip of the cash card can be considered. The security key issuance is not limited to transactions such as deposits and withdrawals, and a new security key can be issued upon receipt of a security key issuance request made by the user at ATM 40. May be.

  The security key received by the user is used as a confirmation key for auxiliary identity verification when the user performs a transaction via the net banking server 30. When the user accesses the net banking server 30 using the PC 50, personal authentication is performed using a user ID and a password, and the user logs in to the net banking server 30. After the login, necessary data is transferred between the net banking server 30 and the host computer 10, and a general transaction such as balance confirmation can be executed as it is.

  The personal authentication method for logging in to the net banking server 30 is not particularly limited. In addition to the authentication method using a password, biometric authentication, voice authentication, and one-time password issuing machine are used. Various authentication methods such as authentication can be used. Information related to the user necessary for the personal authentication is stored in the user master 31 of the net banking server 30. When logging in, the information input by the user and the information stored in the user master 31 are collated. Identity authentication is performed.

  After logging in, the security key, which is an auxiliary confirmation means, was used to accept important transactions that require particularly high levels of security, such as transfers or changes to the credit limit. Identity verification is performed. Therefore, when a predetermined transaction request is accepted, a security key input request is transmitted from the net banking server 30 to the PC 50. For example, a security key input field is provided on the screen on which the user transmits a transfer request for the net banking server 30 from the PC 50.

  When the input of the security key is requested, the user inputs the security key received when the ATM 40 was previously operated. If the security key is printed on a statement slip or the like, the printed security key is input to the PC 50 using a keyboard or the like. If the security key has been written to the IC cash card, the security key is read using the reader of the IC chip.

  When the security key input by the user is transmitted from the PC 50 to the net banking server 30, the security key is collated in the net banking server 30 or the host computer 10 that has received the security key. There are several variations of the security key verification method.

  The first method for verifying the security key is to use the history information recorded in the transaction history 22 of the user's account file 20 and the security key calculation logic 11 to use the regular security key issued to the user. Is calculated again and collated with the received security key. In the case of this method, it is not necessary to store the security key issued to the account master 21 or the user master 31, so that system resources can be saved. For the security key verification, for example, a regular security key calculated by the host computer 10 may be transferred to the network banking server 30 and verified by the network banking server 30, but the network banking server 30 and the host computer 10 may be verified. Processing sharing is not particularly limited.

  The security key used here preferably has a one-time property that is used for each transaction in order to increase the safety of the transaction. Therefore, for example, as shown in FIG. 3, the used security key used in the most recent transaction is recorded in the account master 21, and the security key received by the net banking server 30 is recorded here. If it is set so as not to accept a transaction when it is the same as the already-completed security key, the security key is effective only once and a one-time property can be realized. In this case, every time the transaction using the security key is normally completed, the security key used in the transaction is recorded in the account master 21 as the used security key.

  Further, as shown in FIG. 4, a field for recording a flag indicating the validity of the security key is provided in the account master 21, and when a new security key is issued, a validity flag is set and the security key is set. If the transaction using the URL is successfully completed and the flag is updated to an invalid flag, when the net banking server 30 receives the security key, if the flag is an invalid flag, the transaction is set not to be accepted. As a result, the security key is effective only once, and a one-time property can be realized.

  The second method for verifying the security key is a method in which the regular security key issued immediately before is recorded also on the host computer 10 or the net banking server 30 side and verified with the received security key. . In the case of this method, the regular security key is stored in the user's account master 21 or user master 31.

  FIG. 5 shows an example in which a regular security key is recorded in the account master 21 of the account file 20. In this case, the security key verification may be performed by either the net banking server 30 or the host computer 10. Further, the regular security key may have an expiration date such as one month from the issuance and may be stored together. Normally, ATMs are often used about once a month due to salary dates, etc., so it is preferable to set an expiration date of about one month.

  When an expiration date is set, the expiration date is confirmed at the time of collating the security key. When the expiration date has passed, the acceptance of the transaction is stopped. Note that the expiration date of the security key can also be set as part of the logic in the first method.

  FIG. 7 shows an example in which a regular security key is recorded in the user master 31 of the net banking server 30. In this case, verification of the security key is performed in the net banking server 30. Here, as in the above case, an expiration date may be provided and stored together.

  In the second method, when it is desired to provide the security key with a one-time property, when the regular security key stored in the account master 21 or the user master 31 is used in the transaction, the used security key is changed. Delete it. After that, even if the net banking server 30 receives the transaction request and the security key entered by the user from the same user, the requested transaction is accepted because there is no regular security key to be verified. I can't.

  In the second method, as in the first method, the validity flag shown in the example of FIG. 4 is used to set a validity flag when a new security key is issued. When the key is used, it is updated to an invalid flag, and when the net banking server 30 receives the security key, if this flag is an invalid flag, a setting is made so as not to accept a transaction. Can be realized.

  In the case where the security key is realized by one of the methods described above, if the security key is invalid and a transaction request is not accepted, the user performs some transaction at the ATM 40. A new security key must be issued. In the case where there is no transaction to be performed at the ATM 40, it is preferable that the ATM 40 has a transaction menu for issuing a security key. In order to conduct a transaction at the ATM 40, a cash card or a passbook that the user himself / herself should have is necessary, so that the security key can be surely notified to the user himself / herself.

  FIG. 2 shows an embodiment of the present invention when a user makes a transaction using the mobile phone 60 with a cash card. When the user makes a transaction using the cash card mobile phone 60 in the ATM 40, the security key transmitted from the host computer 10 is written from the ATM 40 to a predetermined memory area of the cash card mobile phone 60.

  When a user accesses the net banking server 30 from the mobile phone 60 with a cash card and logs in, and then makes a predetermined transaction request, input of a security key is required. Here, for example, when a predetermined button is pressed, the security key is set to be read from the predetermined memory area, or the security key is automatically acquired from the predetermined memory area in the case of a transaction requiring the security key. It is possible to transmit the security key received by the ATM 40 to the net banking server 30 by setting as described above.

  The security key issuance flow in the personal authentication system according to the present invention will be described with reference to the flowchart of FIG. When the account number and the password are received from the ATM (S01), it is checked whether or not the passwords match by referring to the account master corresponding to the account number (S02). If the passwords do not match, error processing is performed.

  When the passwords match, the transaction screen is displayed on the ATM, and a transaction request from the ATM is received (S03). When the requested transaction processing is executed (S04), predetermined data is acquired from the history information corresponding to the account number, calculation processing is performed using the acquired data based on the predetermined logic, and a security key is issued. (S05).

  Here, in the case where the issued security key is also stored on the host side, the newly issued security key and the expiration date are stored in the account master corresponding to the account number. When managing the validity of the security key with a flag in the account master in order to provide a one-time property, the validity key is set and the security key is set valid (S06). When the security key is calculated again at the time of identity verification, it is not necessary to store the security key.

  Subsequently, the issued security key is transmitted to the ATM (S07). The security key received by ATM is printed on a statement slip or a passbook, or written on an IC cash card or a mobile phone with a cash card function.

  With reference to the flowchart of FIG. 9, an auxiliary identity verification flow using a security key in the identity authentication system according to the present invention will be described. This flow is for the processing of transactions requested by users logged in to Internet banking, and the process of checking the security key shown in this flowchart is performed by either the host computer or the net banking server. It is good as well.

  When a transaction request is received from a user who has logged in to Internet banking (S11), it is determined from the transaction type whether the requested transaction or a transaction requiring a security key is applicable (S12). If the transaction does not correspond to a transaction requiring a security key, the requested transaction process is executed in the host computer (S17).

  If the transaction corresponds to a transaction requiring a security key, if the validity of the security key is managed by a flag, it is confirmed whether a valid security key is issued for the user (S13). If the validity of the security key is not performed by flag management, this step is not necessary. The validity may be confirmed after receiving the input of the security key.

  If a valid security key has not been issued, a security key acquisition request is displayed on the user's PC or the like (S18). If a valid security key has been issued, or if this step is not provided, a security key input request is displayed on the user's PC or the like (S14). When the security key input by the user is received (S15), this is re-logicized from the regular security code stored in the account master or user master for the user, or information obtained from the transaction history of the user. (S16) to confirm the identity.

  If the security keys match, the requested transaction process is executed in the host computer (S17). If the security keys do not match, error processing is performed.

It is a figure which shows the 1st example of the whole structure of the personal authentication system concerning this invention. It is a figure which shows the 2nd example of the whole structure of the personal authentication system concerning this invention. It is a figure which shows the 1st example of the account master in the personal authentication system concerning this invention. It is a figure which shows the 2nd example of the account master in the personal authentication system concerning this invention. It is a figure which shows the 3rd example of the account master in the personal authentication system concerning this invention. It is a figure which shows the example of the log | history information in the personal authentication system concerning this invention. It is a figure which shows the example of the user master of the net banking server in the personal authentication system concerning this invention. It is a flowchart which shows the issuance flow of the security key in the personal authentication system concerning this invention. It is a flowchart which shows the flow of the auxiliary | assistant identity verification by the security key in the personal authentication system concerning this invention.

Explanation of symbols

10 Host Computer 11 Security Key Generation Logic 20 Account File 21 Account Master 22 Transaction History 30 Net Banking Server 31 User Master 40 ATM
50 pcs
60 Mobile phone (with cash card function)

Claims (9)

Provided in a transaction processing system capable of processing a transaction request from a first transaction terminal connected by a dedicated line and a transaction request from a second transaction terminal that has received access via the Internet; An identity verification device that performs auxiliary identity verification in response to a predetermined transaction request from a user who has logged in with user authentication by accessing from a transaction terminal,
Transaction history storage means for storing, for each user, transaction history information including transactions executed in accordance with a transaction request received from the first transaction terminal;
When a user receives a transaction request made from the first transaction terminal or a confirmation key issuance request made from the first transaction terminal, and a process according to the transaction request or the issue request is normally accepted Confirmation key generation means for generating a confirmation key based on a predetermined logic from history information concerning the user stored in the transaction history storage means;
Confirmation key transmission means for transmitting the confirmation key generated by the confirmation key generation means to the first transaction terminal;
Confirmation key requesting means for transmitting a confirmation key input request to the second terminal when a user who has logged in to the transaction processing system receives a predetermined transaction request from the second transaction terminal. When,
Upon receipt of the confirmation key entered by the user from the second transaction terminal, a confirmation key is generated based on the logic from the history information for the user stored in the transaction history storage means, and the second Confirmation key verification means for verifying whether it matches the confirmation key received from the transaction terminal,
With
If the confirmation key does not match in the confirmation key collating means, the transaction processing system stops accepting the predetermined transaction request. A confirmation key storage means for storing the confirmation key as a used confirmation key in association with the user when the confirmation key matches in the confirmation key collating means and the processing corresponding to the predetermined transaction request is completed; ,
Upon receipt of the confirmation key entered by the user from the second transaction terminal, the used confirmation key for the user stored in the used confirmation key storage means is read out from the second transaction terminal. A used confirmation key verification means for verifying whether it matches the received confirmation key;
With
2. The identity verification device according to claim 1, wherein the transaction processing system stops accepting the predetermined transaction request when the confirmation key matches in the used confirmation key collating means. Provided in a transaction processing system capable of processing a transaction request from a first transaction terminal connected by a dedicated line and a transaction request from a second transaction terminal that has received access via the Internet; An identity verification device that performs auxiliary identity verification in response to a predetermined transaction request from a user who has logged in with user authentication by accessing from a transaction terminal,
Transaction history storage means for storing, for each user, transaction history information including transactions executed in accordance with a transaction request received from the first transaction terminal;
When a user receives a transaction request made from the first transaction terminal or a confirmation key issuance request made from the first transaction terminal, and a process according to the transaction request or the issue request is normally accepted Confirmation key generation means for generating a confirmation key based on a predetermined logic from history information concerning the user stored in the transaction history storage means;
Confirmation key storage means for storing the confirmation key generated by the confirmation key generation means in association with the user;
Confirmation key transmission means for transmitting the confirmation key generated by the confirmation key generation means to the first transaction terminal;
Confirmation key requesting means for transmitting a confirmation key input request to the second terminal when a user who has logged in to the transaction processing system receives a predetermined transaction request from the second transaction terminal. When,
Upon receipt of the confirmation key entered by the user from the second transaction terminal, the confirmation key for the user stored in the confirmation key storage means is read, and the confirmation key received from the second transaction terminal; Confirmation key verification means for verifying whether they match,
With
If the confirmation key does not match in the confirmation key collating means, the transaction processing system stops accepting the predetermined transaction request. When the confirmation key matching means matches the confirmation key and the processing corresponding to the predetermined transaction request is completed, the confirmation key collating means comprises a confirmation key deleting means for deleting the confirmation key stored in the confirmation key storage means,
When it is confirmed in the confirmation key collating means that the confirmation key for the user is not stored in the confirmation key storage means, the transaction processing system stops accepting the predetermined transaction request. The identity verification device according to claim 3. When the confirmation key matches in the confirmation key collating means and the processing corresponding to the predetermined transaction request is completed, a used flag indicating that the confirmation key is used is stored in association with the user. Flag storage means;
Upon receipt of the confirmation key entered by the user from the second transaction terminal, a used flag confirmation means for confirming whether or not a used flag for the user is stored in the used confirmation key storage means;
With
4. The transaction processing system stops receiving the predetermined transaction request when it is confirmed that the used flag is stored in the used flag confirmation means. Identity verification device. Transaction processing capable of processing a first transaction terminal connected by a dedicated line, a transaction request from the first transaction terminal, and a transaction request from a second transaction terminal that has received access via the Internet An identity verification system provided in the system, comprising an identity verification device that performs auxiliary identity verification in response to a predetermined transaction request from a user who has logged in upon being authenticated by accessing the second transaction terminal. And
In the identity verification device,
Transaction history storage means for storing, for each user, transaction history information including transactions executed in accordance with a transaction request received from the first transaction terminal;
When a user receives a transaction request made from the first transaction terminal or a confirmation key issuance request made from the first transaction terminal, and a process according to the transaction request or the issue request is normally accepted Confirmation key generation means for generating a confirmation key based on a predetermined logic from history information concerning the user stored in the transaction history storage means;
Confirmation key transmission means for transmitting the confirmation key generated by the confirmation key generation means to the first transaction terminal;
Confirmation key requesting means for transmitting a confirmation key input request to the second terminal when a user who has logged in to the transaction processing system receives a predetermined transaction request from the second transaction terminal. When,
Upon receipt of the confirmation key entered by the user from the second transaction terminal, a confirmation key is generated based on the logic from the history information for the user stored in the transaction history storage means, and the second Confirmation key verification means for verifying whether it matches the confirmation key received from the transaction terminal,
And the first transaction terminal includes:
Confirmation key receiving means for receiving the confirmation key transmitted by the confirmation key transmitting means;
Confirmation key output means for executing at least one of output of the confirmation key received by the confirmation key receiving means to a form or display, or writing of the confirmation key to a storage medium used by the user;
Is provided,
When the confirmation key collation means does not match the transaction processing system, the transaction processing system stops accepting the predetermined transaction request. Transaction processing capable of processing a first transaction terminal connected by a dedicated line, a transaction request from the first transaction terminal, and a transaction request from a second transaction terminal that has received access via the Internet An identity verification system provided in the system, comprising an identity verification device that performs auxiliary identity verification in response to a predetermined transaction request from a user who has logged in upon being authenticated by accessing the second transaction terminal. And
In the identity verification device,
Transaction history storage means for storing, for each user, transaction history information including transactions executed in accordance with a transaction request received from the first transaction terminal;
When a user receives a transaction request made from the first transaction terminal or a confirmation key issuance request made from the first transaction terminal, and a process according to the transaction request or the issue request is normally accepted Confirmation key generation means for generating a confirmation key based on a predetermined logic from history information concerning the user stored in the transaction history storage means;
Confirmation key storage means for storing the confirmation key generated by the confirmation key generation means in association with the user;
Confirmation key transmission means for transmitting the confirmation key generated by the confirmation key generation means to the first transaction terminal;
Confirmation key requesting means for transmitting a confirmation key input request to the second terminal when a user who has logged in to the transaction processing system receives a predetermined transaction request from the second transaction terminal. When,
Upon receipt of the confirmation key entered by the user from the second transaction terminal, the confirmation key for the user stored in the confirmation key storage means is read, and the confirmation key received from the second transaction terminal; Confirmation key verification means for verifying whether they match,
And the first transaction terminal includes:
Confirmation key receiving means for receiving the confirmation key transmitted by the confirmation key transmitting means;
Confirmation key output means for executing at least one of output of the confirmation key received by the confirmation key receiving means to a form or display, or writing of the confirmation key to a storage medium used by the user;
Is provided,
When the confirmation key collation means does not match the transaction processing system, the transaction processing system stops accepting the predetermined transaction request. A first transaction terminal connected by a dedicated line; a second transaction terminal connectable to the Internet; and a transaction request from the first transaction terminal and the second transaction terminal receiving access via the Internet Auxiliary identity verification for a predetermined transaction request from a user who has logged in after receiving identity authentication, provided in a transaction processing system capable of processing transaction requests from An identity verification method executed by an identity verification device that performs
The identity verification device includes a transaction history storage unit that stores, for each user, transaction history information including transactions executed in accordance with a transaction request received from the first transaction terminal.
The identity verification device receives a transaction request made by the user from the first transaction terminal or a confirmation key issuance request made from the first transaction terminal, and processing according to the transaction request or the issue request Is normally received, a confirmation key generation step of generating a confirmation key based on a predetermined logic from history information concerning the user stored in the transaction history storage unit;
A confirmation key transmitting step in which the identity verification device transmits the confirmation key generated in the confirmation key generation step to the first transaction terminal;
A confirmation key receiving step in which the first transaction terminal receives the confirmation key transmitted in the confirmation key transmission step;
Confirmation that the first transaction terminal executes at least one of outputting the confirmation key received in the confirmation key receiving step to a form or a display, or writing the confirmation key to the storage medium used by the user. Key output step;
When the identity verification device receives a predetermined transaction request made from the second transaction terminal by a user who has logged into the transaction processing system after authenticating the user, a confirmation key input request is sent to the second terminal. A confirmation key requesting step to send;
The second transaction terminal receives the input request transmitted in the confirmation key request step, and receives a confirmation key input by the user in response to the input request; a confirmation key reception step;
A second confirmation key transmission step in which the second transaction terminal transmits the confirmation key received in the confirmation key reception step to the identity verification device;
When the identification device receives the confirmation key transmitted in the second confirmation key transmission step, the identification device generates a confirmation key based on the logic from the history information for the user stored in the transaction history storage unit. A verification key verification step for verifying whether the verification key transmitted in the second verification key transmission step matches the verification key;
Have
The identity verification method according to claim 1, wherein if the confirmation key does not match in the confirmation key collating step, the transaction processing system stops accepting the predetermined transaction request. A first transaction terminal connected by a dedicated line; a second transaction terminal connectable to the Internet; and a transaction request from the first transaction terminal and the second transaction terminal receiving access via the Internet Auxiliary identity verification for a predetermined transaction request from a user who has logged in after receiving identity authentication, provided in a transaction processing system capable of processing transaction requests from An identity verification method executed by an identity verification device that performs
The identity verification device includes a transaction history storage unit that stores, for each user, transaction history information including transactions executed in accordance with a transaction request received from the first transaction terminal.
The identity verification device receives a transaction request made by the user from the first transaction terminal or a confirmation key issuance request made from the first transaction terminal, and processing according to the transaction request or the issue request Is normally received, a confirmation key generation step of generating a confirmation key based on a predetermined logic from history information concerning the user stored in the transaction history storage unit;
A confirmation key storage step in which the identity verification device stores the confirmation key generated in the confirmation key generation step in association with the user;
A confirmation key transmitting step in which the identity verification device transmits the confirmation key generated in the confirmation key generation step to the first transaction terminal;
A confirmation key receiving step in which the first transaction terminal receives the confirmation key transmitted in the confirmation key transmission step;
Confirmation that the first transaction terminal executes at least one of outputting the confirmation key received in the confirmation key receiving step to a form or a display, or writing the confirmation key to the storage medium used by the user. Key output step;
When the identity verification device receives a predetermined transaction request made from the second transaction terminal by a user who has logged into the transaction processing system after authenticating the user, a confirmation key input request is sent to the second terminal. A confirmation key requesting step to send;
The second transaction terminal receives the input request transmitted in the confirmation key request step, and receives a confirmation key input by the user in response to the input request; a confirmation key reception step;
A second confirmation key transmission step in which the second transaction terminal transmits the confirmation key received in the confirmation key reception step to the identity verification device;
When the person confirmation device receives the confirmation key transmitted in the second confirmation key transmission step, the confirmation key for the user stored in the confirmation key storage step is read, and the second confirmation key transmission is performed. A verification key verification step to verify whether it matches the verification key sent in the step;
Have
The identity verification method according to claim 1, wherein if the confirmation key does not match in the confirmation key collating step, the transaction processing system stops accepting the predetermined transaction request.