WO2008004312A1 - Net settlement assisting device - Google Patents

Net settlement assisting device Download PDF

Info

Publication number
WO2008004312A1
WO2008004312A1 PCT/JP2006/313658 JP2006313658W WO2008004312A1 WO 2008004312 A1 WO2008004312 A1 WO 2008004312A1 JP 2006313658 W JP2006313658 W JP 2006313658W WO 2008004312 A1 WO2008004312 A1 WO 2008004312A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
card
authentication
time password
contractor
Prior art date
Application number
PCT/JP2006/313658
Other languages
French (fr)
Japanese (ja)
Inventor
Shun Tanaka
Mitsuyuki Kawakatsu
Original Assignee
Jcb Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Jcb Co., Ltd. filed Critical Jcb Co., Ltd.
Priority to KR1020087031300A priority Critical patent/KR101248058B1/en
Priority to CN2006800552299A priority patent/CN101496024B/en
Publication of WO2008004312A1 publication Critical patent/WO2008004312A1/en

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/34—User authentication involving the use of external additional devices, e.g. dongles or smart cards
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/12—Payment architectures specially adapted for electronic shopping systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/14—Payment architectures specially adapted for billing systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds

Definitions

  • the present invention relates to an online payment assistance device.
  • card identification information such as a credit card or a bank card and a personal identification number are stored in a cellular phone, and the personal identification number input to the cellular phone, the stored V, and personal identification number
  • card identification information card number
  • a mobile phone that also functions as a card by displaying a card number on the display of the mobile phone when it is accepted (see, for example, Patent Document 1).
  • Patent Document 1 Japanese Patent Application Laid-Open No. 2002-64597
  • the mobile phone may have the power of eliminating the above-mentioned wiretapping and tampering.
  • the present invention has been made in view of the above-described conventional problems, and the object of the present invention is the risk of eavesdropping or tampering with a card number or PIN by unauthorized access or the like.
  • the aim is to provide an online payment assistance device that enables safe and secure online commerce.
  • the card information including at least the identification information of the card contractor such as a credit card or debit force card is stored in advance in such a state that it cannot be read by an external force.
  • a card information storage unit, an authentication information storage unit stored in advance in such a state that authentication information for authenticating the subscriber's identity cannot be read by an external force, and the card information associated with the card information The OTP generation information unique to the online payment assistance device is stored in advance in such a state that the external force cannot be read, the OTP generation information storage unit stored in advance, the input means for inputting the authentication information, and the input means.
  • the operator of the online payment assisting device authenticates the identity of the contractor based on the input information and confirms the identity, at least a part of the card information is included.
  • Both the authentication means for reading the identification information and displaying it on the display, and the card information And a one-time password generating means for generating a one-time password based on the OTP generation information and displaying it on the display.
  • the one-time password is used to authenticate the subscriber and
  • the online payment assisting device is characterized in that the online commerce by the payment using the identification information is made possible.
  • a network settlement system in which a credit card or debit card or the like, a contractor terminal such as a cellular phone or personal computer, and an authentication server for authenticating the contractor are connected to each other via a network.
  • a portable online payment assistance device used when performing online commerce by payment using the contractor identification information, the internet payment assistance device comprising a display and the contractor identification information.
  • the card information storage unit that is stored in advance so that the card information including at least cannot be read from the outside, and the authentication information for authenticating the contractor cannot be read from the outside.
  • Authentication information storage unit stored in advance and the OTP generation information associated with the card information and unique to the online payment assisting device are externally read.
  • the OTP generation information storage unit stored in advance so as not to be output, the input means for inputting the authentication information, the operator of the online payment assisting device If the identity of the contractor is verified and the identity is confirmed, at least the identification information is read out of the card information and displayed on the display, and the card information is And a one-time password generating unit that generates a one-time password based on the OTP generation information and displays the one-time password on the display, and the contractor terminal transmits the one-time password to the authentication server. In this way, when the identity of the contractor is verified and the identity is confirmed, the online commerce is enabled. It is an online payment assisting device.
  • the online payment assisting device since the online payment assisting device is portable, it is possible to carry out secure online commerce using a mobile phone, a home personal computer, or a personal computer wherever the contractor is, Convenience increases.
  • the OTP generation information for one-time password generation is stored in a state that cannot be read from the outside, even the contractor himself cannot know the OTP generation information, and the online payment assistance Only the contractor operating the device can know the one-time passcode of the generation result. In other words, since a one-time password cannot be generated by a third party, the safety of online commerce is further guaranteed.
  • the one-time password is generated only after the card information is displayed on the online payment assisting device. Even if the three parties know only the identification information, they cannot generate a one-time password. In addition, even if a third party steals the online payment assistant device, the one-time password cannot be generated without the authentication information to be entered into the online payment assistant device.
  • the contractor after the contractor receives the personal authentication by the authentication means of the online payment assisting device, the contractor further receives the personal authentication by the authentication server, and finally the online commerce is possible. Without personal authentication based on different types of authentication information, spoofing by third parties is further prevented and the safety of online commerce is increased.
  • the authentication information is a personal identification number predetermined by the contractor, and the input means is a numeric keypad.
  • the input means and the authentication means can be configured at a relatively low cost, the use of the online payment assisting device can be promoted.
  • the authentication information quantifies the biometric features of the contractor's fingerprint, iris, vocal cord, facial photograph, etc.
  • This is a network settlement auxiliary device characterized in that it is biometric information.
  • the invention of claim 5 provides:
  • the OTP generation information is a common key
  • the one-time password generation means detects the pressing of a predetermined operation key, and encrypts date and time data including the date and time when the operation key is pressed with the common key.
  • This is an online payment assistance device characterized by generating a one-time password.
  • the OTP generation information is composed of a common key and usage count information that is updated each time the one-time password is generated, and the one-time password generation means detects pressing of a predetermined operation key, and
  • This is a network settlement auxiliary device that encrypts usage count information with a common key to generate a one-time password, and updates the usage count information in the OTP generation information storage after the one-time password is generated.
  • the one-time password generated here uses a common key to encrypt the date / time data consisting of the date and time when the predetermined key was pressed or the usage count information that is updated each time a one-time password is generated. Is. In other words, since it is a password that can only be created by a contractor operating the online payment assistant, it is not possible for a third party to carry out online commerce by impersonating a contractor in possession of the online payment assistant. Unable to improve the safety of online commerce.
  • the online payment assistance device is an online payment assistance device having tamper resistance.
  • the online payment assisting device since the online payment assisting device has tamper resistance, it is possible to further improve security against eavesdropping and tampering of card information, authentication information, and OTP generation information by a third party. It is done.
  • the online settlement assistant device of the present invention if the identity verification of the contractor is not performed by the online settlement assistant device, the card information cannot be obtained even by the contractor himself, Card information is stored in a state that cannot be read by an external force. Unlike conventional credit cards that expose card information, the card information is more confidential and unauthorized use of card information in online commerce. Is prevented.
  • the online payment assisting device is portable, it is possible to conduct safe online commerce using a mobile phone, a home personal computer, or a personal computer at a destination, wherever the contractor is. Convenience increases.
  • the OTP generation information for one-time password generation is stored in a state that cannot be read from the outside, even the contractor himself cannot know the OTP generation information, and the online payment assistance Only the contractor operating the device can know the one-time passcode of the generation result. In other words, since a one-time password cannot be generated by a third party, the safety of online commerce is further guaranteed.
  • the one-time password is generated only after the card information is displayed on the network settlement assistant device, the one-time password is not provided. Even if the three parties know only the identification information, they cannot generate a one-time password. In addition, even if a third party steals the online payment assistant device, the one-time password cannot be generated without the authentication information to be entered into the online payment assistant device.
  • the contractor after the contractor receives the personal authentication by the authentication means of the online payment assisting device, the contractor further receives the personal authentication by the authentication server, and finally the online commerce is possible. Without personal authentication based on different types of authentication information, spoofing by third parties is further prevented and the safety of online commerce is increased.
  • FIG. 1 (a) is an external view of the online payment assistant device 1
  • Fig. 1 (b) is an online payment assistant device.
  • FIG. 3 is a configuration diagram of electrical hardware of device 1;
  • the online payment assistance device 1 includes a cardholder's subscriber terminal (such as a mobile phone or personal computer) such as a credit card or a debit card, and an authentication server (usually owned by the card company). ) are mutually in a networked net settlement system, the settlement subscriber with identification information of the subscriber, which is used when performing a net transactions such Nettoshotsubi ring, FIG. 1 (a ), It has a shape that fits in the palm of your hand, and is composed of a thin and portable case 10. The display 11 and key operation unit 12 are exposed on the outer surface of the case 10. Yes.
  • a cardholder's subscriber terminal such as a mobile phone or personal computer
  • an authentication server usually owned by the card company
  • the display 11 of the present embodiment is an 8-digit display, and the key operation unit 12 includes a numeric keypad 12a from 0 to 9 and a start key 12b.
  • the inside of the housing 10 includes a display 11, a key operation unit 12, a force information storage unit 13, an authentication information storage unit 15, an authentication unit 14, and an OTP generation.
  • the casing 11 of the present embodiment is provided with a slot for incorporating an IC card such as a SIM in addition to the display 11, the key operation unit 12, the driving power source 19, and the IC card is provided in the slot. Insert and use.
  • the CPU and memory used in this IC card are used.
  • the card information storage unit 13 the authentication information storage unit 15, and the OTP generation information storage unit 17 store different information for each contractor, such information is stored in the memory of the IC card.
  • the case 11 itself can be used in common without relying on the contractor by inserting it into the slot. Also, since the case 11 itself does not hold personal information, the productivity of the case 11 can be reduced. And the handling and management of the housing 11 become easy.
  • the driving power source 19 of the present embodiment may be a force solar cell or a rechargeable battery that is a button battery.
  • the online payment assisting apparatus 1 may be in a power-off state during normal operation, and for example, the power may be activated when any key operation of the key operation unit 12 is performed.
  • the card information storage unit 13, the authentication information storage unit 15, and the OTP generation information storage unit 17 of the present embodiment is composed of memory that stores card information, authentication information, and OTP generation information, which will be described later, and the memory is physically a single memory that stores these information together. But you can have more than 2 memories! /.
  • the authentication means 14 and the OTP generation means 16 of the present embodiment are configured by a program stored in a memory, and the CPU power in the net settlement assistant device 1 reads the program from the memory. As a result, the functions of the authentication means 14 and the OTP generation means 16 are realized. It should be noted that in the online payment assisting device that does not include a CPU and a memory, the functions of the authentication means 14 and the OTP generation means 16 may be realized circuitically using electronic components.
  • the online payment assisting device 1 of this embodiment is an issuer that issues a credit card based on a license contract with a credit card brand (if it is a debit card, a bank or a card issuing company that issues the debit card). Distribution to individual cardholder subscribers with card information, authentication information, and OTP generation information that is unique to each subscriber at ISHIRE.
  • the contents stored in the memory cannot be read from the outside after distribution. It is composed of
  • the contractor himself / herself who has been distributed with the online payment assisting apparatus 1 cannot read out the recorded contents of the memory.
  • the contractor himself / herself can know only the card information by displaying the card information on the display 11 only when the identity of the contractor is verified and the identity of the contractor is confirmed. In this state, the card information is kept secret.
  • the contents stored in the memory cannot be read from the outside because the network settlement assistant device 1 has an interface connected to a network such as the Internet, and is not connected to the network. This is because it is a terminal.
  • the Internet payment assistance device 1 or the IC card such as SIM built in the internet payment assistance device 1 is tamper resistant (disassembled). Thus, if the recorded content is read directly from the memory, the recorded content in the memory may be erased or the program may not start. [0048] Details of each part of the online settlement assisting apparatus 1 will be described below.
  • the card information storage unit 13 is a memory in which card information including at least contractor identification information is stored in advance in a state in which it cannot be read by an external force.
  • the card information in this embodiment is unique to the contractor.
  • Identification information card number
  • expiry date a three-digit decimal number encrypted in advance by a predetermined method. Usually printed on the sign panel of a plastic credit card. The authenticity of the card can be confirmed.
  • the name of the holder may also be included.
  • the card information may be composed only of identification information.
  • the card information may be configured by combining one or more of the expiration date, security code, and the holder's name as appropriate.
  • the authentication information storage unit 15 authenticates the contractor, such as a personal identification number determined by the contractor, or biometric information obtained by quantifying the biometric characteristics of the contractor's fingerprint, iris, vocal cord, facial photograph, and the like. This is a memory in which authentication information is stored in advance in such a state that the external information cannot be read.
  • the authentication information stored in the authentication information storage unit 15 is different from the authentication information used by the authentication server in the online payment system for authenticating the contractor. This is authentication information necessary for performing Also, the authentication information in the authentication server and the authentication information in the network settlement assistant device 1 are of different types.
  • the OTP generation information storage unit 17 is a memory in which the OTP generation information unique to the online settlement assistant device 1 is stored in advance so that it cannot be read from the outside.
  • the OTP generation information of this embodiment is , Which is a common key unique to the network settlement assistant device 1, and the common key is a card information storage unit in a server (authentication server in the embodiment described later) that verifies the one-time password generated by the OTP generation means 16. It is associated with the identification information stored in 13.
  • the common key is a key stored only in the authentication server for authenticating the contractor's identity and the net settlement assistant device 1 in the net commerce.
  • the OTP generation means 16 described later is used. Used to generate a one-time password.
  • the authentication means 14 is stored in the card information storage unit 13 by the operator of the online payment assisting apparatus 1. Therefore, it is a means for authenticating the identity of the contractor (card member) who can use the identification information, and the input means (in this embodiment, the numeric keypad 12a).
  • the authentication information storage unit 15 checks whether it matches the authentication information stored in the authentication information storage unit 15, and if it matches, stores it in the card information storage unit 13 as if the operator of the online payment assisting device 1 is the contractor himself / herself. It is a means for reading out at least identification information from the displayed card information and displaying it on the display 11.
  • the authentication unit 14 is activated upon detection of pressing of the start key 12b by the operator pressing the start key 12b of the key operation unit 12. Thereafter, when the operator depresses the numeric keypad 12a corresponding to the input means and inputs a four-digit number, the authentication means 14 receives the code number stored in the authentication information storage unit 15 as the authentication number. If it matches, the card information is displayed on the display 11.
  • the authentication information is a personal identification number as in the present embodiment, it is sufficient if there is a numeric keypad as the input means, and the matching process between the input information and the authentication information can be easily performed. Payment device 1 is realized, and use of network payment device 1 is promoted.
  • the authentication information of the present embodiment is a 4-digit password, but the authentication method and authentication information are not limited to this, and a plurality of authentication methods may be used in which authentication means using a plurality of authentication methods may be appropriately combined. By adopting this method, the accuracy of authentication increases, and the abuse of the online payment assistance device by a third party is prevented.
  • the authentication information is the data obtained by quantifying the biometric features such as the nanometric information (fingerprint, iris, vocal cord, face photograph, etc.).
  • the input means is a scanner, a microphone, a digital camera, etc. for inputting these biometrics information.
  • the biometrics authentication method is a high-precision authentication method, even if the online payment assisting device 1 is stolen by a third party, it is not a contractor to whom the online payment assisting device 1 is distributed. The online payment assistance device 1 cannot be used, and misuse is prevented.
  • the personal identification number which is the authentication information of the present embodiment, may include alphabets in addition to numbers. In this case, it is necessary for the net settlement auxiliary device to include an alphabet key in addition to the numeric keypad. There is. [0061] After the card information is displayed by the authentication means 14, the OTP generation means 16 is based on the OTP generation information (common key in this embodiment) stored in the OTP generation information storage section 17. It is a means for generating a time password and displaying it on the display 11.
  • This one-time password is transmitted from the contractor terminal to the authentication server.
  • the authentication server authenticates the contractor
  • the one-time password is generated with the one-time password generated based on the OTP generation information by the authentication server. Used for verification. If the verification results of these one-time passwords match and the identity is verified by the authentication server, online commerce by settlement using the contractor's identification information becomes possible.
  • the OTP generation means 16 of the present embodiment is capable of generating a one-time password by a time synchronization method, which will be described in detail later.
  • Other generation methods such as a counter synchronization method, challenge & A one-time password may be generated by a response method.
  • the time measuring means 18 is a means necessary for the OTP generating means 16 of the present embodiment to generate a one-time password by the time synchronization method, and is a means for measuring time.
  • the clocking means 18 may be configured by a real-time clock, or stored in the clocking program force S memory, and the clocking program is read and executed by the CPU to realize the clocking function. May be.
  • the OTP generation means 16 generates a one-time password by a method other than the time synchronization method
  • the time measurement means 18 is not necessary, and instead, a means necessary for each generation method is added. Become.
  • the OTP generation unit 16 waits for detection of pressing of the start key 12b after the authentication unit 14 displays the card information on the display 11.
  • the OTP generating unit 16 transmits the pressing detection to the time measuring unit 18.
  • the time measuring means 18 measures the date and time when the start key 12b is detected to be pressed, and delivers the date and time data (year / month / day / hour / hour / minute / second, second is in units of 30 seconds) to the OTP generation means 16.
  • the OTP generation means 16 reads the common key from the OTP generation information storage unit 17,
  • the delivered date / time data is encrypted with the read common key, converted into a decimal number, and displayed on the display 11.
  • the encryption method of this embodiment employs a common key encryption method, but other encryption methods may be used.
  • the card information displayed by the authentication means 14 when the identity of the contractor is verified by the online settlement assistant device 1 and is confirmed as the principal After being entered on the card information input screen that is sent from the website of the merchant that accepts payment or from the authentication sano and displayed on the contractor's terminal, it can be sent to the website or the authentication server.
  • the identity of the contractor is authenticated by the net settlement assistant device 1, and if the identity of the contractor is not confirmed, that is, the inputted input information is stored in the net settlement assistant device and the authentication is performed. If it does not match the information, even the contractor cannot know the card information, and the card information is stored in a state that cannot be read by an external force, so the card information is exposed. Unlike conventional credit cards, the confidentiality of card information is enhanced, preventing unauthorized use of card information in online commerce.
  • the online payment assisting device is portable, it is possible to conduct secure online commerce using a mobile phone, a home personal computer, or a personal computer wherever a contractor is located. Convenience increases.
  • the one-time password displayed by the OTP generation means 16 is input from the authentication server that authenticates the contractor to the one-time password input screen displayed on the contractor terminal.
  • the identity server confirms the identity of the user by matching with the one-time password generated by the authentication server, and enables online commerce by settlement using the contractor's identification information.
  • the third party since the one-time password created based on the contractor-specific OTP generation information stored in the network payment assistant device is used for the authentication of the contractor, the third party temporarily assumes the one-time password. You cannot use it for the next online commerce.
  • the OTP generation information for generating a one-time password is stored in a state that cannot be read from the outside, even the contractor himself cannot know the OTP generation information and assists with online payment. Only the contractor who is operating the device generates a one-time pass You can know the mode. In other words, since a one-time password cannot be generated by a third party, the safety of online commerce is further guaranteed.
  • the one-time password is generated only after the card information is displayed on the network settlement assistant device, the one-time password is not provided. Even if the three parties know only the identification information, they cannot generate a one-time password. Even if a third party steals the online payment assistant, the one-time password cannot be generated without the authentication information to be entered into the online payment assistant.
  • the contractor is authenticated by the authentication means of the online payment assisting device, the contractor is further authenticated by the authentication server. Without personal authentication based on different types of authentication information, spoofing by third parties is further prevented and the safety of online commerce is increased.
  • the authentication information storage unit 15 re-inputs the input information when the input information and the authentication information do not match in the matching determination process performed by the authentication unit 14.
  • the number of times of acceptance may be stored in advance.
  • the net settlement assistant device 1 or the authentication unit 14 is configured to include a counting unit (counter).
  • the counting means counts up from 1, and the counted up number If the counted up number exceeds the allowable error count, then the authentication means 14 will not perform its own processing and generate OTP. Mean 16 is not activated, and the authentication flow and OTP generation flow are not performed.
  • the authentication means 14 displays the card information on the display 11 when the input information and the authentication information that the counted up number does not exceed the allowable number of errors match the authentication information. At this time, the counted up number is reset to 0 (initialized).
  • FIG. 5 shows an example of the operation procedure of the online payment assisting apparatus 1 and the screen transition of the display 11.
  • the display 11 of this embodiment is an 8-digit alphanumeric character display.
  • the one-time password is based on the OTP generation information stored in OTP generation information storage unit 17. Is generated and displayed on the display 11 (S315).
  • the start key 12b is pressed again (S320)
  • the power source of the online settlement assisting apparatus 1 is cut off.
  • the password entered in S240 and S305 is used for displaying card information and for generating a one-time passcode. In such a case, separate passwords may be used. These PINs are stored separately!
  • a one-time password may be generated simply by pressing the start key 12b of S310.
  • the input value is preferably not displayed on the display 11.
  • a credit card member (hereinafter referred to as a card member) who is a credit card contractor who is distributed with the online payment assisting device 1 shown in FIG.
  • a description will be given of an embodiment in which network commerce such as online shopping (hereinafter referred to as “net commerce”) is performed from a personal computer or mobile phone possessed by settlement using the card number of the card member.
  • FIG. 3 The system configuration and network connection relationship of the network payment system of the present embodiment are shown in the system configuration diagram of FIG.
  • the flowchart of Fig. 3 shows the flow of online commerce in the online payment system of this embodiment.
  • it is a credit card brand that provides an online commerce service in the online payment system.
  • the card member applies for a credit card in advance and receives a credit card issue, and the authentication information unique to each card member (registered by the card member when applying for the credit card) Distribution of the online payment assistance device 1 that stores biometric information such as personal identification number and fingerprint information), card information (card number and expiration date unique to each cardholder), and OTP generation information (common key). It shall be.
  • the configuration excluding the display 11, the key operation unit 12, and the driving power supply 19 is an IC such as a SIM.
  • the function of the network payment assisting device 1 is realized by inserting the IC card into the IC card slot (not shown) provided in the housing 10 and stored in the card in advance. If the online payment assistance device does not have an IC card, the online payment assistance device itself has only to have a CPU and memory.
  • the online payment assisting apparatus 1 of the present embodiment is used for online commerce using payment using card member identification information, that is, card payment. If you do not want real face-to-face transactions with a strong credit card, such as a conventional plastic-type magnetic card or IC card, you do not need to issue a credit card. [0102] In addition, in the case where the credit card brand power Ishiyua is also operated! /, The online payment assisting device 1 may be distributed from the credit card brand.
  • the member terminal 2 is a contractor's terminal, and a card member is a terminal for performing online commerce using the online payment assisting device 1, and is a personal computer having at least a communication function and a browser display function, A terminal such as a mobile phone.
  • the member store terminal 3 provides a virtual store (website) to the member terminal 2, accepts orders for products and services, and requests the cardholder to authenticate the ordered card member. After authenticating the customer, the authorization (acquisition of the merchant's contract / administration based on the license agreement with the credit card brand) is given to the customer (the amount of the ordered goods and services). This is a terminal that asks if the credit limit remains in the cardholder and asks if the credit limit remains!
  • the acquirer terminal 4 is a terminal that re-requests the authority request received from the member store terminal 3 to the issuer side.
  • the intermediary server 5 serves as an intermediary between the member store terminal 3 and an authentication server 7 described later, that is, a server that mediates the card member authentication service between the member terminal 2 and the member store terminal 3. It is.
  • the mediation server 5 is a server operated by the credit card brand in this embodiment, and the member store identification information for identifying the member store corresponding to the online commerce service using the online payment assisting device 1; Corresponding to the online commerce service using the online payment assisting device 1, issuance identification information for identifying the issuer is stored.
  • the mediation server 5 uses the net settlement assisting device 1. It is necessary to store the identification information of merchant stores and issuers that are not compatible with online commerce services separately from the above-mentioned member store identification information and issue identification information.
  • the issuer terminal 6 is a terminal that accepts an authorization request that has also received the power of the acquisition terminal 4 and performs authorization.
  • the authentication server 7 When performing online commerce, the cardholder A server that performs authentication.
  • the authentication server 7 is a server operated by Ishiure, connected to the Ishiure terminal 6, and a cardholder card that can perform online commerce using the online payment assistant device 1.
  • Information card number, expiration date
  • OTP generation information common key unique to the online payment assistant device 1 are stored in a mutually associated state. In other words, one card member, card information and OTP generation information are associated with each other and stored in the authentication server 7.
  • the storage of these pieces of information in the authentication server 7 is performed at the same time as or before or after the distribution of the online payment assisting device 1 to the card member.
  • the member terminal 2, the member store terminal 3, the mediation server 5, and the authentication server 7 are connected by a network 9a such as the Internet.
  • the issuer terminal 6 is connected by a dedicated line 9b.
  • the issuer terminal 6 and the authentication server 7 are prepared for each issuer, and are connected to the member terminal 2, the acquirer terminal 4, and the mediation server 5 through the network 9a and the dedicated line 9b. .
  • the member store terminal 3 is also prepared for each member store, and is connected to the member terminal 2, the mediation server 5, and the acquirer terminal 4 through the network 9a and the dedicated line 9b.
  • the card member accesses the member store terminal 3 which is a virtual store (Web site) from the member terminal 2 via the network 9a, and browses products and services.
  • the member terminal 2 transmits to the member store terminal 3 a request for online commerce by card settlement regarding the ordered product and the desired service.
  • the member store terminal 3 displays the card information input screen 100 as shown in FIG. 4 (a) on the member terminal 2, and inputs the card number and the card expiration date to the member terminal 2. Ask to send.
  • the authentication means 14 of the net settlement assisting apparatus 1 is activated, and the net settlement assisting apparatus 1 enters the authentication waiting state. Subsequently, the cardholder must enter the input information necessary for authentication (in this example, 4 Enter the digit password using the numeric keypad 12a.
  • the four-digit password entered here is determined in advance by the card member when applying for the card, and is already stored in the authentication information storage unit 15 in the online settlement assistant device 1.
  • the authentication unit 14 reads the authentication information stored in the authentication information storage unit 15 and confirms whether or not it matches the input information input from the numeric keypad 12a. If they match, the authentication means 14 reads the card number and the expiration date as card information from the card information storage unit 13 and displays them on the display 11.
  • the authentication unit 14 notifies the OTP generation unit 16 that the display has been completed. As a result, the OTP generation unit 16 enters a state of waiting for a one-time newsword generation to be described later.
  • the authentication means 14 sets the card number read from the card information storage unit 13 to the upper 8 digits and lower digits. After dividing into 8 digits, the first 8 digits of the card number are displayed on the display 11 first. Based on the display, the card member enters the first 8 digits of the card number in the card number input field 100a of the card information input screen 100.
  • the authentication means 14 Upon receiving the detection of the start key 12b being pressed, the authentication means 14 displays the last 8 digits of the card number on the display 11. Based on the display, the cardholder enters the last 8 digits of the card number in the card number input field 100a of the card information input screen 100.
  • the authentication means 14 Upon receiving the detection of pressing of the start key 12b, the authentication means 14 displays the expiration date in four digits (MM (month) Z YY (year)). Based on the display, the card member enters the expiration date in the expiration date input field 100b of the card information input screen 100.
  • the card number may be displayed on the display all at once, or the card number and the expiration date may be displayed. May all be displayed.
  • the authentication means 14 divides the card information read from the card information storage unit 13 in advance according to the number of displayable digits, and starts. Key 12b Other, any key The divided card information may be displayed sequentially by pressing detection.
  • the online settlement assistant device 1 displays the card information on the display 11 only when the input information that is input matches the authentication information stored in the authentication information storage unit 15. Therefore, if the authentication information is not known, even if a third party steals the online payment assisting device 1, the internal card information cannot be known. Therefore, there is no fear that the card information, which is safer than the conventional credit card on which the card information is printed, will be misused for online commerce.
  • the ordered product / service name, price, order date, membership Click the send button 100c in the card information input screen 100.
  • Information such as store name and product shipping address may be displayed on the same screen.
  • the send button 100c is clicked, the entered card information is sent to the member store terminal 3 (S10).
  • order information regarding the ordered product ⁇ service name, price, order date, member store name, merchandise delivery destination, etc., card number of the card used for settlement of the ordered product, expiration date, etc.
  • the member store terminal 3 Upon receiving the card information, the member store terminal 3 transmits the member store identification information given to each member store to the intermediary server 5 connected via the network 9a in addition to the received card information.
  • a request for confirmation of whether or not the member is a member who can receive the online commerce service using the settlement assistant device 1 (confirmation of whether or not authentication can be executed) is requested (S20).
  • the mediation server 5 confirms whether or not the received member store identification information matches the member store identification information held (member store authentication). If these pieces of information match, it means that the member store terminal 3 of the member store participating in the online commerce service using the online settlement auxiliary device 1 has also accessed the intermediary server 5. If they do not match, it is an unauthorized access from the member store terminal 3 that has not participated in the online commerce service using the online payment assisting device 1, and the subsequent flow does not proceed.
  • the intermediary server 5 issued the card number of the card member based on the card information of the card member received from the member store terminal 3 participating in the online commerce service using the online payment assisting device 1.
  • the issuer is identified, the force information is transmitted to the identified issuer authentication server 7, and the card member uses the online payment assistant device 1 to execute the online commerce service.
  • Requesting confirmation of whether or not the member is a member who can receive the service (authentication execution availability confirmation) (S30).
  • the mediation server 5 of this embodiment stores issue identification information for identifying the issue, and the mediation server 5 searches the issue identification information based on the received card information to identify the issue. .
  • the mediation server 5 of the present embodiment does not directly check whether or not the authentication can be performed, but performs member store authentication and based on the card information received from the member store terminal 3.
  • the issuer with the card number issued is identified, the card information is transferred to the authentication server 7 of the identified issuer, and the authentication execution confirmation result received from the authentication server 7 is transferred to the member store terminal 3.
  • the intermediary server 5 is a server operated by a credit card brand.
  • each member store terminal 3 may be provided directly.
  • the Karo affiliate store terminal 3 requests the authentication server 7 to confirm whether or not authentication can be executed.
  • merchant authentication may be performed on the authentication server 7! /.
  • the authentication server 7 confirms whether or not the card information received from the intermediary server 5 is registered in the authentication server 7, so that the card member having the card information uses the net settlement assistant device 1. After confirming whether or not the card member is able to receive the online commerce service (confirmation of whether or not authentication can be performed), the result is returned to the intermediary server 5 (S40). Note that the authentication execution result confirmation result is “OK” if the card information received from the intermediary server 5 is registered in the authentication server 7, and is “NO” if not registered.
  • the mediation server 5 that has received the authentication execution feasibility confirmation result transfers the result to the member store terminal 3 (S50).
  • step S60 the process proceeds to a flow for requesting authentication of the cardholder. Specifically, the member store terminal 3 transmits to the member terminal 2 the URL information of the authentication server 7 of the issuer that has previously confirmed whether or not the authentication can be executed together with the result of whether or not the authentication can be executed.
  • the member terminal 2 that has received the authentication request from the member store terminal 3 accesses the same authentication server 7 that the mediation server 5 previously accessed based on the received URL, and makes an authentication request. (S70).
  • the flow of S70 is carried out as a series of flow from S60, and can be realized by using a redirection function or the like generally provided in a personal computer or mobile phone browser used as the member terminal 2, and the card member is conscious of it. This is a flow that is automatically processed inside the member terminal 2 without having to do it.
  • the authentication server 7 prompts the member terminal 2 to transmit a one-time password, and authenticates the card member based on the one-time password received from the member terminal 2 (S80).
  • the authentication server 7 receives the card information and the order information from the accessing member terminal 2, and the card member having this card information mediates from the member store terminal 3 earlier. Via the server 5, it is confirmed whether or not the card member has received a request for confirmation of whether or not authentication can be executed. This confirmation is made by keeping a log of whether or not the card member's card information has been received from the intermediary server 5 a predetermined time before the card member's card information received from the member terminal 2 This is done by checking whether it matches the card information left in the log before time.
  • the order information may be transmitted from the member store terminal 3 to the authentication server 7 via the mediation server 5 in the flow of S20, 30 not from the member terminal 2, or the member store terminal 3 Even if the URL information of the authentication server 7 is transmitted from the user to the member terminal 2, it is transmitted together, and when the member terminal 2 accesses the authentication server 7, it is transferred to the authentication server 7. Good.
  • the authentication server 7 confirms whether or not the card member of the accessing member terminal 2 is the same as the card member who has received the request to confirm whether or not the member terminal terminal 3 can execute the authentication.
  • the order information may be received by both the member terminal 2 and the member store terminal 3 (directly the intermediary server 5), and these collations may be used together.
  • the authentication server 7 determines whether the access is based on the received order information. 4 Create the one-time password input screen 101 as shown in (b) and send it to the member terminal 2 that had access.
  • the one-time password entry screen 101 in Fig. 4 (b) shows the name of the merchant that the cardholder is engaged in online commerce, the amount of goods and services that they are trying to order, and the order date. It is displayed.
  • the card member presses the start key 12b of the network settlement assistant device 1.
  • the OTP generating means 16 of the online payment assisting device 1 shifts from the one-time password generation waiting state to the one-time password generation flow.
  • the OTP generation means 16 reads out the common key stored in the OTP generation information storage section 17, and is date / time data (year / month / day / second, A one-time password is generated by encrypting the second (in units of 30 seconds) using this common key, and this is converted to a decimal number and displayed on the display 11.
  • the encryption method of this embodiment employs a common key encryption method.
  • the display 11 of the present embodiment has 8 displayable digits, the display 11 displays the upper 6 to 8 digits of the generated one-time password.
  • the cardholder enters the one-time password displayed on the display 11 of the online payment assistant device 1 in the password input field 101a of the one-time password input screen 101 displayed on the member terminal 2, When the send button 101b is clicked, the entered one-time password is sent to the authentication server 7.
  • the cardholder re-presses the start key 12b of the online payment assisting device 1 to display it on the display 11 of the online payment assisting device 1. It is desirable from the security point of view to hide the one-time password. At the same time, the power is also turned off. This is desirable from the viewpoint of energy saving.
  • the authentication server 7 Upon receiving the one-time password from the member terminal 2, the authentication server 7 first confirms that the member terminal 2 is the other party who first requested transmission of the one-time password, such as the identification number of the member terminal 2. This is confirmed by confirming whether or not the response is for the one-time password input screen 101 generated and transmitted individually for the member terminal 2 concerned.
  • the authentication server 7 After confirmation, the authentication server 7 is registered in association with this card number from the OTP generation information based on the card information of the card member received before requesting the transmission of the one-time password.
  • the date / time data (year / month / day / second, second is in units of 30 seconds) consisting of the date and time when the authentication server 7 received the one-time password from the member terminal 2 It encrypts with the common key to generate a one-time password and converts it to a decimal number.
  • the encryption method of this embodiment adopts a common key encryption method.
  • the authentication server 7 confirms whether or not the one-time password generated by the authentication server 7 matches the one-time password received from the member terminal 2 earlier. If they match, this one-time password is certainly proved to be a one-time password created at almost the same time by the common key stored only in the net payment assistant device 1 and the authentication server 7.
  • the operator of the member terminal 2 that has transmitted the one-time password to the authentication server 7 stores the common key used to generate the one-time password and the card information associated with the common key.
  • the cardholder who is the operator of the online payment assistance device 1 and who can use the card information, has confirmed the identity of the cardholder who requested the online commerce. Become.
  • the date and time used by the net settlement auxiliary device 1 to generate the one-time password and the authentication server 7 are one.
  • the date and time used to generate the time password are not exactly the same. Therefore, after the authentication server 7 generates the one-time password, the card member presses the start key 12b of the online payment assisting device 1,
  • the second resolution of the date / time data is set to 30 seconds in this embodiment.
  • the card member does not accept the authenticity of the force member.
  • the card member presses the start key 12b of the online payment assisting device 1. If more than 30 seconds elapse between the time when the one-time password is generated and the time when the authentication server 7 receives the one-time password from the member terminal 2, the one-time password does not match. The number of unauthenticated cases will increase, and the convenience of online commerce will be impaired.
  • the authentication server 7 shifts the date and time when the one-time password is received from the member terminal 2 N times before and after X 30 seconds. , Generate a one-time password again on the authentication server 7 side, If it matches the one-time password generated by the customer, the identity of the cardholder is confirmed.
  • N is determined in advance in consideration of security accuracy. That is, if you want to increase the security accuracy, set N small, and if you want to reduce the security accuracy and give priority to the convenience of cardholders, set N large.
  • the authentication server 7 transmits the card member authentication result based on the one-time password verification to the member terminal 2 (S90). Specifically, the authentication server 7 transmits the URL information of the member store terminal 3 to the member terminal 2 in addition to the authentication result, and the authentication result is transferred from the member terminal 2 to the member store terminal 3. Keep it like that.
  • the member terminal 2 Upon receiving the authentication result, the member terminal 2 further transfers the authentication result (personal authentication OK, personal authentication NG) to the Karo Alliance store terminal 3 (S100).
  • the flow of S100 like S70, is performed as a series of flows from S90, and can be realized by the redirect function of the browser of the member terminal 2. In fact, the flow is performed inside the member terminal 2 without the card member being aware of it. It is a flow that is automatically processed.
  • the member store terminal 3 receives the authentication result from the member terminal 2, and if the identity of the card member is confirmed (authentication is OK) as a result of the authentication, the merchant terminal 3 authenticates the card member's authority. In order to make a request, the authentication data is sent to the acquirer terminal 4 and the authentication result is sent to the transaction data consisting of the card member's card information and the desired payment amount (the amount of the product / service the card member is trying to order) (S 110). Note that the transaction data already generated at the time when the order information and the card information are transmitted from the member terminal 2 and stored in the member store terminal 3 may be read in S10.
  • the acquirer terminal 4 Based on the transaction data received from the member store terminal 3 and the authentication result, the acquirer terminal 4 identifies and identifies the card issuer issuer based on the card number of the card member who has been authenticated. The transaction data and the authentication result are transferred to the issuer's issuer terminal 6 (S120).
  • the issuer terminal 6 Upon receiving the transaction data and the authentication result, the issuer terminal 6 determines whether the desired settlement amount included in the transaction data is correct based on the member information and credit information for each member stored in the member database (not shown). Confirm whether the requested cardholder credit limit is within the limits Admit. If the desired amount of payment is within the credit line, ZOOM OK is secured and a credit line equivalent to the desired amount of payment is secured.
  • the issuer terminal 6 transmits the authorization result (authorization OK, authorization NG) to the acquirer terminal 4 (S130), and the acquirer terminal 4 forwards the authorization result to the member store terminal 3. (S 140).
  • the member terminal 3 After the merchant terminal 4 receives the result of the authorization, the member terminal 3 notifies the member terminal 2 of the result (S150). Specifically, if the authorization result is OK, a screen to the effect that online commerce is established between the member store and the card member using the card number of the card member is sent to the member terminal 2. And displayed on member terminal 2. If the result is NG, the screen indicating that Internet commerce has not been established is sent to the member terminal 2 and displayed.
  • the identity authentication using the one-time password in the authentication server 7 is performed each time an online business transaction is performed between the member terminal 2 and the member store terminal 3.
  • the one-time password generated by the OTP generation means 16 of this embodiment is effective for one-time online commerce, a third party who does not have an online payment assistance device temporarily receives a one-time password. Even if eavesdropping, a third party cannot masquerade as a card member and carry out subsequent online commerce, further improving the safety of online commerce.
  • a card member who is distributed with the online payment assistant device la uses the online settlement assistant device la from the personal computer or mobile phone having a communication function to the card member.
  • online commerce is performed by settlement using a card number.
  • the difference between the first embodiment and the present embodiment is that the one-time password generation method of the OTP generation means 16 provided in the net settlement auxiliary device, the stored contents of the OTP generation information storage unit 17, and FIG. This is the contents of the authentication flow (S80, S90) between the member terminal 2 and the authentication server 7 (in this embodiment, the authentication server 7a).
  • the one-time password generation method is the time synchronization method, but in this embodiment, the usage frequency synchronization method is adopted.
  • the time measuring means 18 described in FIG. 1 is replaced with a counting means 18a (not shown).
  • the OTP generation information stored in the OTP generation information storage unit 17 of the present embodiment is composed of a common key unique to the network payment assistance apparatus la and usage count information.
  • the common key is stored in the OTP generation information storage unit 17 in a non-rewritable state, and the authentication server 7a that verifies the one-time password generated by the OTP generation unit 16 uses the card information. Associated with the card number stored in the storage unit 13.
  • the usage count information is stored in the card information storage unit 13 in the authentication server 7a and is associated with the card number.
  • these OTP generation information is stored in the authentication server 7a in a state associated with the card number, and when the authentication server 7a receives the one-time password from the member terminal 2, Like terminal 2, authentication server 7a also generates a one-time password and verifies whether they match, thereby verifying the validity of the one-time password and authenticating the cardholder.
  • the usage count information is information that can be rewritten only when a rewrite command is issued from the OTP generation means 16, and is incremented by 1 such as 0, 1, or 2 by the counting means 18a.
  • the number is added or subtracted one by one, such as 100, 99, 98, etc., and the numerical value after calorie calculation or subtraction is stored in the OTP generation information storage unit 17, and the usage count information is updated. Is done. Whether to add or subtract is determined in advance.
  • the counting means 18a may be included in the OTP generation means 16, or may be provided separately from the OTP generation means 16; in the latter case, the OTP generation means 16 is a counting means. It is necessary to rewrite the usage count information by controlling 18a.
  • the authentication server 7a first sends the one-time password to the member terminal 2.
  • the card member is authenticated based on the one-time password received from the member terminal 2.
  • the authentication server 7a receives the card information and the order information from the member terminal 2 that has accessed, and the card member having this card information has previously received the intermediary server 5 from the member store terminal 3. It is confirmed whether or not the card member has received a request for confirmation of whether or not authentication can be performed. This confirmation is made by keeping a log of whether or not the card member's card information has been received from the intermediary server 5 before a predetermined time, and the card member's card information received from the member terminal 2 is stored. This is done by checking whether or not it matches the card information left in the log a predetermined time ago.
  • the order information is sent from the member store terminal 3 to the authentication server 7a via the mediation server 5 in the flow of S20, 30 but not from the member terminal 2.
  • the URL information of the authentication server 7a is transmitted from the terminal 3 to the member terminal 2, it is transmitted together, and is transferred to the authentication server 7a when the member terminal 2 accesses the authentication server 7a. Also good.
  • the authentication server 7a checks whether the card member of the accessing member terminal 2 is the same as the card member who has received the request to confirm whether or not the member terminal terminal 3 can execute the authentication.
  • the order information may be received by both the member terminal 2 and the member store terminal 3 (directly the intermediary server 5), and these collations may be used together.
  • the authentication server 7a When the authentication server 7a confirms that the access is from the card payment assistant device 1 of the card member that has received the authentication execution feasibility confirmation request first, the authentication server 7a, based on the received order information, Create a one-time password entry screen 101 as shown in Fig. 4 (b), and send it to the member terminal 2 that had access.
  • the one-time password entry screen 101 in Fig. 4 (b) displays the name of the merchant that the card member is engaged in online commerce, the amount of the product / service that the customer is trying to order, and the order date. ing.
  • the card member presses the start key 12b of the net settlement assistant device 1.
  • the OTP generation means 16 of the online payment assistant device 1 detects that the start key 12b has been pressed, Shift to the one-time password generation flow.
  • the OTP generation means 16 reads the common key and usage count information stored in the OTP generation information storage section 17, and encrypts the usage count information with the common key to generate a one-time password. , Make this a decimal number and display on display 11.
  • the one-time password is generated by using a predetermined one-time password generation algorithm for the usage count information.
  • the display 11 of the present embodiment has 8 displayable digits, the display 11 displays the upper 6 to 8 digits of the generated one-time password.
  • the OTP generation information includes, in addition to the above-described usage count information and the common key, other arbitrary information (for example, a policy) that can only be known by both the online payment assistant device la and the authentication server 7a.
  • the usage count information and the arbitrary information may be encrypted with a common key, and a one-time password may be generated.
  • the OTP generation means 16 After generating the one-time password, the OTP generation means 16 causes the counting means 18a to add 1, or subtract the usage frequency information read earlier, and use the usage frequency information in the OTP generation information storage unit 17. Rewrite and update.
  • the card member enters the one-time password displayed on the display 11 of the online payment assistant device 1 in the password input field 101a of the one-time password input screen 101 displayed on the member terminal 2, When the send button 101b is clicked, the entered one-time password is sent to the authentication server 7a.
  • the card member After the one-time password has been entered, the card member re-depresses the start key 12b of the online payment assisting device 1 to display it on the display 11 of the online payment assisting device 1. It is desirable from the security point of view to hide the one-time password. At the same time, the power is also turned off. This is desirable from the viewpoint of energy saving.
  • the authentication server 7a Upon receiving the one-time password from the member terminal 2, the authentication server 7a first confirms that the member terminal 2 is the other party who previously requested the one-time password transmission, such as the identification number of the member terminal 2. This is confirmed by confirming whether or not the response is for the one-time password input screen 101 generated and transmitted individually for the member terminal 2 concerned.
  • the authentication server 7a After confirmation, the authentication server 7a has received it before requesting transmission of a one-time password. Based on the card information of the cardholder, the OTP generated information is registered in association with this card number, the common key and the usage count information are extracted, and the usage count information is encrypted with the common key. Generate a one-time password and convert it to a decimal number.
  • a one-time password is generated by using a predetermined one-time password generation algorithm as usage frequency information.
  • the OTP generation information includes arbitrary information, in addition to the usage count information, the arbitrary information is also encrypted with the common key.
  • the authentication server 7a checks whether or not the one-time password generated by the authentication server 7a matches the one-time password received from the member terminal 2 earlier. If they match, this one-time password is certainly proved to be a one-time password created by the usage count information and the common key stored only in the online payment assisting device 1 and the authentication server 7a.
  • the authentication server 7a sends the card member authentication result (personal authentication OK, personal authentication NG) based on the one-time password verification to the member terminal 2, and the usage count information used for the previous one-time password generation. Are added or subtracted by a predetermined calculation method, and the calculation result is rewritten and updated as use frequency information in the authentication server 7a (S90).
  • the one-time password generation method adopts the usage frequency synchronization method as in the present embodiment, it is assumed that the operator of the member terminal 2 and the net settlement assistant device la is a valid card member. However, the number-of-uses information used for the one-time password generation by the online payment assisting device la and the number-of-uses information used by the authentication server 7a for generating the one-time password may be different and the one-time password may not match.
  • the authentication server 7a sets the usage count information stored in the authentication server 7a to a predetermined range (for example, usage count information + N ), The authentication server 7a regenerates the one-time password, and if it matches the one-time password generated on the member terminal 2, the card member is confirmed.
  • N is determined in advance in consideration of security accuracy. That is, if you want to increase the security accuracy, set N small, and if you want to reduce the security accuracy and give priority to the convenience of cardholders, set N large.
  • the input information input to the online payment assistant device is If the card information does not match the authentication information stored in the payment assistant device, the card information cannot be obtained even by the card member itself. The confidentiality of is increased, and unauthorized use of card information in online commerce is prevented.
  • the online payment assistance device since the online payment assistance device is portable, it is possible to carry out secure online commerce using a mobile phone, a home PC, or a destination PC wherever a cardholder is. The convenience of commerce increases.
  • the card member's personal authentication when online commerce is conducted is based on whether the one-time password generated by the online payment assistant device matches the one-time password generated by the authentication server. It is done by [0200]
  • This one-time password is unique to the online payment assistant device, is stored only in the online payment assistant device and the authentication server, and uses a common key that cannot be known even by the cardholder itself. This is an encryption of date / time data consisting of the date / time when the pressing of the predetermined key is detected or the one-time password is generated and updated usage count information.
  • the one-time password is generated only after the card information is displayed on the network settlement assistant device, the one-time password is not provided.
  • the three parties cannot generate a one-time password even if they only know the card number. Even if a third party steals the online payment assistant, the one-time password cannot be generated without the authentication information to be entered into the online payment assistant. In other words, the safety of online commerce is guaranteed because a third party cannot perform online commerce pretending to be a card member regardless of whether or not an online payment assistance device is available.
  • the one-time password generation method is not limited to the time synchronization method of the above embodiment, and the identity of the cardholder who owns the net payment assistant device is connected between the network payment assistant device and the authentication server. If you can do this,
  • the online payment assistant device adopts a network non-connection type configuration, the card information, authentication information, and OTP generation information once stored in the online payment assistant device are fraudulent. The cardholders who have been distributed with the online payment assistance device cannot read it out by the accessor, etc.!
  • the online payment assistance device can be connected to a terminal such as a personal computer or a mobile phone, if any trouble occurs while connecting the online payment assistance device to the terminal, the cause of the failure is The point of responsibility disaggregation of whether it is on the side of the online payment assisting device or on the terminal side is unclear. Therefore, an online payment assistant device that employs a non-connection-type configuration is effective even in the sense that the point of responsibility resolution becomes clear.
  • FIG. 6 shows the system configuration and flow of pre-registration when a cardholder who does not have an online payment assisting device performs online commerce with the online payment system of the present embodiment.
  • the card member accesses the WEB site for the card member operated by the card company (credit card brand or Ishiyua) from the member PC, and the member information (birth date, telephone number, account number) that only the card member knows Etc.) and send it to the website ((1) in Fig. 6).
  • the website of the card company that received the member information accesses the core system of the card company where the member information is registered, and the received member information and the member information registered in the core system Request verification to the core system ((2) in Fig. 6).
  • the backbone system returns the verification result to the website ((3) in Fig. 6).
  • the website that received the password for the member PC also registers the password in the card server's authentication server 7 ((5) in Fig. 6).
  • the registered password is a fixed password, not a one-time password as generated by the online payment assistant.
  • the card member authentication method uses a fixed password and the card number and the fixed password that can be used by a third party. Once known, it becomes possible for a third party to pretend to be a cardholder and make online payments.
  • the online payment assisting device normally does not expose the card number and can be known only by the card member, or if the authentication information possessed only by the card member is not entered,
  • the password used to authenticate the cardholder during online payment is a one-time password that is not a fixed password, so a third party impersonates a cardholder. It is extremely difficult to conduct online commerce
  • the online payment assistance device of the present invention is limited to the online payment assistance device 1 having all of the configuration requirements described in the above embodiment.
  • various changes and modifications can be made, and the network settlement assistance device of the present invention can be configured by arbitrarily combining the constituent requirements necessary for realizing each purpose. It goes without saying that significant changes and modifications are also within the scope of the claims of the present invention.
  • the online payment using the card number of the credit card has been described.
  • the card can be used for at least the online payment by the card number.
  • An embodiment using a card such as a debit card also falls within the scope of the claims of the present invention.
  • the credit card is used for online commerce using card settlement.
  • a card member wishes only for online commerce and has a credit card that can use conventional plastic-type magnetic cards, IC cards, etc. If you do not wish to have a real face-to-face transaction with a card, you do not need to issue a credit card.
  • Owner of the Internet payment assistance device of the present invention 1S It is necessary to have a conventional plastic type credit card. Flower ,.
  • the card information storage unit 13 of one network payment assisting device 1 stores the card information of one card member having one type of card information
  • the authentication information storage unit 15 stores 1
  • a plurality of card numbers may be stored in the card information storage unit 13.
  • the authentication information in that case may be common authentication information to display multiple card numbers!
  • the card number and the authentication information may correspond to each other, and the card number displayed on the display 11 may be different depending on the input authentication information.
  • authentication information that differs for each person is stored in the authentication information storage unit 15. You can also store common authentication information.
  • the authentication server 7, 7a finally passes through the member store terminal 3, the intermediary service 3 ⁇ 4.
  • the authentication servers 7 and 7a convert the card number of the received card information into a unique number different from the card number and pass through the mediation server 5.
  • this unique number is transmitted from member store terminal 2 to member terminal 2, and transmitted through authentication terminal 7, 7a via member terminal 2 (in S60, 70).
  • the authentication servers 7 and 7a Upon receiving the unique number, the authentication servers 7 and 7a convert the unique number into the card number according to the reverse conversion rule of the card number first converted into the unique number.
  • the OTP generation information associated with the card number is used to generate a one-time password.
  • the unique number other than the card number and the OTP generation information are associated with each other, so that the network 9a except the card number is transmitted by S10, S20, and S30. Since the card number does not flow above, the possibility of eavesdropping on the card number is greatly reduced, which contributes to security improvement.
  • the member terminal 2 transmits card information to the member store terminal 3, and the authentication servers 7, 7a receive the card at S80 in FIG. 2 based on the request from the member store terminal 3.
  • the present invention is not necessarily limited to this.
  • the member terminal 2 accesses the authentication server 7 or 7a, and the authentication server 7 or 7a sends the card member-specific authentication information input screen to the member terminal 2, and is input to the authentication input screen. Based on the received card information and the one-time password, card member identity authentication is performed between the member terminal 2 and the authentication servers 7 and 7a. Within a predetermined time, a predetermined number of times, a predetermined member store, etc.) The website of the member store terminal 3 may be accessed to enable online commerce.
  • the online payment assisting device of the present invention is used for the authentication of the card member between the member terminal 2 and the authentication server 7 or 7a on the card company side. It is based on the fact that online commerce can be performed on the website of the company, and is not necessarily based on the request for authentication from the member terminal 2.
  • Each means and database in the present invention are only logically distinguished in function, and may be physically or virtually identical. Needless to say, a data file may be used instead of a database, and the description of a database includes a data file.
  • the terminal and server capabilities on the online payment system Credit card brand providing entity for online commerce services
  • Ishiyure acquisition of card members' card issuers to card members
  • Aquirer member stores
  • the quirer may be the same, and the turret card brand, issuer, and quirer may be the same.
  • the online payment assisting device 1, la is not limited to the distribution of the issue power. Also, it is not always necessary that the provider of the online payment system is a credit card brand.
  • the issuer terminal 6, the authentication servers 7, 7a, and the acquirer terminal 4 may be the same. Also, the mediation server 5 may be the same as any other terminal or server.
  • a storage medium recording a software program that implements the functions of the present embodiment is supplied to the system, and the computer of the system reads and executes the program stored in the storage medium. This is also realized.
  • the read program itself realizes the functions of the above-described embodiments, and the storage medium storing the program constitutes the present invention.
  • a storage medium for supplying the program for example, a magnetic disk, a hard disk, an optical disk, a magneto-optical disk, a magnetic tape, a nonvolatile memory card, or the like should be used. Can do.
  • the program power from which the storage medium power is read is also written to a nonvolatile or volatile storage means provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer.
  • the processing unit provided in the function expansion board or function expansion unit may perform part or all of the actual processing, and the functions of the above-described embodiments may be realized by the processing. It is included in the present invention.
  • FIG. 1 A configuration diagram showing an external appearance and an electrical hardware configuration of the online settlement assistant device of the present invention.
  • FIG. 2 is a schematic connection configuration diagram of an internet settlement system using an internet settlement assistance device.
  • FIG. 3 is a diagram showing an example of a process flow of an online commerce in the online payment system.
  • FIG. 4 is a diagram showing an example of a screen displayed on a member terminal in the process flow of online commerce in the online payment system.
  • FIG. 5 is a diagram showing an operation procedure and display screen transition of the online settlement assisting device.
  • FIG. 6 Schematic connection configuration diagram of the system required to register a card member's password for authentication in advance when a cardholder uses an online payment system that does not use an online payment assistant. It is.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

[PROBLEMS] A net settlement assisting device free of danger of eavesdropping and false alteration of a card number and a password and enabling more secure net business transaction. [MEANS FOR SOLVING PROBLEMS] A net settlement assisting device comprises a display (11), a card information storage section (13) where card information on a card contractor is so stored in advance as to be prevented from being read from outside, an authentication information storage section (15) where authentication information on the contractor is so stored in advance as to prevented from being read from outside, an OTP creation information storage section (17) where OTP creation information is stored in advance as to be prevented from being read from outside, a numeric keypad (12a), authenticating means (14) for authenticating the operator on the basis of the information inputted by means of the numeric keypad (12a) and displaying the card information on the display (11), and OTP creating means (16) for creating a one-time password according to the OTP creation information after the card information is displayed and displaying the one-time password on the display (11). The contractor is authenticated with the one-time password, thereby enabling a net transaction.

Description

ネット決済補助装置  Online payment assistance device
技術分野  Technical field
[0001] 本発明は、ネット決済補助装置に関する。  [0001] The present invention relates to an online payment assistance device.
背景技術  Background art
[0002] 従来、携帯電話機にクレジットカードや銀行カード等のカード識別情報 (カード番号 )及び暗証番号を格納しておき、携帯電話機に入力された暗証番号と、格納されて V、る暗証番号とがー致した時に、携帯電話機のディスプレイ上にカード番号を表示 することによって、カードとしても機能する携帯電話機がある (例えば、特許文献 1参 照)。  Conventionally, card identification information (card number) such as a credit card or a bank card and a personal identification number are stored in a cellular phone, and the personal identification number input to the cellular phone, the stored V, and personal identification number There is a mobile phone that also functions as a card by displaying a card number on the display of the mobile phone when it is accepted (see, for example, Patent Document 1).
[0003] しかし、このようなカード機能付き携帯電話機には、以下に説明する課題があった。  However, such a cellular phone with a card function has the following problems.
[0004] 特許文献 1 :特開 2002— 64597号公報 [0004] Patent Document 1: Japanese Patent Application Laid-Open No. 2002-64597
発明の開示  Disclosure of the invention
発明が解決しょうとする課題  Problems to be solved by the invention
[0005] 特許文献 1に記載されたカード機能付き携帯電話機へのデータの格納、抹消等が 通信によって行なわれる。つまり、この携帯電話機は、ネットワークに接続されることが 前提となる。 [0005] Data is stored in and deleted from the mobile phone with a card function described in Patent Document 1 through communication. In other words, this mobile phone is assumed to be connected to the network.
[0006] このように、ネットワークに接続可能な携帯電話機に、カード番号や暗証番号を格 納しておくと、不正アクセス等により、悪意の第三者によって、これらのカード番号や 暗証番号が盗聴、改竄される危険性が少な力ゝらずあり、セキュリティ上問題となる。  [0006] As described above, if a card number or a password is stored in a mobile phone that can be connected to a network, the card number or the password may be wiretapped by a malicious third party due to unauthorized access or the like. Therefore, there is little risk of being tampered with, which is a security problem.
[0007] そこで、携帯電話機をネットワークに接続不可能な構成にすれば、上述の盗聴や 改竄の恐れはなくなる力もしれな 、。  [0007] Therefore, if the mobile phone is configured so that it cannot be connected to the network, it may have the power of eliminating the above-mentioned wiretapping and tampering.
[0008] しかし、携帯電話機は、基本となる通話機能に加え、ネットワーク通信機能を有する のが一般的となりつつある昨今、携帯電話機をネットワークに接続不可能な構成とす ることは、現実的に困難である。また、現状の携帯電話機の構成を維持したまま、格 納されて 、るカード番号や暗証番号を外部力 読み出せな 、ようにするためには、 暗号ィ匕プログラム等を備える必要があり、構成が複雑となる。 [0009] また、特許文献 1の携帯電話機の場合、上述のネットワークを介した不正アクセスに よらずとも、携帯電話機のディスプレイに表示されたカード番号を、一度、第三者に 盗み見られてしまうと、第三者がそのカード番号を用いて、インターネット上でクレジッ ト決済によるネット商取引を行なうことが可能となってしまい、この点でのセキュリティも 低い。 [0008] However, it is becoming common for mobile phones to have a network communication function in addition to the basic call function. In recent years, it has been practical to configure a mobile phone so that it cannot be connected to a network. Have difficulty. In addition, it is necessary to provide an encryption key program, etc., in order to prevent the card number and password from being stored and stored in the current mobile phone configuration without being externally read. Becomes complicated. [0009] In addition, in the case of the mobile phone of Patent Document 1, if the card number displayed on the display of the mobile phone is once stolen by a third party, regardless of unauthorized access via the network described above. As a result, a third party can use the card number to conduct online commerce by credit settlement on the Internet, and security in this respect is also low.
[0010] 尚、本件特許出願人は、上記のような、カード番号のみでネット商取引を行なうこと が出来るという事情に鑑みて、カード番号の提示にカ卩え、カード会員が予め定めた固 定パスワードの提示によってカード会員の本人認証を経なければ、ネット商取引が行 えな ヽと 、うネット決済システムの運用を開始して 、る。  [0010] In consideration of the fact that the above-mentioned circumstances allow online commerce using only a card number, the applicant of the present patent is not allowed to present the card number and is fixed by the card member in advance. If the card member's identity is not verified by presenting the password, online commerce will not be possible.
[0011] しかし、この固定パスワードも、一度、第三者に知られてしまえば、やはり第三者が カード会員になりすましてネット商取引を行なうことが可能となってしまい、必ずしも安 全なものとは言えない。  [0011] However, once this fixed password is also known to a third party, it becomes possible for the third party to pretend to be a card member and conduct online commerce, which is not necessarily safe. I can't say that.
[0012] 本発明は、以上のような従来の問題点に鑑みてなされたものであって、その目的と するところは、不正アクセス等によりカード番号や暗証番号を盗聴、改竄される危険 性がなぐかつ、より安全にネット商取引を行なうことが出来るネット決済補助装置を 提供することにある。  [0012] The present invention has been made in view of the above-described conventional problems, and the object of the present invention is the risk of eavesdropping or tampering with a card number or PIN by unauthorized access or the like. The aim is to provide an online payment assistance device that enables safe and secure online commerce.
課題を解決するための手段  Means for solving the problem
[0013] 請求項 1の発明は、  [0013] The invention of claim 1
可搬型のネット決済補助装置であって、ディスプレイと、クレジットカードゃデビット力 ード等のカード契約者の識別情報を少なくとも含むカード情報が、外部力 読み出せ な 、ような状態で予め格納されたカード情報格納部と、前記契約者の本人認証を行 なうための認証情報が、外部力 読み出せな 、ような状態で予め格納された認証情 報格納部と、前記カード情報に関連付けられ前記ネット決済補助装置に固有の OTP 生成情報が、外部力 読み出せな 、ような状態で予め格納された OTP生成情報格 納部と、前記認証情報を入力する入力手段と、前記入力手段から入力された入力情 報に基づいて、前記ネット決済補助装置の操作者が、前記契約者であるか否かの本 人認証を行ない、本人確認がなされた場合、前記カード情報のうち、少なくとも前記 識別情報を読み出して、前記ディスプレイに表示する認証手段と、前記カード情報が 表示された後、前記 OTP生成情報に基づいて、ワンタイムパスワードを生成し、前記 ディスプレイに表示するワンタイムノ スワード生成手段とを備え、前記ワンタイムノ ス ワードによって、前記契約者の本人認証が行なわれ、本人確認がなされた場合、前 記識別情報を用いた決済によるネット商取引が可能にされることを特徴とするネット 決済補助装置である。 It is a portable online payment assistant device, and the card information including at least the identification information of the card contractor such as a credit card or debit force card is stored in advance in such a state that it cannot be read by an external force. A card information storage unit, an authentication information storage unit stored in advance in such a state that authentication information for authenticating the subscriber's identity cannot be read by an external force, and the card information associated with the card information The OTP generation information unique to the online payment assistance device is stored in advance in such a state that the external force cannot be read, the OTP generation information storage unit stored in advance, the input means for inputting the authentication information, and the input means. If the operator of the online payment assisting device authenticates the identity of the contractor based on the input information and confirms the identity, at least a part of the card information is included. Both the authentication means for reading the identification information and displaying it on the display, and the card information And a one-time password generating means for generating a one-time password based on the OTP generation information and displaying it on the display. The one-time password is used to authenticate the subscriber and When the confirmation is made, the online payment assisting device is characterized in that the online commerce by the payment using the identification information is made possible.
[0014] 請求項 2の発明は、  [0014] The invention of claim 2
クレジットカードゃデビットカード等のカード契約者の携帯電話やパーソナルコンビュ ータ等の契約者端末と、前記契約者の本人認証を行なう認証サーバとが、相互にネ ットワーク接続されたネット決済システムにお 、て、前記契約者の識別情報を用いた 決済によるネット商取引を行なう際に用いられる、可搬型のネット決済補助装置であ つて、前記ネット決済補助装置は、ディスプレイと、前記契約者の識別情報を少なくと も含むカード情報が、外部から読み出せないような状態で予め格納されたカード情報 格納部と、前記契約者の本人認証を行なうための認証情報が、外部から読み出せな V、ような状態で予め格納された認証情報格納部と、前記カード情報に関連付けられ 前記ネット決済補助装置に固有の OTP生成情報が、外部力 読み出せないような状 態で予め格納された OTP生成情報格納部と、前記認証情報を入力する入力手段と 、前記入力手段から入力された入力情報に基づいて、前記ネット決済補助装置の操 作者が、前記契約者である力否かの本人認証を行ない、本人確認がなされた場合、 前記カード情報のうち、少なくとも前記識別情報を読み出して、前記ディスプレイに表 示する認証手段と、前記カード情報が表示された後、前記 OTP生成情報に基づい て、ワンタイムパスワードを生成し、前記ディスプレイに表示するワンタイムパスワード 生成手段とを備え、前記契約者端末が、前記ワンタイムパスワードを前記認証サーバ に送信することによって、前記契約者の本人認証が行なわれ、本人確認がなされた 場合、前記ネット商取引が可能にされることを特徴とするネット決済補助装置である。  In a network settlement system in which a credit card or debit card or the like, a contractor terminal such as a cellular phone or personal computer, and an authentication server for authenticating the contractor are connected to each other via a network. A portable online payment assistance device used when performing online commerce by payment using the contractor identification information, the internet payment assistance device comprising a display and the contractor identification information. The card information storage unit that is stored in advance so that the card information including at least cannot be read from the outside, and the authentication information for authenticating the contractor cannot be read from the outside. Authentication information storage unit stored in advance and the OTP generation information associated with the card information and unique to the online payment assisting device are externally read. Based on the input information input from the input means, the OTP generation information storage unit stored in advance so as not to be output, the input means for inputting the authentication information, the operator of the online payment assisting device If the identity of the contractor is verified and the identity is confirmed, at least the identification information is read out of the card information and displayed on the display, and the card information is And a one-time password generating unit that generates a one-time password based on the OTP generation information and displays the one-time password on the display, and the contractor terminal transmits the one-time password to the authentication server. In this way, when the identity of the contractor is verified and the identity is confirmed, the online commerce is enabled. It is an online payment assisting device.
[0015] 請求項 1及び請求項 2の発明によれば、ネット決済補助装置によって契約者の本人 認証の結果、本人確認がなされなければ、契約者自身であってもカード情報を知る ことが出来ず、カード情報は、外部力 読み出せないような状態で格納されているの で、カード情報が露出している従来のクレジットカードと異なり、カード情報の秘匿性 が高まり、ネット商取引におけるカード情報の不正使用が防止される。 [0015] According to the invention of claim 1 and claim 2, if the identity verification of the contractor is not performed as a result of the identity verification of the contractor by the online payment assisting device, even the contractor himself / herself can know the card information. The card information is stored in such a way that it cannot be read by an external force. Therefore, unlike conventional credit cards where the card information is exposed, the confidentiality of the card information. And unauthorized use of card information in online commerce is prevented.
[0016] また、ネット決済補助装置は可搬型であるので、契約者がどこにいても、携帯電話、 自宅のパソコン、出先のパソコンを用いて、安全なネット商取引を行なうことが出来、 ネット商取引の利便性が増す。  [0016] In addition, since the online payment assisting device is portable, it is possible to carry out secure online commerce using a mobile phone, a home personal computer, or a personal computer wherever the contractor is, Convenience increases.
[0017] また、契約者の本人認証に、ネット決済補助装置に格納された契約者固有の OTP 生成情報に基づいて作成されたワンタイムノ スワードを用いるので、第三者が、仮に ワンタイムパスワードを入手しても、次のネット商取引には使えない。  [0017] In addition, since a one-time password created based on the contractor-specific OTP generation information stored in the online payment assistant device is used for authenticating the contractor, a third party temporarily obtains a one-time password. However, it cannot be used for the next online commerce.
[0018] ワンタイムパスワード生成用の OTP生成情報は、外部から読み出せないような状態 で格納されているので、契約者本人であっても、 OTP生成情報を知ることは出来ず、 ネット決済補助装置を操作している契約者本人のみが生成結果のワンタイムパスヮ ードを知ることが出来る。つまり、第三者によるワンタイムパスワード生成は出来ない ので、より、ネット商取引の安全性が保証される。  [0018] Since the OTP generation information for one-time password generation is stored in a state that cannot be read from the outside, even the contractor himself cannot know the OTP generation information, and the online payment assistance Only the contractor operating the device can know the one-time passcode of the generation result. In other words, since a one-time password cannot be generated by a third party, the safety of online commerce is further guaranteed.
[0019] しかも、このワンタイムパスワードの生成は、ネット決済補助装置にカード情報が表 示された後でなければ、行なわれないようになっているので、ネット決済補助装置を 有していない第三者は、識別情報のみを知っていても、ワンタイムパスワードの生成 が出来ない。また、第三者がネット決済補助装置を盗んだとしても、ネット決済補助装 置に入力する認証情報がなければ、ワンタイムパスワードの生成が出来ない。  [0019] In addition, the one-time password is generated only after the card information is displayed on the online payment assisting device. Even if the three parties know only the identification information, they cannot generate a one-time password. In addition, even if a third party steals the online payment assistant device, the one-time password cannot be generated without the authentication information to be entered into the online payment assistant device.
[0020] つまり、契約者は、ネット決済補助装置の認証手段によって本人認証を受けた後、 更に、認証サーバによって本人認証を受けることになり、最終的にネット商取引が可 能となるまでに 2種類の異なる認証情報に基づく本人認証を経なければ 、けな 、の で、第三者によるなりすましがより防止され、ネット商取引の安全性が高まる。  [0020] In other words, after the contractor receives the personal authentication by the authentication means of the online payment assisting device, the contractor further receives the personal authentication by the authentication server, and finally the online commerce is possible. Without personal authentication based on different types of authentication information, spoofing by third parties is further prevented and the safety of online commerce is increased.
[0021] 請求項 3の発明は、  [0021] The invention of claim 3
前記認証情報は、前記契約者が予め定めた暗証番号であり、前記入力手段は、テン キーであることを特徴とするネット決済補助装置である。  The authentication information is a personal identification number predetermined by the contractor, and the input means is a numeric keypad.
[0022] 請求項 3の発明によれば、入力手段及び認証手段を比較的安価に構成することが 出来るので、ネット決済補助装置の利用促進が図られる。  [0022] According to the invention of claim 3, since the input means and the authentication means can be configured at a relatively low cost, the use of the online payment assisting device can be promoted.
[0023] 請求項 4の発明は、  [0023] The invention of claim 4
前記認証情報は、前記契約者の指紋 ·虹彩 ·声帯 ·顔写真等の生体的特徴を数値化 した生体情報であることを特徴とするネット決済補助装置である。 The authentication information quantifies the biometric features of the contractor's fingerprint, iris, vocal cord, facial photograph, etc. This is a network settlement auxiliary device characterized in that it is biometric information.
[0024] 請求項 4の発明によれば、高精度で契約者の本人認証が行えるようになるので、仮 にネット決済補助装置を盗まれても、悪用される恐れのないネット決済補助装置とな る。  [0024] According to the invention of claim 4, since the identity of the contractor can be authenticated with high accuracy, even if the online payment assistant device is stolen, there is no possibility of being misused. Become.
[0025] 請求項 5の発明は、  [0025] The invention of claim 5 provides:
前記 OTP生成情報は、共通鍵であり、前記ワンタイムパスワード生成手段は、所定 の操作キーの押下を検出して、前記操作キーが押下された日時からなる日時データ を、前記共通鍵によって暗号ィ匕してワンタイムパスワードを生成することを特徴とする ネット決済補助装置である。  The OTP generation information is a common key, and the one-time password generation means detects the pressing of a predetermined operation key, and encrypts date and time data including the date and time when the operation key is pressed with the common key. This is an online payment assistance device characterized by generating a one-time password.
[0026] 請求項 6の発明は、  [0026] The invention of claim 6
前記 OTP生成情報は、共通鍵と、前記ンタイムパスワードが生成される都度、更新さ れる利用回数情報によって構成され、前記ワンタイムパスワード生成手段は、所定の 操作キーの押下を検出して、前記利用回数情報を共通鍵によって暗号ィ匕してワンタ ィムパスワードを生成し、前記ワンタイムパスワードが生成された後、前記 OTP生成 情報格納部内の利用回数情報を更新するネット決済補助装置である。  The OTP generation information is composed of a common key and usage count information that is updated each time the one-time password is generated, and the one-time password generation means detects pressing of a predetermined operation key, and This is a network settlement auxiliary device that encrypts usage count information with a common key to generate a one-time password, and updates the usage count information in the OTP generation information storage after the one-time password is generated.
[0027] ここで生成されるワンタイムパスワードは、共通鍵を用いて、所定キーが押下された 日時からなる日時データもしくはワンタイムパスワードの生成都度、更新される利用回 数情報を暗号ィ匕したものである。つまり、ネット決済補助装置を操作している契約者 のみが作成可能なパスワードであるから、ネット決済補助装置を所持して 、な 、第三 者が、契約者になりすましてネット商取引を行なうことは出来ず、ネット商取引の安全 性が更に向上する。  [0027] The one-time password generated here uses a common key to encrypt the date / time data consisting of the date and time when the predetermined key was pressed or the usage count information that is updated each time a one-time password is generated. Is. In other words, since it is a password that can only be created by a contractor operating the online payment assistant, it is not possible for a third party to carry out online commerce by impersonating a contractor in possession of the online payment assistant. Unable to improve the safety of online commerce.
[0028] 請求項 7の発明は、  [0028] The invention of claim 7
前記ネット決済補助装置は、耐タンパ性を備えることを特徴とするネット決済補助装 置である。  The online payment assistance device is an online payment assistance device having tamper resistance.
[0029] 請求項 7の発明によれば、ネット決済補助装置が、耐タンパ性を備えるので、第三 者によるカード情報、認証情報、 OTP生成情報の盗聴、改竄に対する更なるセキユリ ティ向上が図られる。  [0029] According to the invention of claim 7, since the online payment assisting device has tamper resistance, it is possible to further improve security against eavesdropping and tampering of card information, authentication information, and OTP generation information by a third party. It is done.
発明の効果 [0030] 本発明のネット決済補助装置によれば、ネット決済補助装置によって契約者の本人 認証の結果、本人確認がなされなければ、契約者自身であってもカード情報を知る ことが出来ず、カード情報は、外部力 読み出せないような状態で格納されているの で、カード情報が露出している従来のクレジットカードと異なり、カード情報の秘匿性 が高まり、ネット商取引におけるカード情報の不正使用が防止される。 The invention's effect [0030] According to the online settlement assistant device of the present invention, if the identity verification of the contractor is not performed by the online settlement assistant device, the card information cannot be obtained even by the contractor himself, Card information is stored in a state that cannot be read by an external force. Unlike conventional credit cards that expose card information, the card information is more confidential and unauthorized use of card information in online commerce. Is prevented.
[0031] また、ネット決済補助装置は可搬型であるので、契約者がどこにいても、携帯電話、 自宅のパソコン、出先のパソコンを用いて、安全なネット商取引を行なうことが出来、 ネット商取引の利便性が増す。  [0031] Further, since the online payment assisting device is portable, it is possible to conduct safe online commerce using a mobile phone, a home personal computer, or a personal computer at a destination, wherever the contractor is. Convenience increases.
[0032] また、契約者の本人認証に、ネット決済補助装置に格納された契約者固有の OTP 生成情報に基づいて作成されたワンタイムノ スワードを用いるので、第三者が、仮に ワンタイムパスワードを入手しても、次のネット商取引には使えない。  [0032] Since a one-time password created based on the contractor-specific OTP generation information stored in the online payment assistant is used for the authentication of the contractor, a third party temporarily obtains a one-time password. However, it cannot be used for the next online commerce.
[0033] ワンタイムパスワード生成用の OTP生成情報は、外部から読み出せないような状態 で格納されているので、契約者本人であっても、 OTP生成情報を知ることは出来ず、 ネット決済補助装置を操作している契約者本人のみが生成結果のワンタイムパスヮ ードを知ることが出来る。つまり、第三者によるワンタイムパスワード生成は出来ない ので、より、ネット商取引の安全性が保証される。  [0033] Since the OTP generation information for one-time password generation is stored in a state that cannot be read from the outside, even the contractor himself cannot know the OTP generation information, and the online payment assistance Only the contractor operating the device can know the one-time passcode of the generation result. In other words, since a one-time password cannot be generated by a third party, the safety of online commerce is further guaranteed.
[0034] しかも、このワンタイムパスワードの生成は、ネット決済補助装置にカード情報が表 示された後でなければ、行なわれないようになっているので、ネット決済補助装置を 有していない第三者は、識別情報のみを知っていても、ワンタイムパスワードの生成 が出来ない。また、第三者がネット決済補助装置を盗んだとしても、ネット決済補助装 置に入力する認証情報がなければ、ワンタイムパスワードの生成が出来ない。  [0034] In addition, since the one-time password is generated only after the card information is displayed on the network settlement assistant device, the one-time password is not provided. Even if the three parties know only the identification information, they cannot generate a one-time password. In addition, even if a third party steals the online payment assistant device, the one-time password cannot be generated without the authentication information to be entered into the online payment assistant device.
[0035] つまり、契約者は、ネット決済補助装置の認証手段によって本人認証を受けた後、 更に、認証サーバによって本人認証を受けることになり、最終的にネット商取引が可 能となるまでに 2種類の異なる認証情報に基づく本人認証を経なければ 、けな 、の で、第三者によるなりすましがより防止され、ネット商取引の安全性が高まる。  [0035] In other words, after the contractor receives the personal authentication by the authentication means of the online payment assisting device, the contractor further receives the personal authentication by the authentication server, and finally the online commerce is possible. Without personal authentication based on different types of authentication information, spoofing by third parties is further prevented and the safety of online commerce is increased.
発明を実施するための最良の形態  BEST MODE FOR CARRYING OUT THE INVENTION
[0036] 以下、本発明の好適な実施の形態について、添付図面に基づいて詳細に説明す る。図 1 (a)は、ネット決済補助装置 1の外観図であり、図 1 (b)は、ネット決済補助装 置 1の電気的ハードウェアの構成図である。 Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Fig. 1 (a) is an external view of the online payment assistant device 1, and Fig. 1 (b) is an online payment assistant device. FIG. 3 is a configuration diagram of electrical hardware of device 1;
[0037] ネット決済補助装置 1は、クレジットカードゃデビットカード等のカード契約者の契約 者端末 (携帯電話やパーソナルコンピュータ等)と、契約者の本人認証を行なう認証 サーバ (通常、カード会社が保有)が、相互にネットワーク接続されたネット決済シス テムにおいて、契約者が当該契約者の識別情報を用いた決済により、ネットショツビ ング等のネット商取引を行なう際に用いられるものであり、図 1 (a)に示されるように、 手のひらに収まる程度の外形を有し、薄型で持ち運びが可能な筐体 10で構成され、 筐体 10の外表面に、ディスプレイ 11と、キー操作部 12が露出している。 [0037] The online payment assistance device 1 includes a cardholder's subscriber terminal (such as a mobile phone or personal computer) such as a credit card or a debit card, and an authentication server (usually owned by the card company). ) are mutually in a networked net settlement system, the settlement subscriber with identification information of the subscriber, which is used when performing a net transactions such Nettoshotsubi ring, FIG. 1 (a ), It has a shape that fits in the palm of your hand, and is composed of a thin and portable case 10.The display 11 and key operation unit 12 are exposed on the outer surface of the case 10. Yes.
[0038] 尚、本実施例のディスプレイ 11は、 8桁の表示ディスプレイであり、キー操作部 12 は、 0〜9までのテンキー 12aと、スタートキー 12bとから構成される。  The display 11 of the present embodiment is an 8-digit display, and the key operation unit 12 includes a numeric keypad 12a from 0 to 9 and a start key 12b.
[0039] 筐体 10の内部は、図 1 (b)に示すように、ディスプレイ 11、キー操作部 12の他、力 ード情報格納部 13、認証情報格納部 15、認証手段 14、 OTP生成手段 16、 OTP生 成情報格納部 17、計時手段 18として各々機能するためのハードウ ア (CPU、メモ リ）と、これらのハードウェア電気部品（ディスプレイ 11、キー操作部 12、 CPU,メモリ )を駆動するための駆動用電源 19 (電池）によって構成される。  [0039] As shown in FIG. 1 (b), the inside of the housing 10 includes a display 11, a key operation unit 12, a force information storage unit 13, an authentication information storage unit 15, an authentication unit 14, and an OTP generation. Means 16, OTP generation information storage 17 and hardware (CPU, memory) for functioning as timekeeping means 18 and these hardware electrical components (display 11, key operation unit 12, CPU, memory) It is composed of a driving power source 19 (battery) for driving.
[0040] 尚、本実施例の筐体 11には、ディスプレイ 11とキー操作部 12と駆動用電源 19の 他、 SIM等の ICカードを内蔵するスロットが設けられており、当該スロットに ICカード を挿入して用いる。そして、上記 CPUとメモリは、この ICカードに含まれるものを使用 する。後述するように、カード情報格納部 13、認証情報格納部 15、 OTP生成情報格 納部 17には、契約者毎に異なる情報が記憶されるので、このような情報を ICカード のメモリに格納して、スロットに挿入して用いることで、筐体 11自体は、契約者によら ず、共通のものでよぐまた、筐体 11自体に個人情報を保有しないので、筐体 11の 生産性が向上するとともに、筐体 11の取り扱い、管理が容易となる。  [0040] The casing 11 of the present embodiment is provided with a slot for incorporating an IC card such as a SIM in addition to the display 11, the key operation unit 12, the driving power source 19, and the IC card is provided in the slot. Insert and use. The CPU and memory used in this IC card are used. As will be described later, since the card information storage unit 13, the authentication information storage unit 15, and the OTP generation information storage unit 17 store different information for each contractor, such information is stored in the memory of the IC card. Thus, the case 11 itself can be used in common without relying on the contractor by inserting it into the slot. Also, since the case 11 itself does not hold personal information, the productivity of the case 11 can be reduced. And the handling and management of the housing 11 become easy.
[0041] また、本実施例の駆動用電源 19は、ボタン電池である力 太陽電池や充電池等で あってもよい。また、ネット決済補助装置 1は、通常時は電源オフ状態にしておき、例 えば、キー操作部 12のいずれかのキー操作があった場合に、電源起動するようにな つていてもよい。  [0041] Further, the driving power source 19 of the present embodiment may be a force solar cell or a rechargeable battery that is a button battery. In addition, the online payment assisting apparatus 1 may be in a power-off state during normal operation, and for example, the power may be activated when any key operation of the key operation unit 12 is performed.
[0042] 本実施例のカード情報格納部 13、認証情報格納部 15、 OTP生成情報格納部 17 は、具体的には、後述するカード情報、認証情報、 OTP生成情報を各々格納するメ モリによって構成されており、メモリは、物理的には、これら情報をまとめて格納する 1 つのメモリであってもよ 、し、 2以上のメモリであってもよ!/、。 [0042] The card information storage unit 13, the authentication information storage unit 15, and the OTP generation information storage unit 17 of the present embodiment. Specifically, it is composed of memory that stores card information, authentication information, and OTP generation information, which will be described later, and the memory is physically a single memory that stores these information together. But you can have more than 2 memories! /.
[0043] 本実施例の認証手段 14及び OTP生成手段 16は、具体的には、メモリに格納され たプログラムによって構成されており、ネット決済補助装置 1内の CPU力 当該プログ ラムをメモリから読み出して実行することによって、これら認証手段 14及び OTP生成 手段 16の機能が実現されることになる。尚、 CPU,メモリを備えないネット決済補助 装置においては、認証手段 14、 OTP生成手段 16の機能が、電子部品を用いて回 路的に実現されてもよい。  [0043] Specifically, the authentication means 14 and the OTP generation means 16 of the present embodiment are configured by a program stored in a memory, and the CPU power in the net settlement assistant device 1 reads the program from the memory. As a result, the functions of the authentication means 14 and the OTP generation means 16 are realized. It should be noted that in the online payment assisting device that does not include a CPU and a memory, the functions of the authentication means 14 and the OTP generation means 16 may be realized circuitically using electronic components.
[0044] 本実施例のネット決済補助装置 1は、クレジットカードブランドとのライセンス契約に 基づ 、てクレジットカードを発行するイシユア（デビットカードであれば、デビットカード を発行する銀行もしくはカード発行会社)力 個々のカード会員である契約者に対し 、イシユアにおいて契約者毎に固有のカード情報、認証情報、 OTP生成情報力 Sメモ リに記録された状態で、配布 (配布形態は、貸与、譲渡いずれもよい）されるものであ り、配布後は、メモリ (カード情報格納部 13、認証情報格納部 15、 OTP生成情報格 納部 17)の格納内容を、外部から読み出すことが出来な 、ように構成されて 、る。  [0044] The online payment assisting device 1 of this embodiment is an issuer that issues a credit card based on a license contract with a credit card brand (if it is a debit card, a bank or a card issuing company that issues the debit card). Distribution to individual cardholder subscribers with card information, authentication information, and OTP generation information that is unique to each subscriber at ISHIRE. The contents stored in the memory (card information storage unit 13, authentication information storage unit 15, OTP generation information storage unit 17) cannot be read from the outside after distribution. It is composed of
[0045] また、ネット決済補助装置 1を配布された契約者自身であっても、メモリの記録内容 を外部力 読み出すことは出来ない。契約者自身は、契約者の本人認証が行なわれ 、本人と確認された場合に限り、カード情報がディスプレイ 11に表示されることによつ て、当該カード情報のみ、知ることが出来、それ以外の状態においては、カード情報 は秘匿ィ匕されている。  [0045] Further, even the contractor himself / herself who has been distributed with the online payment assisting apparatus 1 cannot read out the recorded contents of the memory. The contractor himself / herself can know only the card information by displaying the card information on the display 11 only when the identity of the contractor is verified and the identity of the contractor is confirmed. In this state, the card information is kept secret.
[0046] メモリの格納内容を、外部から読み出すことが出来ないようになっているのは、ネット 決済補助装置 1がインターネット等のネットワークに接続されるインターフェースを備 えて 、な 、、ネット非接続型の端末であるからである。  [0046] The contents stored in the memory cannot be read from the outside because the network settlement assistant device 1 has an interface connected to a network such as the Internet, and is not connected to the network. This is because it is a terminal.
[0047] 尚、メモリの格納内容の盗聴、改竄に対する更なるセキュリティ向上のため、ネット 決済補助装置 1または、ネット決済補助装置 1に内蔵される SIM等の ICカードが、耐 タンパ性 (分解して、メモリから直接記録内容を読み出そうとすると、メモリの記録内容 が消去されたり、プログラムが起動しなくなる性質)を備えていてもよい。 [0048] 以下、ネット決済補助装置 1の各部の詳細について説明する。 [0047] In order to further improve security against eavesdropping and tampering with the contents stored in the memory, the Internet payment assistance device 1 or the IC card such as SIM built in the internet payment assistance device 1 is tamper resistant (disassembled). Thus, if the recorded content is read directly from the memory, the recorded content in the memory may be erased or the program may not start. [0048] Details of each part of the online settlement assisting apparatus 1 will be described below.
[0049] カード情報格納部 13は、契約者の識別情報を少なくとも含むカード情報が、外部 力 読み出せないような状態で予め格納されたメモリであり、本実施例のカード情報 は、契約者固有の識別情報 (カード番号)と、有効期限と、セキュリティコード (所定の 方法により予め暗号ィ匕した 3桁の 10進数。通常、プラスチックタイプのクレジットカー ドのサインパネルに印字されている。この数字によって、カードの真正性を確認するこ とが出来る）から構成される。また、名義人名が含まれていてもよい。また、単にカード 情報が識別情報のみで構成されていてもよい。また、有効期限、セキュリティコード、 名義人名の全てをカード情報が含む必要はなぐ適宜 1以上組み合わせてカード情 報が構成されていてもよい。 [0049] The card information storage unit 13 is a memory in which card information including at least contractor identification information is stored in advance in a state in which it cannot be read by an external force. The card information in this embodiment is unique to the contractor. Identification information (card number), expiry date, and security code (a three-digit decimal number encrypted in advance by a predetermined method. Usually printed on the sign panel of a plastic credit card. The authenticity of the card can be confirmed. The name of the holder may also be included. Further, the card information may be composed only of identification information. In addition, the card information may be configured by combining one or more of the expiration date, security code, and the holder's name as appropriate.
[0050] 認証情報格納部 15は、契約者が定めた暗証番号や、契約者の指紋、虹彩、声帯、 顔写真等の生体的特徴を数値化した生体情報等、契約者の本人認証を行なうため の認証情報が、外部力 読み出せな 、ような状態で予め格納されたメモリである。 [0050] The authentication information storage unit 15 authenticates the contractor, such as a personal identification number determined by the contractor, or biometric information obtained by quantifying the biometric characteristics of the contractor's fingerprint, iris, vocal cord, facial photograph, and the like. This is a memory in which authentication information is stored in advance in such a state that the external information cannot be read.
[0051] 尚、認証情報格納部 15に格納される認証情報は、ネット決済システムにおける認 証サーバが契約者の本人認証に用いる認証情報とは異なり、ネット決済補助装置 1 が契約者の本人認証を行なうために必要な認証情報である。また、認証サーバにお ける認証情報とネット決済補助装置 1における認証情報は、種類が異なるものである [0051] The authentication information stored in the authentication information storage unit 15 is different from the authentication information used by the authentication server in the online payment system for authenticating the contractor. This is authentication information necessary for performing Also, the authentication information in the authentication server and the authentication information in the network settlement assistant device 1 are of different types.
[0052] OTP生成情報格納部 17は、ネット決済補助装置 1に固有の OTP生成情報が、外 部から読み出せないような状態で予め格納されたメモリであり、本実施例の OTP生成 情報は、ネット決済補助装置 1に固有の共通鍵であり、共通鍵は、 OTP生成手段 16 で生成されたワンタイムパスワードの検証を行なうサーバ（後述の実施例における認 証サーバ）において、カード情報格納部 13に格納されている識別情報と関連付けら れている。 [0052] The OTP generation information storage unit 17 is a memory in which the OTP generation information unique to the online settlement assistant device 1 is stored in advance so that it cannot be read from the outside. The OTP generation information of this embodiment is , Which is a common key unique to the network settlement assistant device 1, and the common key is a card information storage unit in a server (authentication server in the embodiment described later) that verifies the one-time password generated by the OTP generation means 16. It is associated with the identification information stored in 13.
[0053] 尚、共通鍵は、ネット商取引において、契約者の本人認証を行なう認証サーバと、 ネット決済補助装置 1のみに格納された鍵であり、本実施例では、後述の OTP生成 手段 16が、ワンタイムパスワードを生成するのに用いられる。  It should be noted that the common key is a key stored only in the authentication server for authenticating the contractor's identity and the net settlement assistant device 1 in the net commerce. In this embodiment, the OTP generation means 16 described later is used. Used to generate a one-time password.
[0054] 認証手段 14は、ネット決済補助装置 1の操作者が、カード情報格納部 13に格納さ れて 、る識別情報を利用可能な契約者 (カード会員）であるか否かの本人認証を行 なう手段であり、入力手段 (本実施例では、テンキー 12a)力も入力された入力情報と 、認証情報格納部 15に格納されている認証情報と一致するか確認し、一致した場合 に、ネット決済補助装置 1の操作者が当該契約者本人であるものとして、カード情報 格納部 13に格納されているカード情報のうち、少なくとも識別情報を読み出して、デ イスプレイ 11に表示する手段である。 The authentication means 14 is stored in the card information storage unit 13 by the operator of the online payment assisting apparatus 1. Therefore, it is a means for authenticating the identity of the contractor (card member) who can use the identification information, and the input means (in this embodiment, the numeric keypad 12a). The authentication information storage unit 15 checks whether it matches the authentication information stored in the authentication information storage unit 15, and if it matches, stores it in the card information storage unit 13 as if the operator of the online payment assisting device 1 is the contractor himself / herself. It is a means for reading out at least identification information from the displayed card information and displaying it on the display 11.
[0055] 本実施例の認証手段 14は、操作者が、キー操作部 12のスタートキー 12bを押下す ることで、スタートキー 12bの押下検出を受けて起動する。更にその後、操作者が、入 力手段に相当するテンキー 12aを押下して 4桁の数字を入力すると、認証手段 14は 、入力された数字が、認証情報格納部 15に格納されている暗証番号と一致するか否 かを確認し、一致した場合にディスプレイ 11にカード情報を表示する。  The authentication unit 14 according to the present embodiment is activated upon detection of pressing of the start key 12b by the operator pressing the start key 12b of the key operation unit 12. Thereafter, when the operator depresses the numeric keypad 12a corresponding to the input means and inputs a four-digit number, the authentication means 14 receives the code number stored in the authentication information storage unit 15 as the authentication number. If it matches, the card information is displayed on the display 11.
[0056] 認証情報が本実施例のように暗証番号であれば、入力手段としてテンキーがあれ ばよぐ入力情報と認証情報の一致判定処理も容易に行なわれるので、比較的安価 な構成でネット決済装置 1が実現され、ネット決済装置 1の利用促進が図られる。  If the authentication information is a personal identification number as in the present embodiment, it is sufficient if there is a numeric keypad as the input means, and the matching process between the input information and the authentication information can be easily performed. Payment device 1 is realized, and use of network payment device 1 is promoted.
[0057] 本実施例の認証情報は 4桁の暗証番号となるが、認証方法及び認証情報は、これ に限らず、複数の認証方法による認証手段が適宜、組み合わせられてもよぐ複数の 認証手段を採用すれば、それだけ認証精度が高まり、第三者によるネット決済補助 装置の悪用が防止される。  [0057] The authentication information of the present embodiment is a 4-digit password, but the authentication method and authentication information are not limited to this, and a plurality of authentication methods may be used in which authentication means using a plurality of authentication methods may be appropriately combined. By adopting this method, the accuracy of authentication increases, and the abuse of the online payment assistance device by a third party is prevented.
[0058] 例えば、認証手段 14が、バイオメトリタス認証方法を採用して 、れば、認証情報は 、ノ ィオメトリタス情報 (指紋、虹彩、声帯、顔写真等の生体的特徴を数値化したデー タ）となり、また、入力手段は、これらのバイオメトリタス情報を入力するスキャナー、マ イク、ディジタルカメラ等となる。  [0058] For example, if the authentication means 14 adopts the biometrics authentication method, the authentication information is the data obtained by quantifying the biometric features such as the nanometric information (fingerprint, iris, vocal cord, face photograph, etc.). The input means is a scanner, a microphone, a digital camera, etc. for inputting these biometrics information.
[0059] バイオメトリタス認証方法は、高精度な認証方法であるから、仮にネット決済補助装 置 1を第三者に盗まれても、ネット決済補助装置 1が配布された契約者でなければ、 ネット決済補助装置 1を使うことが出来ず、悪用が防止される。  [0059] Since the biometrics authentication method is a high-precision authentication method, even if the online payment assisting device 1 is stolen by a third party, it is not a contractor to whom the online payment assisting device 1 is distributed. The online payment assistance device 1 cannot be used, and misuse is prevented.
[0060] また、本実施例の認証情報である暗証番号には、数字の他、アルファベットが含ま れていてもよぐその場合は、テンキーの他にアルファベットキーをネット決済補助装 置が備える必要がある。 [0061] OTP生成手段 16は、認証手段 14によって、カード情報が表示された後、 OTP生 成情報格納部 17に格納された OTP生成情報 (本実施例では、共通鍵）に基づいて 、ワンタイムパスワードを生成し、ディスプレイ 11に表示する手段である。 [0060] In addition, the personal identification number, which is the authentication information of the present embodiment, may include alphabets in addition to numbers. In this case, it is necessary for the net settlement auxiliary device to include an alphabet key in addition to the numeric keypad. There is. [0061] After the card information is displayed by the authentication means 14, the OTP generation means 16 is based on the OTP generation information (common key in this embodiment) stored in the OTP generation information storage section 17. It is a means for generating a time password and displaying it on the display 11.
[0062] このワンタイムパスワードは、契約者端末から認証サーバに送信され、認証サーバ が契約者の本人認証を行なう際に、認証サーバで OTP生成情報に基づいて生成さ れたワンタイムパスワードとの照合に用いられる。そして、これらワンタイムパスワード の照合結果が一致し、認証サーバによって本人確認がなされた場合、当該契約者の 識別情報を用いた決済によるネット商取引が可能となる。  [0062] This one-time password is transmitted from the contractor terminal to the authentication server. When the authentication server authenticates the contractor, the one-time password is generated with the one-time password generated based on the OTP generation information by the authentication server. Used for verification. If the verification results of these one-time passwords match and the identity is verified by the authentication server, online commerce by settlement using the contractor's identification information becomes possible.
[0063] 本実施例では、認証手段 14による認証が行なわれ、カード情報がディスプレイ 11 に表示された後に、操作者力 Sスタートキー 12bを押下すると、スタートキー 12bを押下 したことが、 OTP生成手段 16を起動させる契機となり、ワンタイムパスワードが生成' 表示される。  [0063] In this embodiment, after the authentication by the authentication means 14 is performed and the card information is displayed on the display 11, when the operator's force S the start key 12b is pressed, the start key 12b is pressed. As a trigger to activate means 16, a one-time password is generated and displayed.
[0064] 尚、本実施例の OTP生成手段 16は、詳細は後述する時間同期方式により、ワンタ ィムパスワードを生成するものとする力 その他の生成方式、例えば、カウンタ同期方 式や、チャレンジ &レスポンス方式により、ワンタイムパスワードが生成されてもよい。  It should be noted that the OTP generation means 16 of the present embodiment is capable of generating a one-time password by a time synchronization method, which will be described in detail later. Other generation methods such as a counter synchronization method, challenge & A one-time password may be generated by a response method.
[0065] 計時手段 18は、本実施例の OTP生成手段 16が時間同期方式によりワンタイムパ スワードを生成するために必要となる手段であり、計時する手段である。尚、計時手 段 18は、リアルタイムクロックによって構成されていてもよいし、また、計時プログラム 力 Sメモリに格納され、当該計時プログラムを CPUが読み出して実行し計時機能を実 現するようになっていてもよい。また、 OTP生成手段 16が、時間同期方式以外の方 式でワンタイムパスワードを生成する場合には、計時手段 18は不要であり、代わりに 、各生成方式に必要な手段が付加されることとなる。  The time measuring means 18 is a means necessary for the OTP generating means 16 of the present embodiment to generate a one-time password by the time synchronization method, and is a means for measuring time. The clocking means 18 may be configured by a real-time clock, or stored in the clocking program force S memory, and the clocking program is read and executed by the CPU to realize the clocking function. May be. In addition, when the OTP generation means 16 generates a one-time password by a method other than the time synchronization method, the time measurement means 18 is not necessary, and instead, a means necessary for each generation method is added. Become.
[0066] 本実施例では、 OTP生成手段 16は、前述したように、認証手段 14がディスプレイ 1 1にカード情報を表示したのを受けて、スタートキー 12bの押下検出待ち状態となる。 OTP生成手段 16は、スタートキー 12bの押下が検出されると、押下検出を計時手段 18に伝達する。計時手段 18は、スタートキー 12bが押下検出された日時を計時し、 日時データ (年月日時分秒。秒は 30秒単位)を OTP生成手段 16に引き渡す。  In the present embodiment, as described above, the OTP generation unit 16 waits for detection of pressing of the start key 12b after the authentication unit 14 displays the card information on the display 11. When the pressing of the start key 12b is detected, the OTP generating unit 16 transmits the pressing detection to the time measuring unit 18. The time measuring means 18 measures the date and time when the start key 12b is detected to be pressed, and delivers the date and time data (year / month / day / hour / hour / minute / second, second is in units of 30 seconds) to the OTP generation means 16.
[0067] そして、 OTP生成手段 16は、 OTP生成情報格納部 17から、共通鍵を読み出し、 引き渡された日時データを読み出した共通鍵で暗号化し、これを十進数に変換し、 ディスプレイ 11に表示する。尚、本実施例の暗号化方式は、共通鍵暗号方式を採用 しているが、その他の暗号化方式でもよい。 [0067] Then, the OTP generation means 16 reads the common key from the OTP generation information storage unit 17, The delivered date / time data is encrypted with the read common key, converted into a decimal number, and displayed on the display 11. The encryption method of this embodiment employs a common key encryption method, but other encryption methods may be used.
[0068] 以上説明したネット決済補助装置 1によれば、ネット決済補助装置 1によって契約者 の本人認証が行なわれ、本人と確認された場合に、認証手段 14が表示したカード情 報は、カード決済が可能な加盟店のウェブサイト又は認証サーノから送信され契約 者端末に表示されるカード情報入力画面に入力された後、ウェブサイト又は認証サ ーバに送信可能にされる。  [0068] According to the online settlement assistant device 1 described above, the card information displayed by the authentication means 14 when the identity of the contractor is verified by the online settlement assistant device 1 and is confirmed as the principal, After being entered on the card information input screen that is sent from the website of the merchant that accepts payment or from the authentication sano and displayed on the contractor's terminal, it can be sent to the website or the authentication server.
[0069] このように、ネット決済補助装置 1によって契約者の本人認証が行なわれ、本人と確 認されなければ、すなわち、入力された入力情報が、ネット決済補助装置に格納され て 、る認証情報と一致しなければ、契約者自身であってもカード情報を知ることが出 来ず、カード情報は、外部力 読み出せないような状態で格納されているので、カー ド情報が露出している従来のクレジットカードと異なり、カード情報の秘匿性が高まり、 ネット商取引におけるカード情報の不正使用が防止される。  [0069] In this manner, the identity of the contractor is authenticated by the net settlement assistant device 1, and if the identity of the contractor is not confirmed, that is, the inputted input information is stored in the net settlement assistant device and the authentication is performed. If it does not match the information, even the contractor cannot know the card information, and the card information is stored in a state that cannot be read by an external force, so the card information is exposed. Unlike conventional credit cards, the confidentiality of card information is enhanced, preventing unauthorized use of card information in online commerce.
[0070] また、ネット決済補助装置は可搬型であるので、契約者がどこにいても、携帯電話、 自宅のパソコン、出先のパソコンを用いて、安全なネット商取引を行なうことが出来、 ネット商取引の利便性が増す。  [0070] Also, since the online payment assisting device is portable, it is possible to conduct secure online commerce using a mobile phone, a home personal computer, or a personal computer wherever a contractor is located. Convenience increases.
[0071] また、 OTP生成手段 16が表示したワンタイムパスワードは、契約者の本人認証を 行う認証サーバから送信され契約者端末に表示されるワンタイムパスワード入力画面 に入力された後、認証サーバに送信可能にされるとともに、認証サーバが生成したヮ ンタイムパスワードとの照合により、一致した場合に、本人確認がなされ、契約者の識 別情報を用いた決済によるネット商取引が可能にされる。  [0071] The one-time password displayed by the OTP generation means 16 is input from the authentication server that authenticates the contractor to the one-time password input screen displayed on the contractor terminal. In addition to being made available for transmission, the identity server confirms the identity of the user by matching with the one-time password generated by the authentication server, and enables online commerce by settlement using the contractor's identification information.
[0072] このように、契約者の本人認証に、ネット決済補助装置に格納された契約者固有の OTP生成情報に基づいて作成されたワンタイムパスワードを用いるので、第三者が、 仮にワンタイムノ スワードを入手しても、次のネット商取引には使えない。  [0072] As described above, since the one-time password created based on the contractor-specific OTP generation information stored in the network payment assistant device is used for the authentication of the contractor, the third party temporarily assumes the one-time password. You cannot use it for the next online commerce.
[0073] ワンタイムパスワード生成用の OTP生成情報は、外部から読み出せないような状態 で格納されているので、契約者本人であっても、 OTP生成情報を知ることは出来ず、 ネット決済補助装置を操作している契約者本人のみが生成結果のワンタイムパスヮ ードを知ることが出来る。つまり、第三者によるワンタイムパスワード生成は出来ない ので、より、ネット商取引の安全性が保証される。 [0073] Since the OTP generation information for generating a one-time password is stored in a state that cannot be read from the outside, even the contractor himself cannot know the OTP generation information and assists with online payment. Only the contractor who is operating the device generates a one-time pass You can know the mode. In other words, since a one-time password cannot be generated by a third party, the safety of online commerce is further guaranteed.
[0074] しかも、このワンタイムパスワードの生成は、ネット決済補助装置にカード情報が表 示された後でなければ、行なわれないようになっているから、ネット決済補助装置を 有していない第三者は、識別情報のみを知っていても、ワンタイムパスワードの生成 が出来ない。また、第三者がネット決済補助装置を盗んだとしても、ネット決済補助装 置に入力する認証情報がなければ、ワンタイムパスワードの生成が出来ない。  [0074] Moreover, since the one-time password is generated only after the card information is displayed on the network settlement assistant device, the one-time password is not provided. Even if the three parties know only the identification information, they cannot generate a one-time password. Even if a third party steals the online payment assistant, the one-time password cannot be generated without the authentication information to be entered into the online payment assistant.
[0075] つまり、契約者は、ネット決済補助装置の認証手段によって本人認証を受けた後、 更に、認証サーバによって本人認証を受けることになり、最終的にネット商取引が可 能となるまでに 2種類の異なる認証情報に基づく本人認証を経なければ 、けな 、の で、第三者によるなりすましがより防止され、ネット商取引の安全性が高まる。  [0075] In other words, after the contractor is authenticated by the authentication means of the online payment assisting device, the contractor is further authenticated by the authentication server. Without personal authentication based on different types of authentication information, spoofing by third parties is further prevented and the safety of online commerce is increased.
[0076] 尚、認証情報格納部 15は、上述した認証情報の他、認証手段 14が行なう一致判 定処理で、入力情報と認証情報が一致しな力つた場合に、入力情報の再入力を受 付ける回数 (エラー許容回数)を予め格納してもよい。その場合、ネット決済補助装置 1又は認証手段 14は、計数手段 (カウンタ）をも備える構成となる。  In addition to the authentication information described above, the authentication information storage unit 15 re-inputs the input information when the input information and the authentication information do not match in the matching determination process performed by the authentication unit 14. The number of times of acceptance (allowable number of errors) may be stored in advance. In that case, the net settlement assistant device 1 or the authentication unit 14 is configured to include a counting unit (counter).
[0077] そして、認証手段 14がー致判定処理を行なうフローにおいて、入力情報と認証情 報が一致しな力つた場合、その都度、計数手段が 1からカウントアップを行い、カウン トアップされた数字と、エラー許容回数とを比較して、カウントアップされた数字がエラ 一許容回数を上回った場合には、以降、認証手段 14は、自身の処理が行なわれな いようにし、更に、 OTP生成手段 16が起動しないようにし、認証フロー及び OTP生 成フローが行なわれな 、ようにする。  [0077] Then, in the flow in which the authentication means 14 performs the match determination process, if the input information and the authentication information do not match, the counting means counts up from 1, and the counted up number If the counted up number exceeds the allowable error count, then the authentication means 14 will not perform its own processing and generate OTP. Mean 16 is not activated, and the authentication flow and OTP generation flow are not performed.
[0078] これにより、悪意の第三者が、ネット決済補助装置 1を盗用して、認証情報を手当た り次第に入力した結果、カード情報やワンタイムパスワードがディスプレイ 11に表示さ れてしまうのを防止することが出来る。  [0078] As a result, a malicious third party steals the online payment assisting device 1 and gradually inputs authentication information. As a result, card information and a one-time password are displayed on the display 11. Can be prevented.
[0079] 尚、カウントアップされた数字がエラー許容回数を上回ることなぐ入力情報と認証 情報が一致した場合には、認証手段 14は、ディスプレイ 11にカード情報の表示を行 なうことにするが、この時に、カウントアップされた数字は、 0にリセット（初期化）される ものとする。 [0080] ここで、ネット決済補助装置 1を操作手順及びディスプレイ 11の画面遷移の一例を 図 5に示す。尚、本実施例のディスプレイ 11は、 8桁の英数字'記号表示用ディスプ レイである。 [0079] It should be noted that the authentication means 14 displays the card information on the display 11 when the input information and the authentication information that the counted up number does not exceed the allowable number of errors match the authentication information. At this time, the counted up number is reset to 0 (initialized). Here, FIG. 5 shows an example of the operation procedure of the online payment assisting apparatus 1 and the screen transition of the display 11. The display 11 of this embodiment is an 8-digit alphanumeric character display.
[0081] まず、操作者によってスタートキー 12bが押下されると、ネット決済補助装置 1の電 源が起動し（S200)、ディスプレイ 11に、「APPLI」と表示される（S210)ので、更に スタートキー 12bが押下された後（S225)カード情報を表示させたい場合は、操作者 はテンキー 12aの「1」を押下し (S230)、認証情報（暗証番号)の変更を行な 、た ヽ 場合は、テンキー 12aの「2」を押下する（S330)。  [0081] First, when the start key 12b is pressed by the operator, the power supply of the online payment assisting device 1 is activated (S200), and "APPLI" is displayed on the display 11 (S210). If the card information is to be displayed after the key 12b is pressed (S225), the operator presses “1” on the numeric keypad 12a (S230) and changes the authentication information (password). Presses “2” on the numeric keypad 12a (S330).
[0082] 「1」が押下された場合（S230)、ディスプレイ 11に「PIN」と表示されるので、操作 者は認証情報として 4桁の暗証番号をテンキー 12aの中力も選択して押下する（S24 0)。その後、スタートキー 12bが押下され (S245)、押下された暗証番号が、認証情 報格納部 15に格納されて!、る認証情報と一致すれば、カード情報格納部 13に格納 されているカード情報のうち、まず、識別情報 (以下、カード番号という）の上 8桁がデ イスプレイ 11に表示される (S250)。  [0082] When “1” is pressed (S230), “PIN” is displayed on the display 11. Therefore, the operator selects and presses the four-digit password as the authentication information and also presses the middle key of the numeric keypad 12a ( S24 0). Thereafter, the start key 12b is pressed (S245), and if the pressed password matches the authentication information stored in the authentication information storage unit 15 !, the card stored in the card information storage unit 13 is stored. Of the information, the first eight digits of the identification information (hereinafter referred to as the card number) are displayed on the display 11 (S250).
[0083] 続いて、スタートキー 12bが押下されると（S255)、カード番号の下 8桁がディスプレ ィ 11に表示される (S260)。  [0083] Subsequently, when the start key 12b is pressed (S255), the last 8 digits of the card number are displayed on the display 11 (S260).
[0084] 続いて、スタートキー 12bが押下されると（S265)、有効期限とセキュリティコードが ディスプレイ 11に表示される（S270)。尚、 S265と S270のフローは必須ではなく、 カード情報のうちカード番号のみが表示されるものであってもよい。  Subsequently, when the start key 12b is pressed (S265), the expiration date and the security code are displayed on the display 11 (S270). Note that the flow of S265 and S270 is not essential, and only the card number in the card information may be displayed.
[0085] 続いて、スタートキー 12bが押下されると（S275)、ディスプレイ 11に「ΟΤΡ= 1」と 表示され、ワンタイムパスワードを生成 ·表示する力、終了する力否かの選択がなされ る。ここで、スタートキー 12bが押下された後（S290)、テンキー 12aの「1」が押下され ると（S295)、ディスプレイ 11に、認証情報の入力を促す「PIN」が表示されるので（S 305)、操作者は、再び 4桁の暗証番号をテンキー 12aから押下し、スタートキー 12b を押下する（S310)。  [0085] Subsequently, when the start key 12b is pressed (S275), “ΟΤΡ = 1” is displayed on the display 11, and the power to generate / display a one-time password and the power to end are selected. . Here, after the start key 12b is pressed (S290), when “1” of the numeric keypad 12a is pressed (S295), “PIN” prompting the user to input authentication information is displayed on the display 11 (S 305), the operator again presses the 4-digit password from the numeric keypad 12a and presses the start key 12b (S310).
[0086] 押下された暗証番号が、認証情報格納部 15に格納されて!ヽる認証情報と一致す れば、 OTP生成情報格納部 17に格納されている OTP生成情報に基づき、ワンタイ ムパスワードが生成され、これがディスプレイ 11に表示される（S315)。 [0087] 再び、スタートキー 12bが押下されると（S320)、ネット決済補助装置 1の電源が遮 断される。 [0086] If the pressed password matches the authentication information stored in authentication information storage unit 15 !, the one-time password is based on the OTP generation information stored in OTP generation information storage unit 17. Is generated and displayed on the display 11 (S315). [0087] When the start key 12b is pressed again (S320), the power source of the online settlement assisting apparatus 1 is cut off.
[0088] テンキー 12aの「1」以外のキーが押下される力 いずれのキーも押下されず、予め 決められた所定時間が経過した場合には (S300)、自動的にネット決済補助装置 1 の電源が遮断される。  [0088] The force by which a key other than "1" on the numeric keypad 12a is pressed If no key is pressed and a predetermined time has elapsed (S300), the network payment assisting device 1 automatically Power is cut off.
[0089] 尚、 S240と S305で入力される暗証番号は、カード情報表示用とワンタイムパスヮ ード生成用とで、別々の暗証番号でもよぐその場合は、認証情報格納部 15に、そ れぞれの暗証番号が区別して格納されて!、る。  Note that the password entered in S240 and S305 is used for displaying card information and for generating a one-time passcode. In such a case, separate passwords may be used. These PINs are stored separately!
[0090] また、本実施例では、ワンタイムパスワードをディスプレイ 11に表示するフロー (S3 15)の前に、 S305で、操作者に再度、認証情報の入力を促したが、 S305を省略し て、 S310のスタートキー 12bの押下のみで、ワンタイムパスワードが生成されてもよい  Further, in this embodiment, before the flow (S3 15) for displaying the one-time password on the display 11, the operator is prompted to input authentication information again in S305, but S305 is omitted. A one-time password may be generated simply by pressing the start key 12b of S310.
[0091] S225の後、テンキー 12aの「2」が押下された場合には（S330)、ディスプレイ 11に 「CHANGE？」と表示される（S335)。 When “2” on the numeric keypad 12a is pressed after S225 (S330), “CHANGE?” Is displayed on the display 11 (S335).
[0092] スタートキー 12bが押下されると（S340)、ディスプレイ 11に「PIN」と表示され、喑 証番号の入力が促されるので、操作者は、テンキー 12aから 4桁の暗証番号を押下 後（S345)、更に、スタートキー 12bを押下し (S350)、押下された暗証番号が、認証 情報格納部 15に格納されている認証情報と一致すれば、変更後の暗証番号の入力 を促す「NEW1」がディスプレイ 11に表示されるので、操作者は変更後の暗証番号 をテンキー 12aから押下し（S355)、更に、スタートキー 12bを押下する（S360)。  [0092] When the start key 12b is pressed (S340), “PIN” is displayed on the display 11 and the user is prompted to enter a verification number. The operator presses the four-digit password from the numeric keypad 12a. (S345) Further, the start key 12b is pressed (S350), and if the pressed password matches the authentication information stored in the authentication information storage unit 15, the user is prompted to input the changed password. Since “NEW1” is displayed on the display 11, the operator depresses the changed password from the numeric keypad 12a (S355), and further depresses the start key 12b (S360).
[0093] 次に、ディスプレイ 11には、再度、変更後の暗証番号の入力を促す「NEW2」がデ イスプレイ 11に表示されるので、操作者は変更後の暗証番号を再度テンキー 12aか ら押下し（S365)、更に、スタートキー 12bを押下する（S370)。  [0093] Next, “NEW2” prompting the user to input the changed password again appears on the display 11, so that the operator presses the changed password again from the numeric keypad 12a. Then, the start key 12b is further pressed (S370).
[0094] S355で押下された暗証番号と、 S365で押下された暗証番号が一致していれば、 ディスプレイ 11に、暗証番号の変更が完了した旨を表す「COMPLETE」が表示さ れる（S375)ので、その確認を経た後、スタートキー 12bが押下されると（S380)、暗 証番号の変更手続が完了し、電源が遮断される。  [0094] If the personal identification number pressed in S355 matches the personal identification number pressed in S365, "COMPLETE" indicating that the personal identification number has been changed is displayed on the display 11 (S375). Therefore, after the confirmation, when the start key 12b is pressed (S380), the procedure for changing the security code is completed and the power is shut off.
[0095] 尚、セキュリティ向上のため、 S355と S365で、テンキー 12aから入力がなされても 、入力された値は、ディスプレイ 11上に表示されないことが望ましい。 [0095] In order to improve security, even if input is performed from the numeric keypad 12a in S355 and S365, The input value is preferably not displayed on the display 11.
実施例 1  Example 1
[0096] 以下、図 1に示したネット決済補助装置 1を配布されたクレジットカード契約者である クレジットカード会員（以下、カード会員という）が、当該ネット決済補助装置 1を用い て、通信機能を有するパソコンや携帯電話から、当該カード会員のカード番号を用い た決済により、ネットショッピング等のネットワーク商取引（以下、ネット商取引という）を 行なう場合の一実施例について説明する。  [0096] Hereinafter, a credit card member (hereinafter referred to as a card member) who is a credit card contractor who is distributed with the online payment assisting device 1 shown in FIG. A description will be given of an embodiment in which network commerce such as online shopping (hereinafter referred to as “net commerce”) is performed from a personal computer or mobile phone possessed by settlement using the card number of the card member.
[0097] 本実施例のネット決済システムのシステム構成とネットワーク接続関係を図 2のシス テム構成図に示す。また、本実施例のネット決済システムにおけるネット商取引のフロ 一を、図 3のフローチャートに示す。  [0097] The system configuration and network connection relationship of the network payment system of the present embodiment are shown in the system configuration diagram of FIG. The flowchart of Fig. 3 shows the flow of online commerce in the online payment system of this embodiment.
[0098] 尚、本実施例で、ネット決済システムにおけるネット商取引サービスを提供するのは 、クレジットカードブランドである。  In this embodiment, it is a credit card brand that provides an online commerce service in the online payment system.
[0099] カード会員は、予め、イシユアに対してクレジットカードの申込みを行い、クレジット カードの発行を受けるとともに、イシユアから、個々のカード会員に固有の認証情報（ カード会員がクレジットカード申込み時に登録した暗証番号や指紋情報等の生体情 報)、カード情報 (個々のカード会員に固有のカード番号、有効期限)、 OTP生成情 報 (共通鍵)が格納されたネット決済補助装置 1の配布を受けているものとする。  [0099] The card member applies for a credit card in advance and receives a credit card issue, and the authentication information unique to each card member (registered by the card member when applying for the credit card) Distribution of the online payment assistance device 1 that stores biometric information such as personal identification number and fingerprint information), card information (card number and expiration date unique to each cardholder), and OTP generation information (common key). It shall be.
[0100] また、本実施例では、図 1 (b)に示したネット決済補助装置 1の構成のうち、ディスプ レイ 11とキー操作部 12と駆動用電源 19を除く構成は、 SIM等の ICカードに予め格 納されており、筐体 10に設けられた ICカードスロット（図示せず）に当該 ICカードが挿 入されることで、ネット決済補助装置 1の機能が実現されるが、必ずしも、ネット決済補 助装置が ICカードを備えていなくてもよぐ ICカードを備えていない場合は、ネット決 済補助装置自身が、 CPUやメモリを備えていればよい。  [0100] In the present embodiment, among the configurations of the online payment assisting device 1 shown in Fig. 1 (b), the configuration excluding the display 11, the key operation unit 12, and the driving power supply 19 is an IC such as a SIM. The function of the network payment assisting device 1 is realized by inserting the IC card into the IC card slot (not shown) provided in the housing 10 and stored in the card in advance. If the online payment assistance device does not have an IC card, the online payment assistance device itself has only to have a CPU and memory.
[0101] また、本実施例のネット決済補助装置 1は、カード会員の識別情報を用いた決済、 すなわち、カード決済、を利用したネット商取引に用いられるものとするが、カード会 員力 ネット商取引のみを希望し、従来のプラスチックタイプの磁気カード、 ICカード 等力 なるクレジットカードによるリアルの対面取引を希望しない場合には、クレジット カードの発行は受けなくてもよい。 [0102] また、クレジットカードブランド力 イシユアの業務も行なって!/、るような場合は、タレ ジットカードブランドから、ネット決済補助装置 1が配布されてもよい。 [0101] Further, the online payment assisting apparatus 1 of the present embodiment is used for online commerce using payment using card member identification information, that is, card payment. If you do not want real face-to-face transactions with a strong credit card, such as a conventional plastic-type magnetic card or IC card, you do not need to issue a credit card. [0102] In addition, in the case where the credit card brand power Ishiyua is also operated! /, The online payment assisting device 1 may be distributed from the credit card brand.
[0103] 会員端末 2は、契約者の端末であり、カード会員が、ネット決済補助装置 1を用いて ネット商取引を行なうための端末であり、通信機能とブラウザ表示機能を少なくとも有 するパーソナルコンピュータ、携帯電話等の端末である。  [0103] The member terminal 2 is a contractor's terminal, and a card member is a terminal for performing online commerce using the online payment assisting device 1, and is a personal computer having at least a communication function and a browser display function, A terminal such as a mobile phone.
[0104] 加盟店端末 3は、会員端末 2に仮想店舗 (ウェブサイト)を提供して、商品やサービ スの注文を受付けるとともに、注文したカード会員の本人認証をイシユア側に依頼し、 カード会員の本人認証が行なわれた後、ァクワイアラ (クレジットカードブランドとのラ ィセンス契約に基づき、加盟店の獲得'契約 ·管理業務を行なう）に対して、ォーソリ ( 注文された商品やサービスの金額分の与信枠がカード会員に残っているかどうかを 調べ、与信枠が残って！/ヽる場合にその金額分を決済用に確保すること)を依頼する 端末である。  [0104] The member store terminal 3 provides a virtual store (website) to the member terminal 2, accepts orders for products and services, and requests the cardholder to authenticate the ordered card member. After authenticating the customer, the authorization (acquisition of the merchant's contract / administration based on the license agreement with the credit card brand) is given to the customer (the amount of the ordered goods and services). This is a terminal that asks if the credit limit remains in the cardholder and asks if the credit limit remains!
[0105] ァクワイアラ端末 4は、加盟店端末 3から受けたォーソリ依頼を、イシユア側に再依 頼 (ォーソリ再仕向）する端末である。  [0105] The acquirer terminal 4 is a terminal that re-requests the authority request received from the member store terminal 3 to the issuer side.
[0106] 仲介サーバ 5は、加盟店端末 3と後述の認証サーバ 7の仲介役を担う、すなわち、 会員端末 2と加盟店端末 3との間でカード会員の認証サービスを仲介する役割を担う サーバである。 [0106] The intermediary server 5 serves as an intermediary between the member store terminal 3 and an authentication server 7 described later, that is, a server that mediates the card member authentication service between the member terminal 2 and the member store terminal 3. It is.
[0107] 仲介サーバ 5は、本実施例ではクレジットカードブランドが運営するサーバであり、 ネット決済補助装置 1を用いたネット商取引サービスに対応している加盟店を識別す る加盟店識別情報と、ネット決済補助装置 1を用いたネット商取引サービスに対応し て 、るイシユアを識別するイシユア識別情報とを格納して 、る。  [0107] The mediation server 5 is a server operated by the credit card brand in this embodiment, and the member store identification information for identifying the member store corresponding to the online commerce service using the online payment assisting device 1; Corresponding to the online commerce service using the online payment assisting device 1, issuance identification information for identifying the issuer is stored.
[0108] 尚、本実施例のネット決済システムにお 、て、ネット決済補助装置 1を用いな ヽネッ ト商取引サービスが混在する場合には、仲介サーバ 5は、ネット決済補助装置 1を用 いたネット商取引サービスに未対応の加盟店及びイシユアの識別情報を、上記加盟 店識別情報及びイシユア識別情報と区別して格納している必要がある。  It should be noted that in the net settlement system of the present embodiment, when there is a mixture of net commerce services that do not use the net settlement assisting device 1, the mediation server 5 uses the net settlement assisting device 1. It is necessary to store the identification information of merchant stores and issuers that are not compatible with online commerce services separately from the above-mentioned member store identification information and issue identification information.
[0109] イシユア端末 6は、ァクワイアラ端末 4力も受けたォーソリ依頼を引受け、ォーソリを 行なう端末である。  [0109] The issuer terminal 6 is a terminal that accepts an authorization request that has also received the power of the acquisition terminal 4 and performs authorization.
[0110] 認証サーバ 7は、ネット商取引を行なう際に、ォーソリに先立ち、カード会員の本人 認証を行なうサーバである。本実施例では、認証サーバ 7は、イシユアが運営するサ ーバであり、イシユア端末 6に接続されており、ネット決済補助装置 1を用いてネット商 取引を行なうことが可能なカード会員のカード情報 (カード番号、有効期限)及び OT P生成情報 (ネット決済補助装置 1に固有の共通鍵)を、互いに関連付けられた状態 で格納している。つまり、 1カード会員にっき、カード情報と OTP生成情報とが関連付 けられて、認証サーバ 7に格納されている。 [0110] When performing online commerce, the authentication server 7 prior to authorization, the cardholder A server that performs authentication. In this embodiment, the authentication server 7 is a server operated by Ishiure, connected to the Ishiure terminal 6, and a cardholder card that can perform online commerce using the online payment assistant device 1. Information (card number, expiration date) and OTP generation information (common key unique to the online payment assistant device 1) are stored in a mutually associated state. In other words, one card member, card information and OTP generation information are associated with each other and stored in the authentication server 7.
[0111] 尚、認証サーバ 7へのこれらの情報の格納は、カード会員にネット決済補助装置 1 を配布するのと同時期、もしくはその前後に行なわれる。  Note that the storage of these pieces of information in the authentication server 7 is performed at the same time as or before or after the distribution of the online payment assisting device 1 to the card member.
[0112] 図 2において、会員端末 2、加盟店端末 3、仲介サーバ 5、認証サーバ 7間は、それ ぞれ、インターネット等のネットワーク 9aによって接続されており、加盟店端末 3、ァク ワイアラ端末 4、イシユア端末 6は、それぞれ専用回線 9bによって接続されている。  [0112] In FIG. 2, the member terminal 2, the member store terminal 3, the mediation server 5, and the authentication server 7 are connected by a network 9a such as the Internet. The member terminal 3, the acquirer terminal 4. The issuer terminal 6 is connected by a dedicated line 9b.
[0113] 尚、イシユア端末 6及び認証サーバ 7は、イシユア毎に個別に用意され、それぞれが 会員端末 2、ァクワイアラ端末 4、仲介サーバ 5にネットワーク 9a、専用回線 9bで接続 されること〖こなる。  [0113] The issuer terminal 6 and the authentication server 7 are prepared for each issuer, and are connected to the member terminal 2, the acquirer terminal 4, and the mediation server 5 through the network 9a and the dedicated line 9b. .
[0114] また、加盟店端末 3も、加盟店毎に個別に用意され、それぞれが会員端末 2、仲介 サーバ 5、ァクワイアラ端末 4にネットワーク 9a、専用回線 9bで接続されることになる。  [0114] In addition, the member store terminal 3 is also prepared for each member store, and is connected to the member terminal 2, the mediation server 5, and the acquirer terminal 4 through the network 9a and the dedicated line 9b.
[0115] 以下、図 3のフローチャート及び図 2のシステム構成図に基づいて、ネット決済補助 装置 1を用いたネット商取引の流れを説明する。カード会員は、会員端末 2から、ネッ トワーク 9aを介して、仮想店舗 (Webサイト）である加盟店端末 3にアクセスし、商品や サービスを閲覧する。そして、注文する商品や希望のサービスが決まったら、会員端 末 2は、加盟店端末 3に、注文商品や希望サービスに関してカード決済によるネット 商取引を希望する旨を送信する。  Hereinafter, the flow of online commerce using the online payment assisting apparatus 1 will be described based on the flowchart of FIG. 3 and the system configuration diagram of FIG. The card member accesses the member store terminal 3 which is a virtual store (Web site) from the member terminal 2 via the network 9a, and browses products and services. When the product to be ordered and the desired service are determined, the member terminal 2 transmits to the member store terminal 3 a request for online commerce by card settlement regarding the ordered product and the desired service.
[0116] 加盟店端末 3は、会員端末 2に、図 4 (a)に示されるようなカード情報入力画面 100 を表示させ、会員端末 2に、カード番号及びカードの有効期限を入力して、送信する ように依頼する。  [0116] The member store terminal 3 displays the card information input screen 100 as shown in FIG. 4 (a) on the member terminal 2, and inputs the card number and the card expiration date to the member terminal 2. Ask to send.
[0117] そこで、カード会員が、ネット決済補助装置 1のスタートキー 12bを押下すると、ネッ ト決済補助装置 1の認証手段 14が起動し、ネット決済補助装置 1が認証待ち状態と なる。続けて、カード会員は、本人認証のために必要な入力情報 (本実施例では、 4 桁の暗証番号)をテンキー 12aから入力する。尚、ここで入力される 4桁の暗証番号 は、予め、カード会員がカード申込み時に決めておき、既にネット決済補助装置 1内 の認証情報格納部 15に格納されて 、るものである。 [0117] Therefore, when the card member presses the start key 12b of the net settlement assisting apparatus 1, the authentication means 14 of the net settlement assisting apparatus 1 is activated, and the net settlement assisting apparatus 1 enters the authentication waiting state. Subsequently, the cardholder must enter the input information necessary for authentication (in this example, 4 Enter the digit password using the numeric keypad 12a. The four-digit password entered here is determined in advance by the card member when applying for the card, and is already stored in the authentication information storage unit 15 in the online settlement assistant device 1.
[0118] 認証手段 14は、認証情報格納部 15に格納されている認証情報を読み出し、テン キー 12aから入力された入力情報と一致するかどうか確認する。そして、両者が一致 した場合、認証手段 14は、カード情報格納部 13からカード情報としてのカード番号 と有効期限を読み出し、ディスプレイ 11に表示する。  The authentication unit 14 reads the authentication information stored in the authentication information storage unit 15 and confirms whether or not it matches the input information input from the numeric keypad 12a. If they match, the authentication means 14 reads the card number and the expiration date as card information from the card information storage unit 13 and displays them on the display 11.
[0119] そして、カード番号と有効期限を全てディスプレイ 11に表示し終えると、認証手段 1 4は、表示し終えた旨を、 OTP生成手段 16に伝達する。これによつて、 OTP生成手 段 16は、後述するワンタイムノ スワード生成待ち状態となる。  [0119] When the card number and the expiration date are all displayed on the display 11, the authentication unit 14 notifies the OTP generation unit 16 that the display has been completed. As a result, the OTP generation unit 16 enters a state of waiting for a one-time newsword generation to be described later.
[0120] 尚、本実施例では、ディスプレイ 11の表示可能桁数が 8桁に限られて 、るため、認 証手段 14は、カード情報格納部 13から読み出したカード番号を上 8桁と下 8桁とに 分割処理した上で、ディスプレイ 11にまず、カード番号の上 8桁を表示する。カード 会員は、その表示に基づき、カード情報入力画面 100のカード番号入力欄 100aに カード番号の上 8桁を入力する。  [0120] In this embodiment, since the displayable number of digits on the display 11 is limited to eight digits, the authentication means 14 sets the card number read from the card information storage unit 13 to the upper 8 digits and lower digits. After dividing into 8 digits, the first 8 digits of the card number are displayed on the display 11 first. Based on the display, the card member enters the first 8 digits of the card number in the card number input field 100a of the card information input screen 100.
[0121] カード番号の上 8桁の入力が終わると、カード会員はスタートキー 12bを押下する。  [0121] When the first eight digits of the card number have been entered, the card member presses the start key 12b.
認証手段 14は、スタートキー 12bの押下検出を受けて、カード番号の下 8桁をデイス プレイ 11に表示する。カード会員は、その表示に基づき、カード情報入力画面 100 のカード番号入力欄 100aにカード番号の下 8桁を入力する。  Upon receiving the detection of the start key 12b being pressed, the authentication means 14 displays the last 8 digits of the card number on the display 11. Based on the display, the cardholder enters the last 8 digits of the card number in the card number input field 100a of the card information input screen 100.
[0122] カード番号の下 8桁の入力が終わると、カード会員はスタートキー 12bを押下する。  [0122] When the last 8 digits of the card number have been entered, the cardholder presses the start key 12b.
認証手段 14は、スタートキー 12bの押下検出を受けて、有効期限を 4桁 (MM (月） Z YY (年)）で表示する。カード会員は、その表示に基づき、カード情報入力画面 100 の有効期限入力欄 100bに、有効期限を入力する。  Upon receiving the detection of pressing of the start key 12b, the authentication means 14 displays the expiration date in four digits (MM (month) Z YY (year)). Based on the display, the card member enters the expiration date in the expiration date input field 100b of the card information input screen 100.
[0123] 尚、ディスプレイの表示領域、表示可能桁数に余裕がある場合には、当然、カード 番号が一度に全て、ディスプレイに表示されてもよいし、また、カード番号と有効期限 がー度に全て表示されてもよい。また逆に、ディスプレイの表示可能桁数が 8桁より少 ない場合は、認証手段 14は、表示可能桁数に合わせて、カード情報格納部 13から 読み出したカード情報を予め分割しておき、スタートキー 12bその他、任意のキーの 押下検出により順次、分割されたカード情報を表示してもよい。 [0123] If the display area of the display and the number of digits that can be displayed are sufficient, naturally, the card number may be displayed on the display all at once, or the card number and the expiration date may be displayed. May all be displayed. Conversely, if the displayable number of digits is less than 8 digits, the authentication means 14 divides the card information read from the card information storage unit 13 in advance according to the number of displayable digits, and starts. Key 12b Other, any key The divided card information may be displayed sequentially by pressing detection.
[0124] 以上のように、ネット決済補助装置 1は、入力された入力情報が、認証情報格納部 15に格納されている認証情報と一致した場合にのみ、ディスプレイ 11上にカード情 報を表示するので、認証情報を知らなければ、第三者が、ネット決済補助装置 1を盗 んだとしても、内部のカード情報を知ることが出来ない。従って、カード情報が印字さ れている従来のクレジットカードに比べて安全性が高ぐカード情報をネット商取引に 悪用される心配がない。  [0124] As described above, the online settlement assistant device 1 displays the card information on the display 11 only when the input information that is input matches the authentication information stored in the authentication information storage unit 15. Therefore, if the authentication information is not known, even if a third party steals the online payment assisting device 1, the internal card information cannot be known. Therefore, there is no fear that the card information, which is safer than the conventional credit card on which the card information is printed, will be misused for online commerce.
[0125] カード会員が、カード番号及び有効期限の入力を終えると（尚、図 4のカード情報 入力画面 100には示されていないが、注文した商品 ·サービス名、金額、注文日、加 盟店名、商品の発送先等の情報が同一画面内に表示されていてもよい）、カード情 報入力画面 100内の送信ボタン 100cをクリックする。送信ボタン 100cがクリックされ ることにより、加盟店端末 3側に、入力されたカード情報が送信される（S 10)。  [0125] When the card member finishes entering the card number and expiration date (not shown in the card information input screen 100 in FIG. 4), the ordered product / service name, price, order date, membership Click the send button 100c in the card information input screen 100. Information such as store name and product shipping address may be displayed on the same screen. When the send button 100c is clicked, the entered card information is sent to the member store terminal 3 (S10).
[0126] 会員端末 2から、注文した商品 ·サービス名、金額、注文日、加盟店名、商品の発 送先等に関する注文情報と、注文商品の決済に用いるカードのカード番号や有効期 限等のカード情報を受信した加盟店端末 3は、受信したカード情報に加え、加盟店 毎に付与された加盟店識別情報を、ネットワーク 9aを介して接続された仲介サーバ 5 に送信し、カード会員がネット決済補助装置 1を用いたネット商取引サービスを受けら れる会員であるカゝ否かの確認 (認証実行可否確認)を要求する（S20)。 [0126] From the member terminal 2, order information regarding the ordered product · service name, price, order date, member store name, merchandise delivery destination, etc., card number of the card used for settlement of the ordered product, expiration date, etc. Upon receiving the card information, the member store terminal 3 transmits the member store identification information given to each member store to the intermediary server 5 connected via the network 9a in addition to the received card information. A request for confirmation of whether or not the member is a member who can receive the online commerce service using the settlement assistant device 1 (confirmation of whether or not authentication can be executed) is requested (S20).
[0127] 仲介サーバ 5は、受信した加盟店識別情報が、保有している加盟店識別情報と一 致する力否かの確認 (加盟店認証)を行なう。これらの情報が一致すれば、ネット決 済補助装置 1を用いたネット商取引サービスに参加している加盟店の加盟店端末 3 力も仲介サーバ 5にアクセスがあつたということになる。一致しなければ、ネット決済補 助装置 1を用いたネット商取引サービスに参加していない加盟店端末 3からのァクセ スである力 不正アクセスであるため、以後のフローには進まない。  [0127] The mediation server 5 confirms whether or not the received member store identification information matches the member store identification information held (member store authentication). If these pieces of information match, it means that the member store terminal 3 of the member store participating in the online commerce service using the online settlement auxiliary device 1 has also accessed the intermediary server 5. If they do not match, it is an unauthorized access from the member store terminal 3 that has not participated in the online commerce service using the online payment assisting device 1, and the subsequent flow does not proceed.
[0128] 仲介サーバ 5は、ネット決済補助装置 1を用いたネット商取引サービスに参加してい る加盟店端末 3から受信したカード会員のカード情報に基づいて、当該カード会員の カード番号が発行されたイシユアを特定し、特定されたイシユアの認証サーバ 7に、力 ード情報を送信し、カード会員がネット決済補助装置 1を用いたネット商取引サービ スを受けられる会員であるカゝ否かの確認 (認証実行可否確認)を要求する（S30)。 [0128] The intermediary server 5 issued the card number of the card member based on the card information of the card member received from the member store terminal 3 participating in the online commerce service using the online payment assisting device 1. The issuer is identified, the force information is transmitted to the identified issuer authentication server 7, and the card member uses the online payment assistant device 1 to execute the online commerce service. Requesting confirmation of whether or not the member is a member who can receive the service (authentication execution availability confirmation) (S30).
[0129] 本実施例の仲介サーバ 5には、イシユアを識別するイシユア識別情報が格納されて おり、仲介サーバ 5は、受信したカード情報に基づいてイシユア識別情報を検索して 、イシユアを特定する。 [0129] The mediation server 5 of this embodiment stores issue identification information for identifying the issue, and the mediation server 5 searches the issue identification information based on the received card information to identify the issue. .
[0130] つまり、本実施例の仲介サーバ 5は、直接、認証実行可否確認を行なうのではなく 、加盟店認証を行なうとともに、加盟店端末 3から受信したカード情報に基づいて、力 ード会員のカード番号が発行されたイシユアを特定し、特定されたイシユアの認証サ ーバ 7にカード情報を転送し、当該認証サーバ 7から受信した認証実行可否確認結 果を加盟店端末 3に転送する役割を担っている。  That is, the mediation server 5 of the present embodiment does not directly check whether or not the authentication can be performed, but performs member store authentication and based on the card information received from the member store terminal 3. The issuer with the card number issued is identified, the card information is transferred to the authentication server 7 of the identified issuer, and the authentication execution confirmation result received from the authentication server 7 is transferred to the member store terminal 3. Have a role.
[0131] 尚、本実施例では、仲介サーバ 5は、クレジットカードブランドが運営しているサー バであるが、これを個々の加盟店端末 3が備えていてもよぐその場合は、直接、カロ 盟店端末 3から認証サーバ 7に、認証実行可否確認が要求されることになる。また、 認証サーバ 7にお 、て、加盟店認証が行なわれてもよ!/、。  [0131] In this embodiment, the intermediary server 5 is a server operated by a credit card brand. However, in this case, each member store terminal 3 may be provided directly. The Karo affiliate store terminal 3 requests the authentication server 7 to confirm whether or not authentication can be executed. In addition, merchant authentication may be performed on the authentication server 7! /.
[0132] 認証サーバ 7は、仲介サーバ 5から受信したカード情報が認証サーバ 7に登録され ている力否かを確認することによって、当該カード情報を有するカード会員がネット決 済補助装置 1を用いたネット商取引サービスを受けられるカード会員である力否かの 確認 (認証実行可否確認)を行な ヽ、その結果を、仲介サーバ 5に返信する（S40)。 尚、認証実行可否確認結果は、仲介サーバ 5から受信したカード情報が認証サーバ 7に登録されて!ヽれば「可」であり、登録されて!、なければ「否」である。  [0132] The authentication server 7 confirms whether or not the card information received from the intermediary server 5 is registered in the authentication server 7, so that the card member having the card information uses the net settlement assistant device 1. After confirming whether or not the card member is able to receive the online commerce service (confirmation of whether or not authentication can be performed), the result is returned to the intermediary server 5 (S40). Note that the authentication execution result confirmation result is “OK” if the card information received from the intermediary server 5 is registered in the authentication server 7, and is “NO” if not registered.
[0133] そして、認証実行可否確認結果を受信した仲介サーバ 5は、その結果を加盟店端 末 3に転送する（S50)。  [0133] Then, the mediation server 5 that has received the authentication execution feasibility confirmation result transfers the result to the member store terminal 3 (S50).
[0134] カード会員の認証実行可否確認結果が「可」である場合には、このカード会員がネ ット決済補助装置 1を用いたネット商取引サービスを受けられるということであるから、 加盟店端末 3は、このカード会員の本人認証要求を行なうフローに進む（S60)。具 体的には、加盟店端末 3は、会員端末 2に対し、認証実行可否結果とともに、先に認 証実行可否確認を行なったイシユアの認証サーバ 7の URL情報を送信する。  [0134] If the card member authentication execution confirmation result is "Yes", this means that the card member can receive the online commerce service using the network settlement assistant device 1, so that the member store terminal In step S60, the process proceeds to a flow for requesting authentication of the cardholder. Specifically, the member store terminal 3 transmits to the member terminal 2 the URL information of the authentication server 7 of the issuer that has previously confirmed whether or not the authentication can be executed together with the result of whether or not the authentication can be executed.
[0135] 加盟店端末 3から認証要求を受けた会員端末 2は、受信した URLに基づき、先に 仲介サーバ 5がアクセスしたのと同一の認証サーバ 7にアクセスし、認証要求を行なう (S70)。尚、 S70のフローは、 S60から一連の流れとして行なわれ、会員端末 2として 用いられるパーソナルコンピュータや携帯電話のブラウザが一般的に備えるリダィレ タト機能等を用いて実現可能であり、カード会員が意識することなぐ会員端末 2内部 で自動的に処理されるフローである。 [0135] The member terminal 2 that has received the authentication request from the member store terminal 3 accesses the same authentication server 7 that the mediation server 5 previously accessed based on the received URL, and makes an authentication request. (S70). The flow of S70 is carried out as a series of flow from S60, and can be realized by using a redirection function or the like generally provided in a personal computer or mobile phone browser used as the member terminal 2, and the card member is conscious of it. This is a flow that is automatically processed inside the member terminal 2 without having to do it.
[0136] 認証サーバ 7は、会員端末 2に、ワンタイムパスワードの送信を促し、会員端末 2か ら受信したワンタイムノ スワードに基づいて、カード会員の認証を行なう（S80)。  [0136] The authentication server 7 prompts the member terminal 2 to transmit a one-time password, and authenticates the card member based on the one-time password received from the member terminal 2 (S80).
[0137] 具体的には、認証サーバ 7は、アクセスしてきた会員端末 2から、カード情報及び注 文情報を受信して、このカード情報を有するカード会員が、先ほど、加盟店端末 3か ら仲介サーバ 5を介して、認証実行可否確認要求を受けたカード会員である力否か を確認する。この確認は、予め定められた所定時間前に仲介サーバ 5から当該カー ド会員のカード情報を受信した力否かのログを残しておき、会員端末 2から受信した カード会員のカード情報が、所定時間前にログに残されたカード情報に一致するか 否かを確認することで行なわれる。  [0137] Specifically, the authentication server 7 receives the card information and the order information from the accessing member terminal 2, and the card member having this card information mediates from the member store terminal 3 earlier. Via the server 5, it is confirmed whether or not the card member has received a request for confirmation of whether or not authentication can be executed. This confirmation is made by keeping a log of whether or not the card member's card information has been received from the intermediary server 5 a predetermined time before the card member's card information received from the member terminal 2 This is done by checking whether it matches the card information left in the log before time.
[0138] 尚、注文情報は、会員端末 2からではなぐ S20, 30のフローにおいて、加盟店端 末 3から仲介サーバ 5を介して認証サーバ 7に送信されていてもよいし、加盟店端末 3から会員端末 2に、認証サーバ 7の URL情報が送信される際、一緒に送信され、会 員端末 2が認証サーバ 7にアクセスする際に、認証サーバ 7に転送されるようになって いてもよい。  Note that the order information may be transmitted from the member store terminal 3 to the authentication server 7 via the mediation server 5 in the flow of S20, 30 not from the member terminal 2, or the member store terminal 3 Even if the URL information of the authentication server 7 is transmitted from the user to the member terminal 2, it is transmitted together, and when the member terminal 2 accesses the authentication server 7, it is transferred to the authentication server 7. Good.
[0139] また、認証サーバ 7が、アクセスしてきた会員端末 2のカード会員と、加盟店端末 3 力 認証実行可否確認要求を受けたカード会員と同一である力否かの確認は、カー ド情報の照合のみならず、注文情報を、会員端末 2及び加盟店端末 3 (直接的には 仲介サーバ 5)の双方力も受信して、それらの照合を併用して行なわれてもよい。  [0139] The authentication server 7 confirms whether or not the card member of the accessing member terminal 2 is the same as the card member who has received the request to confirm whether or not the member terminal terminal 3 can execute the authentication. In addition to the collation, the order information may be received by both the member terminal 2 and the member store terminal 3 (directly the intermediary server 5), and these collations may be used together.
[0140] 認証サーバ 7が、先に認証実行可否確認要求を受けたカード会員のネット決済補 助装置 1からのアクセスであることを確認したら、認証サーバ 7は、受信した注文情報 に基づき、図 4 (b)に示されるようなワンタイムパスワード入力画面 101を作成し、ァク セスのあった会員端末 2に送信する。  [0140] When the authentication server 7 confirms that the access is from the card payment assistant device 1 of the cardholder who has received the request to confirm whether or not the authentication can be executed first, the authentication server 7 determines whether the access is based on the received order information. 4 Create the one-time password input screen 101 as shown in (b) and send it to the member terminal 2 that had access.
[0141] 図 4 (b)のワンタイムパスワード入力画面 101には、カード会員がネット商取引を行 なう相手である加盟店名と、注文しょうとしている商品 ·サービスの金額、注文日が、 表示されている。 [0141] The one-time password entry screen 101 in Fig. 4 (b) shows the name of the merchant that the cardholder is engaged in online commerce, the amount of goods and services that they are trying to order, and the order date. It is displayed.
[0142] 会員端末 2にワンタイムパスワード入力画面 101が表示されると、カード会員は、ネ ット決済補助装置 1のスタートキー 12bを押下する。ネット決済補助装置 1の OTP生 成手段 16は、スタートキー 12b押下を検出すると、ワンタイムノ スワード生成待ち状 態から、ワンタイムパスワード生成フローに移行する。  [0142] When the one-time password input screen 101 is displayed on the member terminal 2, the card member presses the start key 12b of the network settlement assistant device 1. When detecting that the start key 12b is pressed, the OTP generating means 16 of the online payment assisting device 1 shifts from the one-time password generation waiting state to the one-time password generation flow.
[0143] OTP生成手段 16は、 OTP生成情報格納部 17に格納された共通鍵を読み出し、 計時手段 18によって計時された、スタートキー 12bが押下された日時から成る日時 データ (年月日秒、秒は 30秒単位)を、この共通鍵で暗号ィ匕することでワンタイムパス ワードを生成し、これを 10進数にし、ディスプレイ 11に表示する。尚、本実施例の暗 号化方式は共通鍵暗号方式を採用している。また、本実施例のディスプレイ 11の表 示可能桁数は 8桁なので、ディスプレイ 11には生成されたワンタイムパスワードの上 6 〜8桁を表示することにする。  [0143] The OTP generation means 16 reads out the common key stored in the OTP generation information storage section 17, and is date / time data (year / month / day / second, A one-time password is generated by encrypting the second (in units of 30 seconds) using this common key, and this is converted to a decimal number and displayed on the display 11. Note that the encryption method of this embodiment employs a common key encryption method. Further, since the display 11 of the present embodiment has 8 displayable digits, the display 11 displays the upper 6 to 8 digits of the generated one-time password.
[0144] カード会員は、会員端末 2に表示されたワンタイムパスワード入力画面 101のパスヮ ード入力欄 101 aに、ネット決済補助装置 1のディスプレイ 11に表示されたワンタイム ノ スワードを入力し、送信ボタン 101bをクリックすると、入力されたワンタイムパスヮー ドが認証サーバ 7に送信される。  [0144] The cardholder enters the one-time password displayed on the display 11 of the online payment assistant device 1 in the password input field 101a of the one-time password input screen 101 displayed on the member terminal 2, When the send button 101b is clicked, the entered one-time password is sent to the authentication server 7.
[0145] 尚、ワンタイムパスワードの入力が終わった後は、カード会員が、ネット決済補助装 置 1のスタートキー 12bを再押下することで、ネット決済補助装置 1のディスプレイ 11 に表示されているワンタイムパスワードを非表示とすることがセキュリティの観点から望 ましい。また同時に、電源もオフされるの力 省エネの観点から望ましい。  [0145] Note that after the one-time password has been entered, the cardholder re-presses the start key 12b of the online payment assisting device 1 to display it on the display 11 of the online payment assisting device 1. It is desirable from the security point of view to hide the one-time password. At the same time, the power is also turned off. This is desirable from the viewpoint of energy saving.
[0146] 会員端末 2からワンタイムパスワードを受信した認証サーバ 7は、まず、この会員端 末 2が、先に、ワンタイムノ スワードの送信を要求した相手であることを、会員端末 2の 識別番号等の照合や、当該会員端末 2個別に生成されて送信されたワンタイムノ ス ワード入力画面 101に対する返信か否かの確認により、確認する。  [0146] Upon receiving the one-time password from the member terminal 2, the authentication server 7 first confirms that the member terminal 2 is the other party who first requested transmission of the one-time password, such as the identification number of the member terminal 2. This is confirmed by confirming whether or not the response is for the one-time password input screen 101 generated and transmitted individually for the member terminal 2 concerned.
[0147] 確認後、認証サーバ 7は、ワンタイムパスワードの送信を要求する前に受信してい たカード会員のカード情報に基づき、 OTP生成情報の中から、このカード番号に関 連付けて登録されている共通鍵を取出し、認証サーバ 7が会員端末 2からワンタイム パスワードを受信した日時からなる日時データ (年月日秒、秒は 30秒単位)を、この 共通鍵で暗号ィ匕してワンタイムパスワードを生成し、これを十進数に変換する。尚、 本実施例の暗号化方式は、共通鍵暗号方式を採用して!/、る。 [0147] After confirmation, the authentication server 7 is registered in association with this card number from the OTP generation information based on the card information of the card member received before requesting the transmission of the one-time password. The date / time data (year / month / day / second, second is in units of 30 seconds) consisting of the date and time when the authentication server 7 received the one-time password from the member terminal 2 It encrypts with the common key to generate a one-time password and converts it to a decimal number. Note that the encryption method of this embodiment adopts a common key encryption method.
[0148] このようにして認証サーバ 7は、認証サーバ 7で生成されたワンタイムパスワードと、 先に会員端末 2から受信したワンタイムパスワードとが、一致するか否かを確認する。 一致すれば、このワンタイムパスワードは、確かに、ネット決済補助装置 1と認証サー ノ 7のみに格納された共通鍵によって、ほぼ同時刻に作成されたワンタイムパスヮー ドであることが証明される。  In this way, the authentication server 7 confirms whether or not the one-time password generated by the authentication server 7 matches the one-time password received from the member terminal 2 earlier. If they match, this one-time password is certainly proved to be a one-time password created at almost the same time by the common key stored only in the net payment assistant device 1 and the authentication server 7. The
[0149] つまり、ワンタイムパスワードを認証サーバ 7に送信した会員端末 2の操作者が、当 該ワンタイムパスワードの生成に用いられた共通鍵及び、当該共通鍵に関連付けら れたカード情報が格納されたネット決済補助装置 1の操作者であり、かつ、当該カー ド情報を利用可能なカード会員本人であり、これによつて、ネット商取引を依頼してき たカード会員の本人確認がされたことになる。  That is, the operator of the member terminal 2 that has transmitted the one-time password to the authentication server 7 stores the common key used to generate the one-time password and the card information associated with the common key. The cardholder who is the operator of the online payment assistance device 1 and who can use the card information, has confirmed the identity of the cardholder who requested the online commerce. Become.
[0150] 尚、ワンタイムパスワード生成方式が、本実施例のように時間同期方式を採用して いる場合、ネット決済補助装置 1がワンタイムパスワード生成に用いる日時と、認証サ ーバ 7がワンタイムパスワード生成に用いる日時とは、厳密には同じにならず、よって 、認証サーバ 7がワンタイムパスワードを生成してから、カード会員が、ネット決済補助 装置 1のスタートキー 12bを押下して、ネット決済補助装置 1がワンタイムパスワードを 生成するまでの時間差を考慮して、本実施例では、 日時データの秒分解能を 30秒と している。  [0150] When the one-time password generation method adopts the time synchronization method as in the present embodiment, the date and time used by the net settlement auxiliary device 1 to generate the one-time password and the authentication server 7 are one. The date and time used to generate the time password are not exactly the same. Therefore, after the authentication server 7 generates the one-time password, the card member presses the start key 12b of the online payment assisting device 1, In consideration of the time difference until the online settlement assistance device 1 generates the one-time password, the second resolution of the date / time data is set to 30 seconds in this embodiment.
[0151] しかし、両者によって生成されたワンタイムパスワードが完全に一致しない限り、力 ード会員の真正性を認めないというのでは、カード会員がネット決済補助装置 1のス タートキー 12bを押下してワンタイムパスワードが生成されてから、認証サーバ 7が、 会員端末 2からワンタイムパスワードを受信するまでの間、 30秒以上経過してしまつ た場合に、それだけで、ワンタイムパスワードが不一致となり、認証されないという事 態が増え、力えってネット商取引の利便性が損なわれることになつてしまう。  [0151] However, unless the one-time passwords generated by both parties match completely, the card member does not accept the authenticity of the force member. The card member presses the start key 12b of the online payment assisting device 1. If more than 30 seconds elapse between the time when the one-time password is generated and the time when the authentication server 7 receives the one-time password from the member terminal 2, the one-time password does not match. The number of unauthenticated cases will increase, and the convenience of online commerce will be impaired.
[0152] 従って、認証サーバ 7は、会員端末 2から受信したワンタイムパスワードがー致しな 力つた場合でも、会員端末 2からワンタイムパスワードを受信した日時を、前後 N回 X 30秒分ずらして、認証サーバ 7側でワンタイムパスワードを生成し直して、会員端末 2 側で生成されたワンタイムパスワードと一致すれば、カード会員の本人確認がされた ものとする。 [0152] Therefore, even if the one-time password received from the member terminal 2 is not valid, the authentication server 7 shifts the date and time when the one-time password is received from the member terminal 2 N times before and after X 30 seconds. , Generate a one-time password again on the authentication server 7 side, If it matches the one-time password generated by the customer, the identity of the cardholder is confirmed.
[0153] 尚、 Nは、セキュリティ精度を考慮して、予め決定しておく。すなわち、セキュリティ精 度を高くしたい時は、 Nを小さく設定し、セキュリティ精度を低くしてカード会員側の利 便性を優先したい場合は、 Nを大きく設定しておく。  Note that N is determined in advance in consideration of security accuracy. That is, if you want to increase the security accuracy, set N small, and if you want to reduce the security accuracy and give priority to the convenience of cardholders, set N large.
[0154] 認証サーバ 7は、ワンタイムパスワード照合によるカード会員の認証結果を、会員端 末 2に送信する（S90)。尚、具体的には、認証サーバ 7は、会員端末 2に対し、認証 結果に加え、加盟店端末 3の URL情報を送信し、会員端末 2から加盟店端末 3に認 証結果が転送されるようにしておく。  [0154] The authentication server 7 transmits the card member authentication result based on the one-time password verification to the member terminal 2 (S90). Specifically, the authentication server 7 transmits the URL information of the member store terminal 3 to the member terminal 2 in addition to the authentication result, and the authentication result is transferred from the member terminal 2 to the member store terminal 3. Keep it like that.
[0155] 認証結果を受信した会員端末 2は、当該認証結果 (本人認証 OK、本人認証 NG) を更に、カロ盟店端末 3に転送する（S100)。尚、 S100のフローは、 S70同様、 S90力 ら一連の流れとして行なわれ、会員端末 2のブラウザのリダイレクト機能によって実現 可能であり、実際には、カード会員が意識することなぐ会員端末 2内部で自動的に 処理されるフローである。  [0155] Upon receiving the authentication result, the member terminal 2 further transfers the authentication result (personal authentication OK, personal authentication NG) to the Karo Alliance store terminal 3 (S100). The flow of S100, like S70, is performed as a series of flows from S90, and can be realized by the redirect function of the browser of the member terminal 2. In fact, the flow is performed inside the member terminal 2 without the card member being aware of it. It is a flow that is automatically processed.
[0156] 加盟店端末 3は、会員端末 2から認証結果を受信し、認証の結果、カード会員の本 人確認がされた場合 (本人認証 OK)には、ァクワイアラに、当該カード会員のォーソ リ要求をするため、ァクワイアラ端末 4に、カード会員のカード情報と、決済希望金額（ カード会員が注文しょうとしている商品 ·サービスの金額)からなる取引データにカロえ 、当該認証結果を送信する（S 110)。尚、取引データは、 S10で、会員端末 2から、 注文情報とカード情報の送信があった時点で既に生成されて、加盟店端末 3に記憶 されたものが、読み出されてもよい。  [0156] The member store terminal 3 receives the authentication result from the member terminal 2, and if the identity of the card member is confirmed (authentication is OK) as a result of the authentication, the merchant terminal 3 authenticates the card member's authority. In order to make a request, the authentication data is sent to the acquirer terminal 4 and the authentication result is sent to the transaction data consisting of the card member's card information and the desired payment amount (the amount of the product / service the card member is trying to order) (S 110). Note that the transaction data already generated at the time when the order information and the card information are transmitted from the member terminal 2 and stored in the member store terminal 3 may be read in S10.
[0157] ァクワイアラ端末 4は、加盟店端末 3から受信した取引データと認証結果に基づき、 本人認証 OKのカード会員のカード番号に基づ 、て、カード発行元であるイシユアを 特定し、特定されたイシユアのイシユア端末 6に、取引データと認証結果を転送する（ S120)。  [0157] Based on the transaction data received from the member store terminal 3 and the authentication result, the acquirer terminal 4 identifies and identifies the card issuer issuer based on the card number of the card member who has been authenticated. The transaction data and the authentication result are transferred to the issuer's issuer terminal 6 (S120).
[0158] 取引データと認証結果を受信したイシユア端末 6は、図示しない会員データベース に格納されている会員毎の会員情報や与信情報に基づいて、取引データに含まれ る決済希望金額が、ォーソリを依頼されたカード会員の与信枠の範囲内力否かを確 認する。決済希望金額が与信枠の範囲内であれば、ォーソリ OKとして、決済希望金 額分の与信枠を確保する。 [0158] Upon receiving the transaction data and the authentication result, the issuer terminal 6 determines whether the desired settlement amount included in the transaction data is correct based on the member information and credit information for each member stored in the member database (not shown). Confirm whether the requested cardholder credit limit is within the limits Admit. If the desired amount of payment is within the credit line, ZOOM OK is secured and a credit line equivalent to the desired amount of payment is secured.
[0159] そして、イシユア端末 6は、ォーソリの結果 (ォーソリ OK、ォーソリ NG)をァクワイア ラ端末 4に送信し (S130)、更に、ァクワイアラ端末 4は、加盟店端末 3に、ォーソリ結 果を転送する（S 140)。  [0159] The issuer terminal 6 transmits the authorization result (authorization OK, authorization NG) to the acquirer terminal 4 (S130), and the acquirer terminal 4 forwards the authorization result to the member store terminal 3. (S 140).
[0160] そして、加盟店端末 3は、ァクワイアラ端末 4カもォーソリ結果を受信した後、その結 果を会員端末 2に通知する（S150)。具体的には、ォーソリ結果が OKだった場合に は、加盟店とカード会員との間で、当該カード会員のカード番号を用いた決済による ネット商取引が成立した旨の画面を会員端末 2に送信し、会員端末 2に表示する。ま たォーソリ結果力NGだった場合には、ネット商取引が不成立の旨の画面を会員端 末 2に送信、表示する。  [0160] After the merchant terminal 4 receives the result of the authorization, the member terminal 3 notifies the member terminal 2 of the result (S150). Specifically, if the authorization result is OK, a screen to the effect that online commerce is established between the member store and the card member using the card number of the card member is sent to the member terminal 2. And displayed on member terminal 2. If the result is NG, the screen indicating that Internet commerce has not been established is sent to the member terminal 2 and displayed.
[0161] 尚、本実施例では、認証サーバ 7におけるワンタイムノ スワードを用いた本人認証 は、会員端末 2と加盟店端末 3との間でネット商取引が行なわれる都度、行なわれる。 つまり、本実施例の OTP生成手段 16で生成されるワンタイムパスワードは、 1回限り のネット商取引に有効なものであるから、仮にネット決済補助装置を所持していない 第三者がワンタイムノ スワードを盗聴しても、第三者が、カード会員になりすまして以 降のネット商取引を行なうことは出来ず、ネット商取引の安全性が更に向上する。 実施例 2  [0161] In the present embodiment, the identity authentication using the one-time password in the authentication server 7 is performed each time an online business transaction is performed between the member terminal 2 and the member store terminal 3. In other words, since the one-time password generated by the OTP generation means 16 of this embodiment is effective for one-time online commerce, a third party who does not have an online payment assistance device temporarily receives a one-time password. Even if eavesdropping, a third party cannot masquerade as a card member and carry out subsequent online commerce, further improving the safety of online commerce. Example 2
[0162] 次に、ネット決済補助装置 la (図示せず)を配布されたカード会員が、当該ネット決 済補助装置 laを用いて、通信機能を有するパソコンや携帯電話から、当該カード会 員のカード番号を用いた決済により、ネット商取引を行なう場合の一実施例について 説明する。  [0162] Next, a card member who is distributed with the online payment assistant device la (not shown) uses the online settlement assistant device la from the personal computer or mobile phone having a communication function to the card member. A description will be given of an embodiment in which online commerce is performed by settlement using a card number.
[0163] 先の実施例 1と、本実施例との相違点は、ネット決済補助装置が備える OTP生成 手段 16のワンタイムパスワード生成方法と、 OTP生成情報格納部 17の格納内容と、 図 3における会員端末 2と認証サーバ 7 (本実施例では認証サーバ 7aとする）との間 の認証フロー（S80, S90)の内容である。  [0163] The difference between the first embodiment and the present embodiment is that the one-time password generation method of the OTP generation means 16 provided in the net settlement auxiliary device, the stored contents of the OTP generation information storage unit 17, and FIG. This is the contents of the authentication flow (S80, S90) between the member terminal 2 and the authentication server 7 (in this embodiment, the authentication server 7a).
[0164] すなわち、先の実施例 1では、ワンタイムパスワード生成方法を、時間同期方式とし ていたが、本実施例では、利用回数同期方式を採用する。これに伴い、本実施例の ネット決済補助装置 laにおいては、図 1に記載されていた計時手段 18が、計数手段 18a (図示せず）に代わる。 That is, in the first embodiment, the one-time password generation method is the time synchronization method, but in this embodiment, the usage frequency synchronization method is adopted. Along with this, this example In the online payment assisting apparatus la, the time measuring means 18 described in FIG. 1 is replaced with a counting means 18a (not shown).
[0165] ネット決済補助装置 1, laと認証サーバ 7, 7aに関し、上述した相違点以外の構成 及び、 S80, S90以外のフローについては、図 1〜図 3に示された実施例と同一であ るので、以下、図 1〜図 3を用いて、図 3の S80, S90の部分のみの詳細フローを説 明する。 [0165] Regarding the online payment assistance device 1, la and the authentication servers 7, 7a, the configuration other than the above-described differences and the flow other than S80, S90 are the same as the embodiment shown in Figs. Therefore, the detailed flow of only the portions S80 and S90 in FIG. 3 will be described below with reference to FIGS.
[0166] 本実施例の OTP生成情報格納部 17に格納される OTP生成情報は、ネット決済補 助装置 laに固有の共通鍵と、利用回数情報とから構成される。  [0166] The OTP generation information stored in the OTP generation information storage unit 17 of the present embodiment is composed of a common key unique to the network payment assistance apparatus la and usage count information.
[0167] このうち、共通鍵は、 OTP生成情報格納部 17内に書き換え不可能な状態で格納さ れ、 OTP生成手段 16で生成されたワンタイムパスワードの検証を行なう認証サーバ 7aにおいて、カード情報格納部 13に格納されているカード番号と関連付けられてい る。  [0167] Among these, the common key is stored in the OTP generation information storage unit 17 in a non-rewritable state, and the authentication server 7a that verifies the one-time password generated by the OTP generation unit 16 uses the card information. Associated with the card number stored in the storage unit 13.
[0168] 利用回数情報は、共通鍵同様、認証サーバ 7aにおいて、カード情報格納部 13に 格納されて 、るカード番号と関連付けられて 、る。  [0168] Like the common key, the usage count information is stored in the card information storage unit 13 in the authentication server 7a and is associated with the card number.
[0169] つまり、これらの OTP生成情報は、カード番号と関連付けられた状態で、認証サー ノ 7aにも格納されており、認証サーバ 7aが会員端末 2からワンタイムパスワードを受 信した際、会員端末 2同様、認証サーバ 7aでもワンタイムパスワードを生成して、これ らが一致するかどうかを確認することによって、ワンタイムパスワードの妥当性検証、 カード会員の認証を行なう。  [0169] In other words, these OTP generation information is stored in the authentication server 7a in a state associated with the card number, and when the authentication server 7a receives the one-time password from the member terminal 2, Like terminal 2, authentication server 7a also generates a one-time password and verifies whether they match, thereby verifying the validity of the one-time password and authenticating the cardholder.
[0170] また、利用回数情報は、 OTP生成手段 16からの書き換え指令があった場合のみ、 書き換えが可能な情報であり、計数手段 18aによって、 0回、 1回、 2回というように 1 ずつ加算されるか又は、 100回、 99回、 98回というように、 1ずつ減算された後、カロ 算又は減算後の数値が、 OTP生成情報格納部 17に格納されて、利用回数情報が 更新される。尚、加算か減算かは、予め決められている。  [0170] In addition, the usage count information is information that can be rewritten only when a rewrite command is issued from the OTP generation means 16, and is incremented by 1 such as 0, 1, or 2 by the counting means 18a. The number is added or subtracted one by one, such as 100, 99, 98, etc., and the numerical value after calorie calculation or subtraction is stored in the OTP generation information storage unit 17, and the usage count information is updated. Is done. Whether to add or subtract is determined in advance.
[0171] 尚、計数手段 18aは、 OTP生成手段 16に含まれていてもよいし、 OTP生成手段 1 6と別に設けられていてもよいが、後者の場合は、 OTP生成手段 16が計数手段 18a を制御して、利用回数情報の書き換えが行なわれる必要がある。  [0171] The counting means 18a may be included in the OTP generation means 16, or may be provided separately from the OTP generation means 16; in the latter case, the OTP generation means 16 is a counting means. It is necessary to rewrite the usage count information by controlling 18a.
[0172] 図 3の S80において、まず、認証サーバ 7aは、会員端末 2に、ワンタイムパスワード の送信を促し、会員端末 2から受信したワンタイムパスワードに基づいて、カード会員 の認証を行なう。 [0172] In S80 of FIG. 3, the authentication server 7a first sends the one-time password to the member terminal 2. The card member is authenticated based on the one-time password received from the member terminal 2.
[0173] 具体的には、認証サーバ 7aは、アクセスしてきた会員端末 2から、カード情報及び 注文情報を受信して、このカード情報を有するカード会員が、先ほど、加盟店端末 3 から仲介サーバ 5を介して、認証実行可否確認要求を受けたカード会員であるか否 かを確認する。この確認は、予め定められた所定時間前に仲介サーバ 5から当該力 ード会員のカード情報を受信した力否かのログを残しておき、会員端末 2から受信し たカード会員のカード情報が、所定時間前にログに残されたカード情報に一致する か否かを確認することで行なわれる。  [0173] Specifically, the authentication server 7a receives the card information and the order information from the member terminal 2 that has accessed, and the card member having this card information has previously received the intermediary server 5 from the member store terminal 3. It is confirmed whether or not the card member has received a request for confirmation of whether or not authentication can be performed. This confirmation is made by keeping a log of whether or not the card member's card information has been received from the intermediary server 5 before a predetermined time, and the card member's card information received from the member terminal 2 is stored. This is done by checking whether or not it matches the card information left in the log a predetermined time ago.
[0174] 尚、注文情報は、会員端末 2からではなぐ S20, 30のフローにおいて、加盟店端 末 3から仲介サーバ 5を介して認証サーバ 7aに送信されて 、てもよ 、し、加盟店端末 3から会員端末 2に、認証サーバ 7aの URL情報が送信される際、一緒に送信され、 会員端末 2が認証サーバ 7aにアクセスする際に、認証サーバ 7aに転送されるように なっていてもよい。  [0174] The order information is sent from the member store terminal 3 to the authentication server 7a via the mediation server 5 in the flow of S20, 30 but not from the member terminal 2. When the URL information of the authentication server 7a is transmitted from the terminal 3 to the member terminal 2, it is transmitted together, and is transferred to the authentication server 7a when the member terminal 2 accesses the authentication server 7a. Also good.
[0175] また、認証サーバ 7aが、アクセスしてきた会員端末 2のカード会員と、加盟店端末 3 力 認証実行可否確認要求を受けたカード会員と同一である力否かの確認は、カー ド情報の照合のみならず、注文情報を、会員端末 2及び加盟店端末 3 (直接的には 仲介サーバ 5)の双方力も受信して、それらの照合を併用して行なわれてもよい。  [0175] The authentication server 7a checks whether the card member of the accessing member terminal 2 is the same as the card member who has received the request to confirm whether or not the member terminal terminal 3 can execute the authentication. In addition to the collation, the order information may be received by both the member terminal 2 and the member store terminal 3 (directly the intermediary server 5), and these collations may be used together.
[0176] 認証サーバ 7aが、先に認証実行可否確認要求を受けたカード会員のネット決済補 助装置 1からのアクセスであることを確認したら、認証サーバ 7aは、受信した注文情 報に基づき、図 4 (b)に示されるようなワンタイムパスワード入力画面 101を作成し、ァ クセスのあった会員端末 2に送信する。  [0176] When the authentication server 7a confirms that the access is from the card payment assistant device 1 of the card member that has received the authentication execution feasibility confirmation request first, the authentication server 7a, based on the received order information, Create a one-time password entry screen 101 as shown in Fig. 4 (b), and send it to the member terminal 2 that had access.
[0177] 図 4 (b)のワンタイムパスワード入力画面 101には、カード会員がネット商取引を行 なう相手である加盟店名と、注文しょうとしている商品 ·サービスの金額、注文日が、 表示されている。  [0177] The one-time password entry screen 101 in Fig. 4 (b) displays the name of the merchant that the card member is engaged in online commerce, the amount of the product / service that the customer is trying to order, and the order date. ing.
[0178] 会員端末 2にワンタイムパスワード入力画面 101が表示されると、カード会員は、ネ ット決済補助装置 1のスタートキー 12bを押下する。ネット決済補助装置 1の OTP生 成手段 16は、スタートキー 12b押下を検出すると、ワンタイムノ スワード生成待ち状 態から、ワンタイムパスワード生成フローに移行する。 [0178] When the one-time password input screen 101 is displayed on the member terminal 2, the card member presses the start key 12b of the net settlement assistant device 1. When the OTP generation means 16 of the online payment assistant device 1 detects that the start key 12b has been pressed, Shift to the one-time password generation flow.
[0179] OTP生成手段 16は、 OTP生成情報格納部 17に格納された共通鍵と利用回数情 報を読み出し、当該利用回数情報を、共通鍵で暗号ィ匕してワンタイムパスワードを生 成し、これを 10進数にし、ディスプレイ 11に表示する。  [0179] The OTP generation means 16 reads the common key and usage count information stored in the OTP generation information storage section 17, and encrypts the usage count information with the common key to generate a one-time password. , Make this a decimal number and display on display 11.
[0180] 尚、本実施例では、利用回数情報を所定のワンタイムパスワード生成アルゴリムを 用いて、ワンタイムパスワードを生成している。  In this embodiment, the one-time password is generated by using a predetermined one-time password generation algorithm for the usage count information.
[0181] また、本実施例のディスプレイ 11の表示可能桁数は 8桁なので、ディスプレイ 11に は生成されたワンタイムパスワードの上 6〜8桁を表示することにする。  [0181] Since the display 11 of the present embodiment has 8 displayable digits, the display 11 displays the upper 6 to 8 digits of the generated one-time password.
[0182] 尚、 OTP生成情報は、上記の利用回数情報と共通鍵の他に、その他、ネット決済 補助装置 laと認証サーバ 7aの両者しか知り得ない任意の情報 (例えば、ポリシー等 )を含んでいてもよぐその場合、利用回数情報と、当該任意の情報が、共通鍵で暗 号化され、ワンタイムパスワードが生成されてもよい。  [0182] Note that the OTP generation information includes, in addition to the above-described usage count information and the common key, other arbitrary information (for example, a policy) that can only be known by both the online payment assistant device la and the authentication server 7a. In that case, the usage count information and the arbitrary information may be encrypted with a common key, and a one-time password may be generated.
[0183] OTP生成手段 16は、ワンタイムパスワードを生成した後、計数手段 18aに、先に読 み出した利用回数情報を 1、加算又は減算させて、 OTP生成情報格納部 17の利用 回数情報を書き換え、更新する。  [0183] After generating the one-time password, the OTP generation means 16 causes the counting means 18a to add 1, or subtract the usage frequency information read earlier, and use the usage frequency information in the OTP generation information storage unit 17. Rewrite and update.
[0184] カード会員は、会員端末 2に表示されたワンタイムパスワード入力画面 101のパスヮ ード入力欄 101 aに、ネット決済補助装置 1のディスプレイ 11に表示されたワンタイム ノ スワードを入力し、送信ボタン 101bをクリックすると、入力されたワンタイムパスヮー ドが認証サーバ 7aに送信される。  [0184] The card member enters the one-time password displayed on the display 11 of the online payment assistant device 1 in the password input field 101a of the one-time password input screen 101 displayed on the member terminal 2, When the send button 101b is clicked, the entered one-time password is sent to the authentication server 7a.
[0185] 尚、ワンタイムパスワードの入力が終わった後は、カード会員が、ネット決済補助装 置 1のスタートキー 12bを再押下することで、ネット決済補助装置 1のディスプレイ 11 に表示されているワンタイムパスワードを非表示とすることがセキュリティの観点から望 ましい。また同時に、電源もオフされるの力 省エネの観点から望ましい。  [0185] After the one-time password has been entered, the card member re-depresses the start key 12b of the online payment assisting device 1 to display it on the display 11 of the online payment assisting device 1. It is desirable from the security point of view to hide the one-time password. At the same time, the power is also turned off. This is desirable from the viewpoint of energy saving.
[0186] 会員端末 2からワンタイムパスワードを受信した認証サーバ 7aは、まず、この会員端 末 2が、先に、ワンタイムノ スワードの送信を要求した相手であることを、会員端末 2の 識別番号等の照合や、当該会員端末 2個別に生成されて送信されたワンタイムノ ス ワード入力画面 101に対する返信か否かの確認により、確認する。  [0186] Upon receiving the one-time password from the member terminal 2, the authentication server 7a first confirms that the member terminal 2 is the other party who previously requested the one-time password transmission, such as the identification number of the member terminal 2. This is confirmed by confirming whether or not the response is for the one-time password input screen 101 generated and transmitted individually for the member terminal 2 concerned.
[0187] 確認後、認証サーバ 7aは、ワンタイムパスワードの送信を要求する前に受信してい たカード会員のカード情報に基づき、 OTP生成情報の中から、このカード番号に関 連付けて登録されて 、る共通鍵と利用回数情報を取出し、利用回数情報を共通鍵 で暗号ィ匕してワンタイムパスワードを生成し、これを十進数に変換する。 [0187] After confirmation, the authentication server 7a has received it before requesting transmission of a one-time password. Based on the card information of the cardholder, the OTP generated information is registered in association with this card number, the common key and the usage count information are extracted, and the usage count information is encrypted with the common key. Generate a one-time password and convert it to a decimal number.
[0188] 尚、本実施例では、利用回数情報を所定のワンタイムパスワード生成アルゴリムを 用いて、ワンタイムパスワードを生成している。また、 OTP生成情報に、任意の情報 が含まれていれば、利用回数情報に加え、当該任意の情報も合わせて共通鍵で暗 号化する。  In the present embodiment, a one-time password is generated by using a predetermined one-time password generation algorithm as usage frequency information. In addition, if the OTP generation information includes arbitrary information, in addition to the usage count information, the arbitrary information is also encrypted with the common key.
[0189] このようにして、認証サーバ 7aは、認証サーバ 7aで生成されたワンタイムパスワード と、先に会員端末 2から受信したワンタイムパスワードとが、一致するか否かを確認す る。一致すれば、このワンタイムノ スワードは、確かに、ネット決済補助装置 1と認証サ ーバ 7aのみに格納された利用回数情報と共通鍵とによって作成されたワンタイムパ スワードであることが証明される。  In this way, the authentication server 7a checks whether or not the one-time password generated by the authentication server 7a matches the one-time password received from the member terminal 2 earlier. If they match, this one-time password is certainly proved to be a one-time password created by the usage count information and the common key stored only in the online payment assisting device 1 and the authentication server 7a.
[0190] つまり、ワンタイムパスワードを認証サーバ 7aに送信した会員端末 2の操作者力 当 該ワンタイムパスワードの生成に用いられた利用回数情報と共通鍵及び、当該共利 用回数情報と通鍵に関連付けられたカード情報が格納されたネット決済補助装置 1 の操作者であり、かつ、当該カード情報を利用可能なカード会員本人であり、これに よって、ネット商取引を依頼してきたカード会員の本人確認がされたことになる。  [0190] That is, the operator power of the member terminal 2 that transmitted the one-time password to the authentication server 7a. The usage count information and the common key used to generate the one-time password, and the shared usage count information and the key. The cardholder who is the operator of the online payment assisting device 1 in which the card information associated with the card is stored and who can use the card information. Confirmation has been made.
[0191] 認証サーバ 7aは、ワンタイムパスワード照合によるカード会員の認証結果 (本人認 証 OK、本人認証 NG)を、会員端末 2に送信するとともに、先のワンタイムパスワード 生成に用いた利用回数情報を、予め決められた演算方法により加算又は減算し、そ の演算結果を認証サーバ 7a内の利用回数情報として書き換え、更新する（S90)。  [0191] The authentication server 7a sends the card member authentication result (personal authentication OK, personal authentication NG) based on the one-time password verification to the member terminal 2, and the usage count information used for the previous one-time password generation. Are added or subtracted by a predetermined calculation method, and the calculation result is rewritten and updated as use frequency information in the authentication server 7a (S90).
[0192] 尚、ワンタイムパスワード生成方式が、本実施例のように利用回数同期方式を採用 している場合、会員端末 2及びネット決済補助装置 laの操作者が正当なカード会員 であったとしても、ネット決済補助装置 laがワンタイムパスワード生成に用いる利用回 数情報と、認証サーバ 7aがワンタイムパスワード生成に用いる利用回数情報とが異 なり、ワンタイムパスワードが一致しない場合がある。  [0192] When the one-time password generation method adopts the usage frequency synchronization method as in the present embodiment, it is assumed that the operator of the member terminal 2 and the net settlement assistant device la is a valid card member. However, the number-of-uses information used for the one-time password generation by the online payment assisting device la and the number-of-uses information used by the authentication server 7a for generating the one-time password may be different and the one-time password may not match.
[0193] カード会員が、ネット決済補助装置 laでワンタイムパスワードを生成しても、それが 必ず、認証サーバ 7aに送信される保証はなぐカード会員が、ネット商取引を途中で 中断してしまう場合や、また、そもそもネット商取引を行なっていないにもかかわらず、 ネット決済補助装置 laを操作して、いたずらにワンタイムパスワードを生成してしまう ことがある。そのような場合には、ネット決済補助装置 laの利用回数情報は更新され るのに、認証サーバ 7aの利用回数情報は更新されないので、当然、生成されるワン タイムパスワードも異なるものになってしまう。 [0193] Even if a card member generates a one-time password with the online payment assistant device la, the card member does not guarantee that it will be sent to the authentication server 7a. Even if you are interrupted or you are not engaged in online commerce, you may accidentally generate a one-time password by operating the online payment assistant la. In such a case, the usage count information of the network payment assistant device la is updated, but the usage count information of the authentication server 7a is not updated, so the generated one-time password will naturally be different. .
[0194] しかし、両者によって生成されたワンタイムパスワードが完全に一致しない限り、力 ード会員の真正性を認めないというのでは、認証 NGが増え、かえってネット商取引 の禾 IJ便'性が損なわれることになつてしまう。  [0194] However, as long as the one-time passwords generated by both parties do not match completely, if the authenticity of the force member is not recognized, the authentication NG will increase, and on the contrary, the 禾 IJ service of Internet commerce will be impaired. Will end up being lost.
[0195] 従って、認証サーバ 7aは、会員端末 2から受信したワンタイムパスワードがー致しな 力つた場合でも、認証サーバ 7aに格納されている利用回数情報を所定範囲（例えば 、利用回数情報 + N)で変更して、認証サーバ 7a側でワンタイムノ スワードを生成し 直して、会員端末 2側で生成されたワンタイムパスワードと一致すれば、カード会員の 本人確認がされたものとする。  Accordingly, even when the one-time password received from the member terminal 2 is valid, the authentication server 7a sets the usage count information stored in the authentication server 7a to a predetermined range (for example, usage count information + N ), The authentication server 7a regenerates the one-time password, and if it matches the one-time password generated on the member terminal 2, the card member is confirmed.
[0196] 尚、 Nは、セキュリティ精度を考慮して、予め決定しておく。すなわち、セキュリティ精 度を高くしたい時は、 Nを小さく設定し、セキュリティ精度を低くしてカード会員側の利 便性を優先したい場合は、 Nを大きく設定しておく。  [0196] Note that N is determined in advance in consideration of security accuracy. That is, if you want to increase the security accuracy, set N small, and if you want to reduce the security accuracy and give priority to the convenience of cardholders, set N large.
[0197] 以上のように、本発明のネット決済補助装置を用いてネット商取引を行なうと、カー ド情報をカード情報入力画面に入力する際、ネット決済補助装置に入力された入力 情報が、ネット決済補助装置に格納されている認証情報と一致しなければ、カード会 員自身であってもカード情報を知ることが出来ないので、カード情報が露出している 従来のクレジットカードと異なり、カード情報の秘匿 ¾が高まり、ネット商取引における カード情報の不正使用が防止される。  [0197] As described above, when online commerce is performed using the online payment assistant device of the present invention, when the card information is input to the card information input screen, the input information input to the online payment assistant device is If the card information does not match the authentication information stored in the payment assistant device, the card information cannot be obtained even by the card member itself. The confidentiality of is increased, and unauthorized use of card information in online commerce is prevented.
[0198] また、ネット決済補助装置は可搬型であるので、カード会員がどこにいても、携帯電 話、自宅のパソコン、出先のパソコンを用いて、安全なネット商取引を行なうことが出 来、ネット商取引の利便性が増す。  [0198] Also, since the online payment assistance device is portable, it is possible to carry out secure online commerce using a mobile phone, a home PC, or a destination PC wherever a cardholder is. The convenience of commerce increases.
[0199] また、ネット商取引が行なわれる際のカード会員の本人認証は、ネット決済補助装 置で生成されるワンタイムパスワードと、認証サーバで生成されるワンタイムパスヮー ドとが一致する力否かによって行なわれる。 [0200] このワンタイムパスワードは、ネット決済補助装置に固有で、ネット決済補助装置及 び認証サーバのみに格納され、かつ、カード会員自身でさえも知ることが出来ない共 通鍵を用いて、所定キーの押下が検出された日時からなる日時データもしくはワンタ ィムパスワードの生成都度、更新される利用回数情報を暗号ィ匕したものである。 [0199] In addition, the card member's personal authentication when online commerce is conducted is based on whether the one-time password generated by the online payment assistant device matches the one-time password generated by the authentication server. It is done by [0200] This one-time password is unique to the online payment assistant device, is stored only in the online payment assistant device and the authentication server, and uses a common key that cannot be known even by the cardholder itself. This is an encryption of date / time data consisting of the date / time when the pressing of the predetermined key is detected or the one-time password is generated and updated usage count information.
[0201] つまりは、ネット決済補助装置を操作して ヽるカード会員のみが作成可能な認証情 報であるから、ネット決済補助装置を所持していない第三者が、カード会員になりす ましてネット商取引を行なうことは出来ず、ネット商取引の安全性が更に向上する。  [0201] In other words, since it is authentication information that can only be created by a card member who operates an online payment assistant device, a third party who does not have an online payment assistant device becomes a card member. Online commerce cannot be performed, and the safety of online commerce is further improved.
[0202] しかも、このワンタイムパスワードの生成は、ネット決済補助装置にカード情報が表 示された後でなければ、行なわれないようになっているので、ネット決済補助装置を 有していない第三者は、カード番号のみを知っていても、ワンタイムパスワードの生成 が出来ない。また、第三者がネット決済補助装置を盗んだとしても、ネット決済補助装 置に入力する認証情報がなければ、ワンタイムパスワードの生成が出来ない。つまり 、第三者は、ネット決済補助装置の入手有無にかかわらず、カード会員になりすまし たネット商取引を行なうことが出来ないので、ネット商取引の安全性が保証される。  [0202] Moreover, since the one-time password is generated only after the card information is displayed on the network settlement assistant device, the one-time password is not provided. The three parties cannot generate a one-time password even if they only know the card number. Even if a third party steals the online payment assistant, the one-time password cannot be generated without the authentication information to be entered into the online payment assistant. In other words, the safety of online commerce is guaranteed because a third party cannot perform online commerce pretending to be a card member regardless of whether or not an online payment assistance device is available.
[0203] 尚、ワンタイムパスワードの生成方法は、上記実施例の時間同期方式に限らず、ネ ット決済補助装置と認証サーバとの間で、ネット決済補助装置を所有するカード会員 の本人認証が行える方式であればょ 、。  [0203] Note that the one-time password generation method is not limited to the time synchronization method of the above embodiment, and the identity of the cardholder who owns the net payment assistant device is connected between the network payment assistant device and the authentication server. If you can do this,
[0204] また、ネット決済補助装置は、ネット非接続型の構成を採用しているから、一度、ネ ット決済補助装置に格納されたカード情報、認証情報、 OTP生成情報は、不正ァク セス等により読み出すことが出来ず、ネット決済補助装置を配布されたカード会員さ えもが読み出すことが出来な ヽようになって!/ヽる。  [0204] Further, since the online payment assistant device adopts a network non-connection type configuration, the card information, authentication information, and OTP generation information once stored in the online payment assistant device are fraudulent. The cardholders who have been distributed with the online payment assistance device cannot read it out by the accessor, etc.!
[0205] 仮に、ネット決済補助装置が、パーソナルコンピュータや携帯電話等の端末に接続 可能であるとすると、ネット決済補助装置と端末を接続中に、何らかの不具合が発生 した場合、不具合の原因が、ネット決済補助装置側にあるのカゝ、端末側にあるのかと いう責任分解点が不明確となる。従って、ネット非接続型の構成を採用しているネット 決済補助装置は、責任分解点が明確となる意味でも、有効である。  [0205] Assuming that the online payment assistance device can be connected to a terminal such as a personal computer or a mobile phone, if any trouble occurs while connecting the online payment assistance device to the terminal, the cause of the failure is The point of responsibility disaggregation of whether it is on the side of the online payment assisting device or on the terminal side is unclear. Therefore, an online payment assistant device that employs a non-connection-type configuration is effective even in the sense that the point of responsibility resolution becomes clear.
[0206] ここで、ネット決済補助装置を持たな 、カード会員が、本実施例のネット決済システ ムで、ネット商取引を行なう場合の事前登録のシステム構成及びフローを図 6に示す [0207] カード会員は、会員 PCから、カード会社 (クレジットカードブランド又はイシユア）が 運営するカード会員向けの WEBサイトにアクセスし、カード会員だけが知る会員情報 (生年月日、電話番号、口座番号等)を入力して、 WEBサイトに送信する（図 6中、（1 ) )。 [0206] Here, FIG. 6 shows the system configuration and flow of pre-registration when a cardholder who does not have an online payment assisting device performs online commerce with the online payment system of the present embodiment. [0207] The card member accesses the WEB site for the card member operated by the card company (credit card brand or Ishiyua) from the member PC, and the member information (birth date, telephone number, account number) that only the card member knows Etc.) and send it to the website ((1) in Fig. 6).
[0208] 会員情報を受信したカード会社の WEBサイトは、当該会員情報が登録されて 、る カード会社の基幹システムにアクセスし、受信した会員情報と、基幹システムに登録 されている会員情報との照合を基幹システムに依頼する（図 6中、（2) )。基幹システ ムは、 WEBサイトに照合結果を返信する（図 6中、（3) )。  [0208] The website of the card company that received the member information accesses the core system of the card company where the member information is registered, and the received member information and the member information registered in the core system Request verification to the core system ((2) in Fig. 6). The backbone system returns the verification result to the website ((3) in Fig. 6).
[0209] 照合結果が OKであれば、カード会員の本人確認が行なわれたものとし、 WEBサイ トから、会員 PCに、パスワードの登録を要求する。会員 PCは、ノ スワードを WEBサイ トに送信する（図 6中、（4) )。  [0209] If the verification result is OK, it is assumed that the identity of the card member has been confirmed, and the registration of the password is requested from the website to the member PC. The member PC sends a password to the website ((4) in Fig. 6).
[0210] 会員 PC力もパスワードを受信した WEBサイトは、当該パスワードをカード会社の認 証サーバ 7に登録する（図 6中、（5) )。  [0210] The website that received the password for the member PC also registers the password in the card server's authentication server 7 ((5) in Fig. 6).
[0211] ここで登録されるノ スワードは、固定パスワードであり、ネット決済補助装置で生成さ れるようなワンタイムパスワードではない。つまり、ネット決済補助装置を持たないカー ド会員が、ネット決済システム上でネット決済を行なう場合の、カード会員の認証方法 は、固定パスワードによる方法し力なぐカード番号と固定パスワードが第三者に一度 知られてしまうと、以後は、第三者がカード会員になりすましてネット決済を行なうこと が可能となってしまう。  [0211] The registered password is a fixed password, not a one-time password as generated by the online payment assistant. In other words, when a card member who does not have an online payment assistance device makes an online payment on the online payment system, the card member authentication method uses a fixed password and the card number and the fixed password that can be used by a third party. Once known, it becomes possible for a third party to pretend to be a cardholder and make online payments.
[0212] また、ネット決済補助装置を持たないカード会員は、パスワードを登録するために、 カード会社の WEBサイトにアクセスして、本人認証を経た後にパスワード登録作業を 行なわなければならず、カード会員側の負担が大きい。  [0212] In addition, card members who do not have an online payment assisting device must access the card company's website and register their passwords after registering them to register their passwords. The burden on the side is large.
[0213] 更に、カード会員のみならず、カード会社側においても、パスワードをカード会員に 登録させるための WEBサイトの構築、カード会員の本人認証を行なうための基幹シ ステムの構築が必要となる。 [0213] Furthermore, not only card members, but also card companies need to construct a website for registering passwords with card members and a backbone system for authenticating card members.
[0214] また、ネット決済補助装置は、通常、カード番号が露出しておらず、カード会員のみ が知り得るもしくは、カード会員のみが有する認証情報の入力がなければ、カード番 号が表示されない構成となっており、更に、ネット決済の際に、カード会員の本人認 証に用いられるパスワードは、固定パスワードではなぐワンタイムパスワードであるの で、第三者がカード会員になりすましてネット商取引を行なうことは極めて困難となる [0214] In addition, the online payment assisting device normally does not expose the card number and can be known only by the card member, or if the authentication information possessed only by the card member is not entered, In addition, the password used to authenticate the cardholder during online payment is a one-time password that is not a fixed password, so a third party impersonates a cardholder. It is extremely difficult to conduct online commerce
[0215] 以上、ネット決済補助装置 1の実施例につき説明したが、本発明のネット決済補助 装置は、上記実施例で説明した構成要件の全てを備えたネット決済補助装置 1に限 定されるものではなぐ各種の変更及び修正が可能であり、個々の目的実現に必要 な構成要件を任意に組み合わせて、本発明のネット決済補助装置を構成することが 可能である。又、力かる変更及び修正についても本発明の特許請求の範囲に属する ことは言うまでもない。 [0215] While the embodiment of the online payment assistance device 1 has been described above, the online payment assistance device of the present invention is limited to the online payment assistance device 1 having all of the configuration requirements described in the above embodiment. However, various changes and modifications can be made, and the network settlement assistance device of the present invention can be configured by arbitrarily combining the constituent requirements necessary for realizing each purpose. It goes without saying that significant changes and modifications are also within the scope of the claims of the present invention.
[0216] 例えば、実施例では、クレジットカードのカード番号を用いたネット決済にっ 、て説 明したが、少なくともカード番号によってネット決済を行なうことが可能なカードであれ ば、クレジットカード以外に、デビットカード等のカードによる実施例も、本発明の特許 請求の範囲に属する。  [0216] For example, in the embodiment, the online payment using the card number of the credit card has been described. However, in addition to the credit card, the card can be used for at least the online payment by the card number. An embodiment using a card such as a debit card also falls within the scope of the claims of the present invention.
[0217] また、本実施例では、カード決済を利用したネット商取引に用いられるものとしたが 、カード会員が、ネット商取引のみを希望し、従来のプラスチックタイプの磁気カード 、ICカード等力もなるクレジットカードによるリアルの対面取引を希望しない場合には 、クレジットカードの発行は受けなくてもよぐ本発明のネット決済補助装置の所有者 1S 従来のプラスチックタイプのクレジットカードを必ずしも有して 、る必要はな 、。  [0217] Further, in this embodiment, the credit card is used for online commerce using card settlement. However, a card member wishes only for online commerce and has a credit card that can use conventional plastic-type magnetic cards, IC cards, etc. If you do not wish to have a real face-to-face transaction with a card, you do not need to issue a credit card. Owner of the Internet payment assistance device of the present invention 1S It is necessary to have a conventional plastic type credit card. Flower ,.
[0218] また、例えば、実施例では、 1のネット決済補助装置 1のカード情報格納部 13に、 1 種類のカード情報を有する 1カード会員のカード情報を格納し、認証情報格納部 15 に 1種類の認証情報を格納した場合を説明したが、複数のカード番号がカード情報 格納部 13に格納されてもよい。その場合の認証情報は、複数のカード番号を表示す るために共通の認証情報であってもよ！ヽし、カード番号と認証情報がそれぞれ対応し 、入力された認証情報によって、ディスプレイ 11に表示されるカード番号が異なるよう になっていてもよい。  [0218] Also, for example, in the embodiment, the card information storage unit 13 of one network payment assisting device 1 stores the card information of one card member having one type of card information, and the authentication information storage unit 15 stores 1 Although the case where the type of authentication information is stored has been described, a plurality of card numbers may be stored in the card information storage unit 13. The authentication information in that case may be common authentication information to display multiple card numbers! However, the card number and the authentication information may correspond to each other, and the card number displayed on the display 11 may be different depending on the input authentication information.
[0219] また、親子クレジットカード等、同一又は複数のカード番号を、複数人が使用する場 合は、それぞれの人によって異なる認証情報が認証情報格納部 15に格納されて ヽ てもよ 、し、共通の認証情報が格納されて 、てもよ 、。 [0219] Also, when the same or multiple card numbers, such as a parent and child credit card, are used by multiple persons, authentication information that differs for each person is stored in the authentication information storage unit 15. You can also store common authentication information.
[0220] また、上記実施例においては、カード情報と OTP生成情報が、ネット決済補助装置 1, la及び認証サーバ 7, 7aで、それぞれ、関連付けられている旨を述べた力 カー ド情報の盗聴を防止するため、カード情報と OTP生成情報が、直接的ではなく間接 的に関連付けられていても、特許請求の範囲に含まれるものとする。  [0220] Also, in the above embodiment, eavesdropping on the power card information stating that the card information and the OTP generation information are associated with each other in the online payment assisting device 1, la and the authentication servers 7, 7a, respectively. Therefore, even if the card information and the OTP generation information are associated indirectly rather than directly, they are included in the claims.
[0221] 具体的には、図 3の S 10において会員端末 2で入力されたカード情報力 S20, 30 で、加盟店端末 3、仲介サーノ ¾を経由して、最終的に認証サーバ 7, 7aに送信され ることになるが、認証サーバ 7, 7aはこの際、受信したカード情報のうち、カード番号 を、当該カード番号とは異なるユニークな番号に変換して、仲介サーバ 5を経由して 、加盟店端末 3に送信する（S40, 50において)。  [0221] Specifically, with the card information power S20, 30 input at the member terminal 2 in S10 of Fig. 3, the authentication server 7, 7a finally passes through the member store terminal 3, the intermediary service ¾. In this case, the authentication servers 7 and 7a convert the card number of the received card information into a unique number different from the card number and pass through the mediation server 5. , To the member store terminal 3 (in S40, 50).
[0222] 更に、このユニークな番号は、加盟店端末 2から会員端末 2に送信され、会員端末 2を経由して認証サーバ 7, 7a〖こ送信される（S60, 70において）。  [0222] Furthermore, this unique number is transmitted from member store terminal 2 to member terminal 2, and transmitted through authentication terminal 7, 7a via member terminal 2 (in S60, 70).
[0223] 当該ユニークな番号を受信した認証サーバ 7, 7aは、最初にカード番号をユニーク な番号に変換したのとは逆の変換ルールによって、ユニークな番号をカード番号に 変換し、変換されたカード番号に関連付けられて 、る OTP生成情報をワンタイムパス ワードの生成に用いることになる。  [0223] Upon receiving the unique number, the authentication servers 7 and 7a convert the unique number into the card number according to the reverse conversion rule of the card number first converted into the unique number. The OTP generation information associated with the card number is used to generate a one-time password.
[0224] このように、カード番号とカード番号以外のユニークな番号と OTP生成情報とが関 連付けられること〖こよって、 S10, S20, S30でカード番号が送信される以外は、ネッ トワーク 9a上を、カード番号が流れることがないので、カード番号を盗聴される可能性 が大幅に下がり、セキュリティ向上に寄与する。  [0224] As described above, the unique number other than the card number and the OTP generation information are associated with each other, so that the network 9a except the card number is transmitted by S10, S20, and S30. Since the card number does not flow above, the possibility of eavesdropping on the card number is greatly reduced, which contributes to security improvement.
[0225] また、上記実施例では、会員端末 2が加盟店端末 3にカード情報を送信し、認証サ ーバ 7, 7aが、加盟店端末 3からの依頼に基づき、図 2の S80においてカード会員の 本人認証を行なう場合について説明したが、本発明は必ずしもこれに限らない。  [0225] Further, in the above embodiment, the member terminal 2 transmits card information to the member store terminal 3, and the authentication servers 7, 7a receive the card at S80 in FIG. 2 based on the request from the member store terminal 3. Although the case of authenticating a member's identity has been described, the present invention is not necessarily limited to this.
[0226] 例えば、先に会員端末 2が認証サーバ 7, 7aにアクセスして、認証サーバ 7, 7aが カード会員専用の認証情報入力画面を会員端末 2に送信し、当該認証入力画面に 入力されたカード情報とワンタイムパスワードに基づいて、会員端末 2と認証サーバ 7 , 7aとの間でカード会員の本人認証を行なっておき、その結果、本人と確認されて以 降、所定条件 (例えば、所定時間、所定回数、所定加盟店等）内で、会員端末 2が、 加盟店端末 3のウェブサイトにアクセスして、ネット商取引を行えるようになつていても よい。 [0226] For example, first, the member terminal 2 accesses the authentication server 7 or 7a, and the authentication server 7 or 7a sends the card member-specific authentication information input screen to the member terminal 2, and is input to the authentication input screen. Based on the received card information and the one-time password, card member identity authentication is performed between the member terminal 2 and the authentication servers 7 and 7a. Within a predetermined time, a predetermined number of times, a predetermined member store, etc.) The website of the member store terminal 3 may be accessed to enable online commerce.
[0227] つまり、本発明のネット決済補助装置は、会員端末 2と、カード会社側の認証サー バ 7, 7aとの間で、カード会員の本人認証に用いられ、認証後、実際に加盟店のゥェ ブサイト等においてネット商取引が出来るようになることを基本としており、必ずしも、 加盟店端末 2からの本人認証依頼を前提として 、るものではな 、。  [0227] In other words, the online payment assisting device of the present invention is used for the authentication of the card member between the member terminal 2 and the authentication server 7 or 7a on the card company side. It is based on the fact that online commerce can be performed on the website of the company, and is not necessarily based on the request for authentication from the member terminal 2.
[0228] 本発明に於ける各手段、データベースは、その機能が論理的に区別されているの みであって、物理上あるいは事実上は同一の領域を為していても良い。又データべ ースの代わりにデータファイルであっても良いことは言うまでもなぐデータベースとの 記載にはデータファイルをも含んで 、る。  [0228] Each means and database in the present invention are only logically distinguished in function, and may be physically or virtually identical. Needless to say, a data file may be used instead of a database, and the description of a database includes a data file.
[0229] 上記実施例では、ネット決済システム上の端末やサーバ力 クレジットカードブラン ド (ネット商取引サービスの提供主体）、イシユア (カード会員の獲得'カード会員への カード発行主体)、ァクワイアラ (加盟店の獲得 ·契約*管理主体)、加盟店のそれぞ れが運営するものである旨を説明したが、これらは全て概念上'役割上、区別される ものであり、物理的には、イシユアとァクワイアラが同一である場合もあるし、また、タレ ジットカードブランド、イシユア、ァクワイアラが同一である場合もある。  [0229] In the above example, the terminal and server capabilities on the online payment system Credit card brand (providing entity for online commerce services), Ishiyure (acquisition of card members' card issuers to card members), Aquirer (member stores) However, these are all conceptually distinct from each other in terms of roles, and are physically different from Ishiyure. The quirer may be the same, and the turret card brand, issuer, and quirer may be the same.
[0230] 従って、例えば、本明細書において、ネット決済補助装置 1, laは、イシユア力も配 布されることに限定されるものではない。また、必ずしもネット決済システムの提供主 体がクレジットカードブランドである必要もない。また、イシユア端末 6と認証サーバ 7, 7aとァクワイアラ端末 4が同一であってもよい。また、仲介サーバ 5が、その他の端末 やサーバの 、ずれかと同一であってもよ 、。  [0230] Therefore, for example, in the present specification, the online payment assisting device 1, la is not limited to the distribution of the issue power. Also, it is not always necessary that the provider of the online payment system is a credit card brand. The issuer terminal 6, the authentication servers 7, 7a, and the acquirer terminal 4 may be the same. Also, the mediation server 5 may be the same as any other terminal or server.
[0231] 尚、本発明を実施するにあたり本実施態様の機能を実現するソフトウェアのプロダラ ムを記録した記憶媒体をシステムに供給し、そのシステムのコンピュータが記憶媒体 に格納されたプログラムを読み出し実行することによつても実現される。  [0231] In carrying out the present invention, a storage medium recording a software program that implements the functions of the present embodiment is supplied to the system, and the computer of the system reads and executes the program stored in the storage medium. This is also realized.
[0232] この場合、記憶媒体力 読み出されたプログラム自体が前記した実施態様の機能 を実現することとなり、そのプログラムを記憶した記憶媒体は本発明を構成する。  [0232] In this case, the read program itself realizes the functions of the above-described embodiments, and the storage medium storing the program constitutes the present invention.
[0233] プログラムを供給する為の記憶媒体としては、例えば磁気ディスク、ハードディスク、 光ディスク、光磁気ディスク、磁気テープ、不揮発性のメモリカード等を使用すること ができる。 [0233] As a storage medium for supplying the program, for example, a magnetic disk, a hard disk, an optical disk, a magneto-optical disk, a magnetic tape, a nonvolatile memory card, or the like should be used. Can do.
[0234] 又、コンピュータが読み出したプログラムを実行することにより、上述した実施態様 の機能が実現されるだけではなぐそのプログラムの指示に基づき、コンピュータ上で 稼働して 、るオペレーティングシステムなどが実際の処理の一部又は全部を行 、、そ の処理によって前記した実施態様の機能が実現される場合も本発明に含まれる。  [0234] Further, by executing the program read by the computer, not only the functions of the above-described embodiments are realized, but also the operating system that runs on the computer based on the instructions of the program is actually The present invention also includes a case where part or all of the processing is performed and the functions of the above-described embodiments are realized by the processing.
[0235] 更に、記憶媒体力も読み出されたプログラム力 コンピュータに挿入された機能拡 張ボードやコンピュータに接続された機能拡張ユニットに備わる不揮発性あるいは揮 発性の記憶手段に書き込まれた後、そのプログラムの指示に基づき、機能拡張ボー ドあるいは機能拡張ユニットに備わる演算処理装置などが実際の処理の一部あるい は全部を行 ヽ、その処理により前記した実施態様の機能が実現される場合も本発明 に含まれる。  [0235] Further, the program power from which the storage medium power is read is also written to a nonvolatile or volatile storage means provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer. Based on the instructions of the program, the processing unit provided in the function expansion board or function expansion unit may perform part or all of the actual processing, and the functions of the above-described embodiments may be realized by the processing. It is included in the present invention.
図面の簡単な説明  Brief Description of Drawings
[0236] [図 1]本発明のネット決済補助装置の外観及び電気的ハードウェア構成を示す構成 図である。  [0236] [FIG. 1] A configuration diagram showing an external appearance and an electrical hardware configuration of the online settlement assistant device of the present invention.
[図 2]ネット決済補助装置を用いたネット決済システムの概略接続構成図である。  FIG. 2 is a schematic connection configuration diagram of an internet settlement system using an internet settlement assistance device.
[図 3]ネット決済システムにおけるネット商取引のプロセスフローの一例を示す図であ る。  FIG. 3 is a diagram showing an example of a process flow of an online commerce in the online payment system.
[図 4]ネット決済システムにおけるネット商取引のプロセスフローにおいて、会員端末 に表示される画面の一例を示す図である。  FIG. 4 is a diagram showing an example of a screen displayed on a member terminal in the process flow of online commerce in the online payment system.
[図 5]ネット決済補助装置の操作手順及びディスプレイ画面遷移を示す図である。  FIG. 5 is a diagram showing an operation procedure and display screen transition of the online settlement assisting device.
[図 6]ネット決済補助装置を用いないネット決済システムをカード会員が利用するに際 し、事前に、カード会員の本人認証のためのパスワードを登録するために必要なシス テムの概略接続構成図である。  [Figure 6] Schematic connection configuration diagram of the system required to register a card member's password for authentication in advance when a cardholder uses an online payment system that does not use an online payment assistant. It is.
符号の説明  Explanation of symbols
[0237] 1 :ネット決済補助装置 [0237] 1: Online payment assistance device
10 :筐体  10: Housing
11 :ディスプレイ  11: Display
12 :キー操作部 12a:テンキー 12: Key operation section 12a: Numeric keypad
12b:スタートキー 12b: Start key
13:カード情報格納部13: Card information storage
14:認証手段 14: Authentication method
15:認証情報格納部 15: Authentication information storage
16: OTP生成手段16: OTP generation means
17: OTP生成情報格納部17: OTP generation information storage
18:計時手段 18: Timing method
19:駆動用電源  19: Power supply for driving
端  Edge
3:加盟店端末  3: Member store terminal
4:ァクワイアラ端末 5:仲介サーバ 4: Acquisition terminal 5: Mediation server
6:イシユア端末 6: Issure terminal
7:認証サーバ 7: Authentication server
9a:ネットワーク 9a: Network
9b:専用回線 9b: Private line

Claims

請求の範囲 The scope of the claims
[1] 可搬型のネット決済補助装置であって、  [1] A portable online payment assistance device,
ディスプレイと、  Display,
クレジットカードゃデビットカード等のカード契約者の識別情報を少なくとも含む力 ード情報が、外部から読み出せな 、ような状態で予め格納されたカード情報格納部 と、  A card information storage unit in which force information including at least identification information of a card contractor such as a credit card or a debit card cannot be read from outside;
前記契約者の本人認証を行なうための認証情報が、外部から読み出せな!/、ような 状態で予め格納された認証情報格納部と、  An authentication information storage unit in which authentication information for authenticating the contractor cannot be read from the outside! /
前記カード情報に関連付けられ前記ネット決済補助装置に固有の OTP生成情報 力 外部力 読み出せな 、ような状態で予め格納された OTP生成情報格納部と、 前記認証情報を入力する入力手段と、  An OTP generation information storage unit stored in advance in such a state that the OTP generation information force external force associated with the card information and unique to the online payment assisting device cannot be read, and an input means for inputting the authentication information;
前記入力手段から入力された入力情報に基づいて、前記ネット決済補助装置の操 作者が、前記契約者である力否かの本人認証を行ない、本人確認がなされた場合、 前記カード情報のうち、少なくとも前記識別情報を読み出して、前記ディスプレイに表 示する認証手段と、  Based on the input information input from the input means, the operator of the online payment assisting device authenticates the identity of the contractor and confirms the identity. Authentication means for reading at least the identification information and displaying it on the display;
前記カード情報が表示された後、前記 OTP生成情報に基づいて、ワンタイムパスヮ ードを生成し、前記ディスプレイに表示するワンタイムパスワード生成手段と、 を備え、  One-time password generation means for generating a one-time password based on the OTP generation information after the card information is displayed, and displaying the one-time password on the display;
前記ワンタイムパスワードによって、前記契約者の本人認証が行なわれ、本人確認 力 された場合、前記識別情報を用いた決済によるネット商取引が可能にされる ことを特徴とするネット決済補助装置。  The online payment assisting device, wherein when the user is authenticated and confirmed by the one-time password, online commerce by payment using the identification information is enabled.
[2] クレジットカードゃデビットカード等のカード契約者の携帯電話やパーソナルコンビ ユータ等の契約者端末と、前記契約者の本人認証を行なう認証サーバとが、相互に ネットワーク接続されたネット決済システムにお 、て、前記契約者の識別情報を用い た決済によるネット商取引を行なう際に用いられる、可搬型のネット決済補助装置で あって、  [2] A credit card or debit card or other card subscriber's mobile phone, personal computer or other subscriber terminal, and an authentication server that authenticates the subscriber's identity in a network payment system connected to each other. In addition, a portable online payment assistance device used when performing online commerce by payment using the identification information of the contractor,
前記ネット決済補助装置は、  The online payment assistance device
ディスプレイと、 前記契約者の識別情報を少なくとも含むカード情報が、外部から読み出せないよう な状態で予め格納されたカード情報格納部と、 Display, A card information storage unit in which card information including at least the identification information of the contractor is stored in advance so as not to be read from outside;
前記契約者の本人認証を行なうための認証情報が、外部から読み出せな!/、ような 状態で予め格納された認証情報格納部と、  An authentication information storage unit in which authentication information for authenticating the contractor cannot be read from the outside! /
前記カード情報に関連付けられ前記ネット決済補助装置に固有の OTP生成情報 力 外部力 読み出せな 、ような状態で予め格納された OTP生成情報格納部と、 前記認証情報を入力する入力手段と、  An OTP generation information storage unit stored in advance in such a state that the OTP generation information force external force associated with the card information and unique to the online payment assisting device cannot be read, and an input means for inputting the authentication information;
前記入力手段から入力された入力情報に基づいて、前記ネット決済補助装置の操 作者が、前記契約者である力否かの本人認証を行ない、本人確認がなされた場合、 前記カード情報のうち、少なくとも前記識別情報を読み出して、前記ディスプレイに表 示する認証手段と、  Based on the input information input from the input means, the operator of the online payment assisting device authenticates the identity of the contractor and confirms the identity. Authentication means for reading at least the identification information and displaying it on the display;
前記カード情報が表示された後、前記 OTP生成情報に基づいて、ワンタイムパスヮ ードを生成し、前記ディスプレイに表示するワンタイムパスワード生成手段と、 を備え、  One-time password generation means for generating a one-time password based on the OTP generation information after the card information is displayed, and displaying the one-time password on the display;
前記契約者端末が、前記ワンタイムパスワードを前記認証サーバに送信すること〖こ よって、前記契約者の本人認証が行なわれ、本人確認がなされた場合、前記ネット 商取引が可能にされる  The contractor terminal transmits the one-time password to the authentication server, so that the contractor's identity is authenticated, and the identity of the contractor is confirmed, the online commerce is enabled.
ことを特徴とするネット決済補助装置。  A net payment assistance device characterized by the above.
[3] 前記認証情報は、前記契約者が予め定めた暗証番号であり、  [3] The authentication information is a password predetermined by the contractor,
前記入力手段は、テンキーである  The input means is a numeric keypad
ことを特徴とする請求項 1又は請求項 2に記載のネット決済補助装置。  The network settlement auxiliary device according to claim 1 or claim 2, wherein
[4] 前記認証情報は、前記契約者の指紋 ·虹彩 ·声帯 ·顔写真等の生体的特徴を数値 化した生体情報である [4] The authentication information is biometric information obtained by quantifying the biometric features of the contractor's fingerprint, iris, vocal cord, facial photograph, etc.
ことを特徴とする請求項 1又は請求項 2に記載のネット決済補助装置。  The network settlement auxiliary device according to claim 1 or claim 2, wherein
[5] 前記 OTP生成情報は、 [5] The OTP generation information is
共通鍵であり、  A common key,
前記ワンタイムパスワード生成手段は、  The one-time password generating means
所定の操作キーの押下を検出して、前記操作キーが押下された日時からなる日時 データを、前記共通鍵によって暗号ィ匕してワンタイムパスワードを生成する ことを特徴とする請求項 1から請求項 4のいずれかに記載のネット決済補助装置。 Date and time consisting of the date and time when the operation key was pressed when a predetermined operation key was pressed 5. The network settlement assistance apparatus according to claim 1, wherein the one-time password is generated by encrypting data using the common key.
[6] 前記 OTP生成情報は、 [6] The OTP generation information is
共通鍵と、前記ワンタイムパスワードが生成される都度、更新される利用回数情報 によって構成され、  Consists of a common key and usage count information that is updated each time the one-time password is generated,
前記ワンタイムパスワード生成手段は、  The one-time password generating means
所定の操作キーの押下を検出して、前記利用回数情報を共通鍵によって暗号化し てワンタイムパスワードを生成し、  Detects pressing of a predetermined operation key, encrypts the usage count information with a common key to generate a one-time password,
前記ワンタイムパスワードが生成された後、前記 OTP生成情報格納部内の利用回 数情報を更新する  After the one-time password is generated, the usage count information in the OTP generation information storage unit is updated.
ことを特徴とする請求項 1から請求項 4のいずれかに記載のネット決済補助装置。  5. The online settlement auxiliary device according to claim 1, wherein
[7] 前記ネット決済補助装置は、耐タンパ性を備える [7] The online payment assisting device has tamper resistance.
ことを特徴とする請求項 1から請求項 6のいずれかに記載のネット決済補助装置。  7. The online payment assisting device according to claim 1, wherein:
PCT/JP2006/313658 2006-07-07 2006-07-10 Net settlement assisting device WO2008004312A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
KR1020087031300A KR101248058B1 (en) 2006-07-07 2006-07-10 Internet settlement system
CN2006800552299A CN101496024B (en) 2006-07-07 2006-07-10 Net settlement assisting device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
JP2006-188341 2006-07-07
JP2006188341A JP4388039B2 (en) 2006-07-07 2006-07-07 Internet payment system

Publications (1)

Publication Number Publication Date
WO2008004312A1 true WO2008004312A1 (en) 2008-01-10

Family

ID=38894290

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2006/313658 WO2008004312A1 (en) 2006-07-07 2006-07-10 Net settlement assisting device

Country Status (5)

Country Link
JP (1) JP4388039B2 (en)
KR (1) KR101248058B1 (en)
CN (1) CN101496024B (en)
TW (1) TW200805203A (en)
WO (1) WO2008004312A1 (en)

Cited By (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2008263548A (en) * 2007-04-13 2008-10-30 Toshiba Corp Communication terminal, information management system and information management method
CN101789864B (en) * 2010-02-05 2012-10-10 中国工商银行股份有限公司 On-line bank background identity identification method, device and system
CN104333555A (en) * 2014-11-14 2015-02-04 中国建设银行股份有限公司 Dynamic token working method and dynamic token working system
CN105208005A (en) * 2015-08-25 2015-12-30 宇龙计算机通信科技(深圳)有限公司 Fingerprint authentication method, connection equipment and terminal equipment
US9819676B2 (en) 2012-06-29 2017-11-14 Apple Inc. Biometric capture for unauthorized user identification
US9832189B2 (en) 2012-06-29 2017-11-28 Apple Inc. Automatic association of authentication credentials with biometrics
CN104333555B (en) * 2014-11-14 2018-02-09 中国建设银行股份有限公司 A kind of dynamic token method of work and system
US9959539B2 (en) 2012-06-29 2018-05-01 Apple Inc. Continual authorization for secured functions
US10212158B2 (en) 2012-06-29 2019-02-19 Apple Inc. Automatic association of authentication credentials with biometrics
CN109426913A (en) * 2017-08-31 2019-03-05 北京橙鑫数据科技有限公司 Management method, managing device and the electronic equipment of card
US10331866B2 (en) 2013-09-06 2019-06-25 Apple Inc. User verification for changing a setting of an electronic device
US10735412B2 (en) 2014-01-31 2020-08-04 Apple Inc. Use of a biometric image for authorization
JP2021533504A (en) * 2018-08-09 2021-12-02 株式会社センストーンSsenstone Inc. Smart cards that generate and provide virtual code and their methods and programs
US11676188B2 (en) 2013-09-09 2023-06-13 Apple Inc. Methods of authenticating a user

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2009078182A1 (en) 2007-12-19 2009-06-25 Icon Corp. Server device, information providing method and information succession system
US20090287603A1 (en) * 2008-05-15 2009-11-19 Bank Of America Corporation Actionable Alerts in Corporate Mobile Banking
JP5589471B2 (en) * 2010-03-19 2014-09-17 大日本印刷株式会社 Royalty management system, royalty management method and token
FR2963191B1 (en) * 2010-07-23 2012-12-07 Viaccess Sa METHOD FOR DETECTING UNLAWFUL USE OF A SECURITY PROCESSOR
KR101242024B1 (en) * 2011-01-14 2013-03-11 시큐어플랫폼즈테크놀로지(주) Method for Controlling Display of OTP Device, and OTP Device
KR101249587B1 (en) * 2011-09-09 2013-04-01 아이리텍 잉크 Smart card with OTP including iris image information
KR20130100872A (en) * 2012-02-22 2013-09-12 주식회사 엘지씨엔에스 Payment method by means of one time response code, payment server and operator terminal performing the same
CN104715361A (en) * 2013-12-17 2015-06-17 康迅数位整合股份有限公司 Mobile device paying system and method
KR101623710B1 (en) * 2014-11-19 2016-05-24 주식회사 텔스카 System and method for wirelessly generating one-time password in line with transaction information
KR101663699B1 (en) * 2015-07-20 2016-10-17 주식회사 비즈모델라인 Method for Providing Network type OTP by using Biometrics
KR101636068B1 (en) * 2015-09-25 2016-07-06 주식회사 비즈모델라인 Method for Operating OTP using Biometric

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH11316740A (en) * 1998-05-06 1999-11-16 Meidensha Corp One time password authentication system
JP2001312477A (en) * 2000-04-28 2001-11-09 Nippon Yunishisu Kk System, device, and method for authentication
JP2006072890A (en) * 2004-09-06 2006-03-16 Seiko Epson Corp Ic card
JP2006146914A (en) * 2004-11-15 2006-06-08 Agilent Technol Inc Identification card with biosensor, and user authentication method

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20010025234A (en) * 2000-11-09 2001-04-06 김진삼 A certification method of credit of a financing card based on fingerprint and a certification system thereof
KR100548638B1 (en) * 2005-08-03 2006-02-02 주식회사 하이스마텍 Creating and authenticating one time password using smartcard and the smartcard therefor

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH11316740A (en) * 1998-05-06 1999-11-16 Meidensha Corp One time password authentication system
JP2001312477A (en) * 2000-04-28 2001-11-09 Nippon Yunishisu Kk System, device, and method for authentication
JP2006072890A (en) * 2004-09-06 2006-03-16 Seiko Epson Corp Ic card
JP2006146914A (en) * 2004-11-15 2006-06-08 Agilent Technol Inc Identification card with biosensor, and user authentication method

Cited By (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2008263548A (en) * 2007-04-13 2008-10-30 Toshiba Corp Communication terminal, information management system and information management method
CN101789864B (en) * 2010-02-05 2012-10-10 中国工商银行股份有限公司 On-line bank background identity identification method, device and system
US10212158B2 (en) 2012-06-29 2019-02-19 Apple Inc. Automatic association of authentication credentials with biometrics
US9819676B2 (en) 2012-06-29 2017-11-14 Apple Inc. Biometric capture for unauthorized user identification
US9832189B2 (en) 2012-06-29 2017-11-28 Apple Inc. Automatic association of authentication credentials with biometrics
US9959539B2 (en) 2012-06-29 2018-05-01 Apple Inc. Continual authorization for secured functions
US10331866B2 (en) 2013-09-06 2019-06-25 Apple Inc. User verification for changing a setting of an electronic device
US11676188B2 (en) 2013-09-09 2023-06-13 Apple Inc. Methods of authenticating a user
US10735412B2 (en) 2014-01-31 2020-08-04 Apple Inc. Use of a biometric image for authorization
CN104333555B (en) * 2014-11-14 2018-02-09 中国建设银行股份有限公司 A kind of dynamic token method of work and system
CN104333555A (en) * 2014-11-14 2015-02-04 中国建设银行股份有限公司 Dynamic token working method and dynamic token working system
CN105208005A (en) * 2015-08-25 2015-12-30 宇龙计算机通信科技(深圳)有限公司 Fingerprint authentication method, connection equipment and terminal equipment
CN109426913A (en) * 2017-08-31 2019-03-05 北京橙鑫数据科技有限公司 Management method, managing device and the electronic equipment of card
JP7192089B2 (en) 2018-08-09 2022-12-19 株式会社センストーン Smart card, method and program for generating and providing virtual code
JP2021533504A (en) * 2018-08-09 2021-12-02 株式会社センストーンSsenstone Inc. Smart cards that generate and provide virtual code and their methods and programs
US11922411B2 (en) 2018-08-09 2024-03-05 SSenStone Inc. Smart card for generating and providing virtual code, and method and program therefor

Also Published As

Publication number Publication date
JP2008015924A (en) 2008-01-24
TWI304190B (en) 2008-12-11
KR101248058B1 (en) 2013-03-27
KR20090051147A (en) 2009-05-21
CN101496024B (en) 2013-05-01
TW200805203A (en) 2008-01-16
JP4388039B2 (en) 2009-12-24
CN101496024A (en) 2009-07-29

Similar Documents

Publication Publication Date Title
JP4388039B2 (en) Internet payment system
US11349847B2 (en) Unified identity verification
CN106688004B (en) Transaction authentication method and device, mobile terminal, POS terminal and server
CN105243313B (en) For the method whenever confirmed to verifying token
US9124433B2 (en) Remote authentication and transaction signatures
CN102057386B (en) Trusted service manager (TSM) architectures and methods
US7694130B1 (en) System and method to authenticate a user utilizing a time-varying auxiliary code
US8667285B2 (en) Remote authentication and transaction signatures
US8661520B2 (en) Systems and methods for identification and authentication of a user
US20210224795A1 (en) Escrow non-face-to-face cryptocurrency transaction device and method using phone number
TW201741922A (en) Biological feature based safety certification method and device
EP2733655A1 (en) Electronic payment method and device for securely exchanging payment information
US20110103586A1 (en) System, Method and Device To Authenticate Relationships By Electronic Means
US20030046237A1 (en) Method and system for enabling the issuance of biometrically secured online credit or other online payment transactions without tokens
TW201121280A (en) Network security verification method and device and handheld electronic device verification method.
JP2010170561A (en) Portable electronic charge and authorization device and method therefor
KR20210039920A (en) Mobile communication terminal for personal authentification, personal authentification system and personal authentification method using the mobile communication terminal
KR100968941B1 (en) Finance trade system using a otp
CA3154449C (en) A digital, personal and secure electronic access permission
JP2002269052A (en) System, method, and program for portable terminal authentication, and computer-readable recording medium stored with the same program
JP2009259297A (en) Network settlement auxiliary equipment
TWI677842B (en) System for assisting a financial card holder in setting password for the first time and method thereof
JP2017010246A (en) Information processing device, information processing system, information processing method, and program
JP2003323599A (en) Smart card and smart card system
TWI679603B (en) System for assisting a financial card holder in setting password for the first time and method thereof

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 200680055229.9

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 06768020

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 1020087031300

Country of ref document: KR

NENP Non-entry into the national phase

Ref country code: DE

NENP Non-entry into the national phase

Ref country code: RU

122 Ep: pct application non-entry in european phase

Ref document number: 06768020

Country of ref document: EP

Kind code of ref document: A1